Practical privacy and AI governance for professionals who need to move beyond frameworks and actually build something. Global perspective, zero fluff.

The Six Lawful Basis: What They Are, What They Need, and How to Choose the Right One

Part 1 of The Legal Basis Playbook Every piece of personal data your organisation processes needs a reason to exist. Not a business reason — though that matters too — but a legal reason. Under the GDPR, that reason is called a lawful basis for processing. Get it right, and you have

Privacy Policy vs. Privacy Notice: They're Not the Same Thing — And Confusing Them Is a Compliance Gap

Most privacy professionals use the word "notice" as if it means one thing. It doesn't. And the organisations that haven't figured that out yet are operating with a document masquerading as a privacy program. Let's fix that. First: The Distinction Most People

The Tool That Predates Every Privacy Law — and May Just Outlive Them All

A story about engineers, regulators, and a humble diagram that keeps showing up at the right time. It's the 1970s. There are no privacy laws. No GDPR. No data protection authorities. No DPIAs. The word "compliance" isn't keeping anyone up at night. But in

Your GDPR programme is your DPDPA head start. But only if you know which parts to carry forward

Every DPDPA playbook I have seen starts at zero. Gap assessments built as if the organisation never heard of privacy. Policy templates drafted as if consent frameworks don't already exist. Implementation timelines that completely ignore the three years of GDPR muscle the organisation spent building. I understand why.

"Same thing, different name." — The myth that's quietly breaking DPDPA implementations.

Built for privacy professionals who live inside the frameworks, not just around them. Practical analysis on GDPR, India's DPDPA, cross-jurisdictional compliance, and the operational layer most legal blogs skip.

Your RoPA is not a spreadsheet. It's the backbone of your entire privacy program

Let me tell you what most RoPA guides won't. They'll tell you what goes in a Record of Processing Activities. They'll list the fields. They'll show you a template. And then they'll leave you alone with a blank spreadsheet, a

I Work in Privacy. But Most of My Job Isn’t About Compliance.

When people hear “privacy,” they usually think of: Policies. Consent. Regulations. Checklists. And for a long time, I did too. But the more I’ve worked closely with products and teams, the more I’ve realised: Privacy work doesn’t really start with compliance. It starts with questions. Questions like: