GDPR & Privacy

Data protection and privacy compliance

GDPR and AI: The "Right to Be Forgotten" Now Means "Unlearning"

When GDPR's Article 17 was written, 'erasure' meant deleting a row from a database. In 2026, it means something far more complicated. If a user's data was used to train an AI model, deleting the database record isn't enough. The data has been absorbed into model weights, influencing predictions for every subsequent user. The EDPB has made right to erasure its coordinated enforcement priority for 2025-2026, with 30 data protection authorities investigating how organisations handle deletion requests. And the Italian DPA already fined OpenAI 15 million euros for, among other things, failing to handle training data properly under GDPR. This post explains what machine unlearning is, why it's a nightmare for developers, and what practical architectural decisions you can make right now to avoid the problem in the first place.

KIAIData ScienceData ScienceDSGVOGDPRMachine LearningMachine LearningSaaSSaaS

The EU AI Act Kicks In August 2026: What SaaS Builders Need to Know

The EU AI Act's biggest enforcement date is August 2, 2026. That's less than five months away. High-risk AI system obligations, transparency rules, and the full enforcement framework all go live on that date. If you build SaaS products that use AI and serve European customers, this directly affects you. This post explains the four risk tiers, how to figure out which one your product falls into, what the obligations actually mean in practice, and what you should be doing right now. No legal jargon. Practical guidance from someone building AI-powered SaaS for the European market.

KIAIDACHDACHeCommerceeCommerceDSGVOGDPRSaaSSaaS

The NIS2 Directive Explained: What SaaS and eCommerce Businesses Actually Need to Do

The NIS2 Directive is now active across the EU, covering SaaS providers, cloud platforms, online marketplaces, and digital service providers. Fines reach up to 10 million euros. If you run a SaaS platform or ecommerce business serving EU customers, here is what you need to know and what you need to do.

eCommerceeCommerceDSGVOGDPRMarketing AutomationMarketing AutomationSaaSSaaS

The EU Cyber Resilience Act Is Coming: What It Means, Who Needs to Prepare, and How I Can Help

The EU Cyber Resilience Act entered into force in December 2024, with reporting obligations kicking in September 2026 and full enforcement by December 2027. If you build, sell, or distribute software or connected products in the EU, this affects you. Here is what you need to know, what you need to do, and how a Growth Hacker and SaaS developer with cybersecurity experience can help you get compliant.

eCommerceeCommerceDSGVOGDPRMarketing AutomationMarketing AutomationSaaSSaaS