A configuration error exposed sensitive HR dossiers to dozens of managers
A Hamburg regulator's retailer decision shows how access configuration, retention, and sensitive workplace notes can become one connected governance problem.
Germany
Pillar 03
Data, Technology & Intangibles
Accounts, data, code, licences and other invisible assets that the business assumes it can keep using.
Which critical permission or intangible right could fail under stress?
AccessDataLicensingVendor lock-in
Guides and case lessons
Read the system from more than one angle.
Background GPS continues after the app is closed
Canadian privacy findings involving an app's background location collection show how an abandoned business plan can leave a live data practice behind.
Canada
Mobile consent design became a EUR50 million case
CNIL's platform provider decision shows why layered notices and consent design can become the practical object of regulatory scrutiny, not a footer detail.
France / European Union
Bankruptcy turned sensitive data into a transferred business asset
A genetic-data investigation and later SEC filing connect credential stuffing, linked relatives and a completed Chapter 11 asset sale.
Canada / United Kingdom / United States
Outsourcing the system did not outsource the breach
A Singapore breach decision split consequences between a healthcare data owner and its IT provider, exposing the limits of vendor transfer language.
Singapore
When the network goes dark, the incident log can become the next data risk
A cyclone connectivity review reveals why offline workarounds need data-minimisation, custody and deletion rules before the network fails.
Australia (Queensland)
The buyer can inherit the notification work
An FTC order split data-breach consequences between a former owner and buyer, turning privacy diligence into an operating handover.
United States
The cloud region failed when heat defeated redundant cooling
A Google Cloud incident shows how extreme heat, cooling failure and recovery sequencing can reach systems that appear regionally resilient.
United Kingdom / global cloud services
Ransom-returned data is not an incident scope
A Canadian laboratory breach investigation shows why payment, returned data and regulator findings answer different incident questions.
Canada
A review response can disclose more than the complaint
A health-privacy settlement shows why reputation response authority should be separated from access to customer facts.
United States
A hidden spreadsheet tab turned redaction failure into a safety problem
An ICO penalty notice shows how a hidden spreadsheet tab turned a redaction mistake into a safety and workforce problem.
United Kingdom (Northern Ireland)
Voice deletion promises conflict with model training
A voice-assistant order shows why a deletion request may have a different technical meaning once children's voice and location data feed algorithmic systems.
United States
The AI inventory that cannot explain its use case
A list of AI tools becomes more useful when it records the decision use, affected people, data path, owner and material-change triggers.
EU framework illustration and voluntary US institutional framework; applicability Not assessed
The certificate expired exactly when the service needed it most.
A practical second lens for connecting a business-critical certificate or key to its service, owner, lifecycle triggers and replacement evidence.
General operational method informed by US institutional guidance; no reader-specific standard or compliance conclusion
The Cloud Exit Test That Was Never Run
A practical guide to separating a paper exit clause, an export capability and observed evidence from a controlled recovery exercise.
Operational method with an EU Data Act source lead; scope, dates and rights not assessed
A cybersecurity profile is a conversation between the board and the system
A NIST CSF Organizational Profile can expose ownership and trade-offs without becoming a certification, maturity score or legal safe harbour.
Voluntary US institutional framework; no regulated-sector conclusion
The domain was authenticated on paper. The report had nowhere to go.
An evidence-aware guide to assigning ownership around email-authentication records, report routes, exceptions and review triggers.
General operational method informed by US institutional material; no universal or reader-specific duty stated
Can You Prove the Environmental Claim You Repeat?
A source-to-claim record for checking environmental statements received from suppliers before they reach products, sales material or customers.
United Kingdom with a United States comparison
The service had an administrator. The business did not have a recovery path.
A critical SaaS tenant needs a reviewable account-holder, privileged-role, recovery and handoff record—not confidence in one current login.
General operational method informed by United States institutional guidance; provider and local-law treatment not assessed
The model changed quietly: who notices first?
A versioned change record can separate a vendor announcement from the buyer's tested operational impact, decision and rollback path.
General operational method; contract, privacy and legal scope Not assessed
DORA's subcontracting question: which critical service actually moves?
A DORA-related subcontracting map should connect an ICT service to its function, sub-provider, change route and exit dependency without assuming every vendor is in scope.
European Union financial-sector framework; entity, service and criticality scope Not assessed
The Digital Identity Wallet Question: Who Becomes the Relying Party?
A regulatory-radar guide to mapping role, purpose, user journey, requested attributes, evidence, data boundaries and change governance before integration.
European Union framework; Member State rollout, role and sector treatment not assessed
NIS2 supply-chain risk is not a vendor questionnaire
A supplier questionnaire can inform a NIS2-related review, but scope, supplier criticality, evidence, ownership and national implementation remain separate questions.
European Union directive framework; national law and entity scope Not assessed
The product changed after sale. The product file did not.
An EU-source-bounded analysis separating PLD liability from CRA cybersecurity while preserving version, evidence and unresolved product questions.
European Union source context only; product, role, market, national implementation, safety, defect, conformity, liability, reporting and recall outcomes unassessed
Open-Source Notices Are a Delivery Dependency
A release-evidence guide for connecting shipped components to licence records, notice treatment, named owners and visible exceptions.
Cross-market software-release method; licence and distribution effect not assessed
The release looked routine—until the question became, ‘Who accepted this change?’
A software build result is one release input; the decision record preserves the version, evidence, exception, owner, rollback condition and next review.
General operational method informed by United States institutional guidance; applicability not assessed
The vendor has an SBOM. Do you have a decision record?
An SBOM can identify software components, but an owner still needs a versioned record of receipt, review, exceptions, changes and incident use.
General operational method; no jurisdiction-specific conclusion
AI Vendor Contracts: Trace Data, IP and Open-Source Dependencies
Map what enters an AI service, what the vendor may retain or reuse, what leaves it, and which software and licence dependencies remain hidden.
Cross-market
European Accessibility Act: What E-Commerce SMEs Should Check Now
A scoped guide to the European Accessibility Act for consumer e-commerce, including the service microenterprise exemption and national-law limits.
European Union and Member State implementing laws
EU AI Act in 2026: Which Deadlines Moved—and Which Duties Did Not?
A dated owner’s map of the EU AI Act after the 2026 AI Omnibus, separating live transparency and GPAI rules from delayed high-risk duties.
European Union
EU Cyber Resilience Act: The 2026 Reporting Clock and 2027 Readiness
A practical CRA preparation map for digital-product businesses, separating September 2026 reporting from the December 2027 main obligations.
European Union
EU Data Act: Connected-Product Data and Cloud Switching in 2026
What business owners should verify under the EU Data Act now, before the connected-product design and cloud switching milestones arrive.
European Union
US Privacy and Cyber in 2026: Build a Trigger Map, Not One Checklist
A business-owner map of selected U.S. federal and state privacy and cyber triggers, including California’s 2026 rules and DROP duties.
United States — selected federal, California and Texas authorities
The rejected contract that did not erase a trademark licence
A US Supreme Court decision separates breach from rescission when a bankrupt licensor rejects an ongoing contract.
United States
The founder exit that carried the operating memory out
A 2026 Delaware decision shows how a founder's post-sale role, customer influence and mass data removal can converge into an IP crisis.
United States — Delaware