Insights

Shadow AI, de AVG en datalekken (2): datalek en modelrisico’s

Shadow AI, GDPR, and Data Leaks (2): Data Leaks and Model Risks

Part 2 of a four-part series on shadow AI for DPOs and privacy officers. Shadow AI is the use of AI tools such as ChatGPT, Claude, or Gemini outside the purview of IT and the DPO, often through free personal...

Shadow AI, de AVG en datalekken (1): wat shadow AI is en wat de AVG eist

Shadow AI, the GDPR and data breaches (1): what shadow AI is and what the GDPR requires

Part 1 of a four-part series on shadow AI for DPOs and privacy officers. At the end of 2025, the municipality of Eindhoven reported to the Dutch Data Protection Authority (AP) that employees had uploaded Youth Act documents, CVs, and...

Cyber Security Incidenten melden begint met weten wat er is gebeurd

Reporting Cyber Security Incidents starts with knowing what happened

Incident response under new EU data and cyber legislation doesn't require five separate checklists, but one evidence-based process. A joint publication by Lawrence Advocaten and Hunt & Hackett When a cyber incident occurs, an organization has more important things to...

Voldoet jouw DPIA-template? Vijf controlepunten voor diepgang en onderbouwing. Lawrence Advocaten.

Does your DPIA template meet the requirements? Five checkpoints for depth and substantiation

Most organizations now have a DPIA template. The problem is often not that the template is missing, but that it insufficiently compels correct or complete completion. In practice, this results in DPIAs that fall short on precisely the points that...

In dit blog bespreken we hoe AI-tools binnen de HR moeten worden gekwalificeerd onder de AI Act, welke verplichtingen daarbij op hoofdlijnen horen en hoe een FG daar in de praktijk mee aan de slag kan.

HR AI Tools under the AI Act: What Does the DPO Need to Know?

Most AI tools deployed by organizations for recruitment, CV screening, or performance monitoring fall under the most stringent regime of the AI Act, and many organizations are not yet fully aware of this. For the Data Protection Officer (DPO), this...

Data Privacy Framework en SCC’s: wanneer heb je bij doorgiften naar de VS SCC’s en een TIA nodig?

Data Privacy Framework and SCCs: when do you need SCCs and a TIA for transfers to the US?

Many organizations use American (sub)processors for cloud hosting, HR software, marketing tooling, and security monitoring. As soon as personal data leaves the European Economic Area ("EEA")—or is physically accessible from a third country (for example, for remote support)—the regime of...

Nieuwe EU-datawetgeving en de M&A praktijk: Data Act & Data Governance Act

New EU data legislation and M&A practice: Data Act & Data Governance Act

The EU's 2030 Digital Agenda sets the course for a European digital future, with accompanying new legislation. This new legislation brings numerous changes and obligations for various organizations and is therefore also relevant for M&A practice, as the scope of...

Nieuwe EU-datawetgeving en de M&A praktijk: DSA

New EU data legislation and the M&A practice: DSA

Nieuwe EU-datawetgeving en de M&A praktijk: NIS2 en DORA

New EU data legislation and M&A practice: NIS2 and DORA

Our experts