Insights

A joint follow-up by Lawrence Advocaten and Hunt & Hackett to the three-part series on shadow AI. The first three parts of this series focused on how organizations can manage shadow AI from legal and organizational perspectives. Policy, approved applications,...

Part 3 of a four-part series on shadow AI for DPOs and privacy officers. Shadow AI, the use of AI tools such as ChatGPT, Claude or Gemini outside the view of IT and the DPO, presents legal risks that we...

Part 2 of a four-part series on shadow AI for DPOs and privacy officers. Shadow AI is the use of AI tools such as ChatGPT, Claude, or Gemini outside the purview of IT and the DPO, often through free personal...

Part 1 of a four-part series on shadow AI for DPOs and privacy officers. At the end of 2025, the municipality of Eindhoven reported to the Dutch Data Protection Authority (AP) that employees had uploaded Youth Act documents, CVs, and...

Incident response under new EU data and cyber legislation doesn't require five separate checklists, but one evidence-based process. A joint publication by Lawrence Advocaten and Hunt & Hackett When a cyber incident occurs, an organization has more important things to...

Most organizations now have a DPIA template. The problem is often not that the template is missing, but that it insufficiently compels correct or complete completion. In practice, this results in DPIAs that fall short on precisely the points that...

Most AI tools deployed by organizations for recruitment, CV screening, or performance monitoring fall under the most stringent regime of the AI Act, and many organizations are not yet fully aware of this. For the Data Protection Officer (DPO), this...

Many organizations use American (sub)processors for cloud hosting, HR software, marketing tooling, and security monitoring. As soon as personal data leaves the European Economic Area ("EEA")—or is physically accessible from a third country (for example, for remote support)—the regime of...

Who owns your face, your voice, and your words in the age of synthetic personas, aka AI clones? The rise of AI clones (realistic-looking and sounding AI representations of real people) marks a shift in how identity is legally understood...

The EU's 2030 Digital Agenda sets the course for a European digital future, with accompanying new legislation. This new legislation brings numerous changes and obligations for various organizations and is therefore also relevant for M&A practice, as the scope of...

The EU's 2030 Digital Agenda sets the course for a European digital future, with accompanying new legislation. This new legislation brings numerous changes and obligations for various organizations and is therefore also relevant for M&A practice, as the scope of...

The EU's 2030 Digital Agenda sets the course for a European digital future, with accompanying new legislation. This new legislation brings numerous changes and obligations for various organizations and is therefore also relevant for M&A practice, as the scope of...