I was shown a weight loss diet plan ad after asking Chat GPT for a weekly meal plan for a 70 year old man receiving high cortisone treatment. I hadn’t seen any advertising in Chat GPT conversations before this. Under what circumstances are ads shown? Specific words/phrases in the conversation clearly trigger specific ads. Doesn't this contravene the sharing/processing of personal information with/by third parties regulation under the GDPR? The response given was that the ads are ‘contextual’, not triggered by a single word. What does this mean going forward? I was not asked whether I consented to advertising when I subscribed, although the subscription is not a paid one. Are we to assume going forward that exposure to advertising based on the content of Chat GPT conversations is inevitable unless you pay? If so, shouldn’t this in itself be advertised/declared publicly? Leaching personal information without expressing intent to do so is still not ok. (EU user, not UK)

Can anyone tell me more about the paralegal/data privacy field? I have a BS in Comp Science, I did a data privacy internship two years ago and a co-op consulting part time for 1.5 years in data privacy. I’m interested in exploring data privacy and potential lawyer…but I really want to start off as a paralegal.

Just discovered that multiple people in my workplace (couple managers, HR person and IT obviously) have been monitoring all my computer and phone activity (not just emails, browsing history etc) without telling me.

Considering I don't believe I've done anything that would warrant this level of monitoring would this class as a GDPR/employee rights violation?

It is for the scenery view. The camera is far enough away than people's faces are not identifiable at full uncompressed resolution. General bodyshape and clothes colours could be determined as well as things like if they are walking a dog, pushing a stroller, riding a bike etc. The feed can be scrubbed up to 12hrs prior.

Due to the inability to identify anyone outside of these details, is there a data privacy concern? Would this make me a data controller?

I requested uber to delete my account 10 months ago in January. We are now in October. Every 30 days I get an email saying the account will be deleted in 30 days and then in 30 days I get a new email saying the account will be deleted in 30 days. When I contact their data officer I’m told I need to login and request account deletion, despite the email saying that logins will cancel the deletion request. They’re also replying in French when I’ve never emailed them in French or used French on my account. Anyone had any luck in getting their account deleted?

We're in the middle of selecting an ecommerce platform for a European operation and our DPO has flagged EU data residency as a hard requirement (not just a configuration preference), and the platforms we're evaluating have meaningfully different answers to where customer data and session tokens actually sit.

The issue holding up our processor agreement review is that some platforms treat EU-region deployment as a configuration layer on top of a US-origin controller, which means signing SCCs, while others are built with EU-resident controllers from the ground up, and the compliance review looks quite different depending on which side of that line a platform sits on.

Our DPO flagged Scayle and Spryker as the 2 EU-native options on our list, both built out of Germany and structuring their DPAs with EU-resident controllers by default, and said those were the ones she could review most straightforwardly without needing SCC negotiations on top.

We'd assumed the EU hosting question was just about picking the right region setting, but where the platform company is incorporated turned out to be the harder constraint to satisfy, and it's not something you find in the standard sales deck.

We use several recruitment agencies and recently had a question come up that I couldn't find a clear answer to.

An agency sends us a candidate's CV which then gets shared with the relevant people involved in the recruitment process. That might mean email attachments, downloads, phones or occasionally a printed copy.

If that candidate later asks the agency to delete their information, what are we reasonably expected to do about all those copies?

We can delete the original copy shared with us and anything we can find, but I don't see how we can know whether someone downloaded a copy somewhere else or printed it.

How do other employers actually handle this in practice, and where does our GDPR responsibility end?

Hi r/gdpr.

I've posted the linked post in Legal advice, the top commenter has said my situation may be a gdpr breach but unfortunately I don't know or understand enough about this to get an idea of how realistic it is.

Any advice appreciated.

I work in privacy and AI (think governance, operations, DPIAs and ROPA etc, automations). What site is best for finding new roles? I use linkedin but their new search sucks and I feel like I’m missing some roles. UK based. Thank you

edit: https://bohojobs.co.uk/ seems to be the best site for the UK.

I've an employment dispute ongoing with my employer. Earlier this year I sent them a subject access request. They acknowledged it and extended the deadline because it was "complex".

My solicitor later sent a separate request. It didn't replace mine and even referred to mine as pending. After my deadline passed, the company said they'd treated my request as withdrawn because of hers. They've since admitted in writing that I never withdrew it and that it was never processed.

Key documents still haven't been provided, and a follow-up letter from my solicitor has gone unanswered. She's advised focusing on the employment case, which I agree with, but I'd like to know what else is open to me on the GDPR side.

Has anyone been in a similar spot? Is a DPC complaint worth it, or is there another route that actually gets results?

For context i have autism and just started at a new job
A week into starting i sent some information regarding a house on my estate being issued notice now following the complaints from other residents about said property, and made a comment about the amount they owe to the council.

I did not realise this could constitute GDPR breach, however was pulled up on it by my line manager who showed me messages.

This information i knew about the estate comes from outside of work, apart from the notice being issued - which i saw from my flat window and so did many others.
I also knew about the amount they owe to council as the estate management team had informed me once that they were not paying any CT and i knew the property had been empty for 4+ years

Im worried im going to get dismissed from my job, i did not mean for this to be a breach and if i had known i wouldnt have done it. I didnt know that informing my estate that there was finally action being done on a property was breach of gdpr and my own owing calculations could also be a breach

Any advice and likelihoods of what will happen next are welcomed. They are going to do an investigatory meeting with myself.

In February I submitted an Article 17 request to Discord to erase my messages (760k in my data export). Their first reply explained why they don't offer bulk deletion:

"Consistent with GDPR, Discord balances the privacy interests of the user against the interests other users have in a conversation and the ability for us to provide the service as a whole. ... If a given text channel were suddenly missing important context, it would be confusing to other users or possibly mislead those users about what happened in that conversation."

The same reply says "we offer users the ability to edit or delete their own messages", and suggests holding shift to delete faster.

They asked for a CSV of message IDs, and didn't act on it until my third submission. They then bulk-deleted my messages in servers and group chats I'd left, despite saying "We don't offer the ability to delete your messages in bulk right now", but not the rest. Their explanation:

"At this time, Discord processes message deletions for content located in spaces the user no longer has access to. We do not offer the bulk deletion of messages in spaces that the user does have access to. While we understand you may have questions about what constitutes as an "accessible space," we're unable to provide further internal details, as access permissions are managed dynamically within our platform and may vary depending on a number of factors."

So the manual delete button is effectively how Discord complies with erasure, and it only steps in where you can't use it. Since you can't leave a one on one DM, DMs aren't erased on request.

I know GDPR doesn't require any specific tool. My issue is that Article 17(1) puts the obligation to erase on the controller, and "do it yourself" seems to shift that onto the data subject, 640k messages in my case. That's hard to square with Article 12(2).

The balancing argument also undercuts itself. A manually deleted message leaves exactly the same gap in context as a bulk deleted one. If other users' interests really outweighed mine, the delete button shouldn't exist either. And in servers I'd left, the other members can still read my messages, but Discord deleted those anyway.

Two more things:

DMs between my own two accounts. Both accounts made the request, in the same email chain and through the support site. Discord confirmed the submission in March with its standard caveat that messages in "accessible spaces" wouldn't be deleted, but never said this applied to a DM where both participants had requested erasure. Those messages are still there over six months later. No third party is involved.

Unanswered questions. Discord says deleting your account "anonymizes" messages by removing usernames, emails and IPs. I asked which metadata is actually erased vs. pseudonymised, and which Article 17(3) exception they rely on. No answer to either so far.

I've had a complaint with the Irish DPC since April, and it was transferred to the Cross Border Assessment team in June. I'm not looking for advice on my case, but I'm curious how people here read the general questions:

Can a controller satisfy Article 17(1) by relying on manual self-deletion tools, and is limiting bulk erasure to "inaccessible spaces" compatible with the Article 12(2) duty to facilitate rights?

Where every participant in a conversation has requested erasure, what basis could a controller have for retaining it?

Is "access permissions are managed dynamically" an adequate explanation under Articles 12(1) and 12(4), where the legal basis for retention hasn't been stated?

As per title, has anyone already filed requests under GDPR after the LG wiretap scandal?

Access request to get what they have on file.
Erasure to delete the data
Restriction of processing to stop all use (perhaps while waiting for eventual Class Action lawsuits to open)
Withdrawal of consent to stop use?

I’m wondering about doing this myself.

Hi guys, not sure if this is the correct subreddit to post this in. My local gym located in the U.K. has now put in place a rule where every member has to upload a picture of themselves clearly showing their face, otherwise entry will be refused.

This picture is to be uploaded to an online community app that every member has access to and every member can see each member's profile picture.

Does this breach GDPR laws?

Is the phone sync contact really an issue when using the free WhatsApp business app, or is the problem overstated by companies trying to sell you data management and compliance support?

I'm interviewing for an AI adoption role at a big manufacturer in Germany. A chunk of the job is preparing privacy documentation so the DPO can review new internal AI tools quickly. I've built AI tools at startups, where this barely existed, so I'm trying to understand how it works in practice.

Concrete example: a tool that reads defect photos from the line and drafts the defect report. The report includes the name of the worker who filed it, and photos sometimes catch faces or badges.

Would you DPIA that, or is a records-of-processing entry plus a short screening enough? Where do you draw the line for internal tools touching employee data?

Also curious what you wish business teams sent you up front so you aren't chasing them for basics.

Not after legal advice, just how practitioners actually run this.

To what extent is the use of plain text, ie unencrypted text, acceptable in email?

In the last few years I've had dealings with pension providers, local authorities, UK gov, lawyers who have all provided secure communications channels.

But the vast majority of emails are sent in the clear and readable by anyone who can watch network traffic into or out of mail servers. Those emails will often disclose

1 email addresses

2 personal names

3 maybe phone numbers

4 maybe addresses

And might have much much more.

What are the GDPR consequences of that?

Do any big businesses or government departments have filters on their OUTbound mail service to stop employees accidentally sending protected things to their personal email addresses?

Hi everyone,
I’m a solo developer based in France building a small educational web app. Students upload course material and generate flashcards, multiple-choice quizzes, summaries and practice exams.
It isn’t a companion chatbot or a social platform. However, some potential users are high-school students aged 15–17, not just adult university students.
I’m trying to understand the API requirements for end users, rather than the age restrictions for creating a personal ChatGPT or Claude account.
The architecture is standard: users interact with my app, and my backend calls the provider using my API key. I don’t explicitly include account names, emails or user IDs in prompts. However, uploaded documents and written answers could contain personal information, so I don’t want to assume everything is anonymous.
The difficult part is understanding how to implement the requirements properly without creating an unnecessarily intrusive signup process:
OpenAI’s developer guidance discusses safeguards for under-18 users, parental consent and additional restrictions on processing younger children’s personal data.

Anthropic has guidance for products serving minors, but I’m unsure how its practical requirements compare with OpenAI’s.

Provider requirements and French/EU privacy rules are separate, which makes it difficult to know what an appropriate setup actually looks like.

One option I’m considering is:
No AI access for users under 15.

Anthropic for users aged 15–17, with appropriate safeguards.

OpenAI or Anthropic for adults.

A short age declaration at signup, enforced on the backend.

A parental approval flow wherever required.

This is a proposed setup, not something I’m claiming is compliant.
For developers who have actually dealt with this:
Have you received written clarification from OpenAI or Anthropic about an educational app used by teenagers?

What age checks do you use: self-declaration, birth date, parental email approval or a third-party verification service?

If you use parental approval, how do you establish that the person approving is genuinely a parent without collecting identity documents?

Does your provider require zero data retention for your particular users and use case? Have you managed to obtain it as a small business?

Have you had this setup reviewed professionally, and what changes were recommended?

I’d particularly appreciate firsthand experiences from small educational apps in the EU, or links to relevant official API terms. Please distinguish personal-account rules from rules for applications built on the API.
I’m not looking for advice to ignore the requirements because the app is small. I want a practical, proportionate way to address them without turning a simple study tool into a heavy identity-verification process.
Thanks!

First, is it still allowed? And besides not using the vendor, what would be the alternative?

I accidentally sent two work emails today to my personal email, I work in local government in revenues. One was just a generic account number for me to check on the software, and the other was a land reg TR1 form, both accidentally forwarded to my personal email instead of my work. I told my manager who said to be more careful in future and deleted the emails off my personal account.

Is there anything for me to worry about with this? Data breach risk or reporting wise

Hi everyone,

I’m a lawyer based in Latam working in data protection and compliance. I’m looking to deepen my knowledge of the GDPR and develop practical skills relevant to the DPO role.

I’m particularly interested in online, self-paced courses in English

One option I’m considering is the German Compliance Institute’s DPO Certification Training:
https://germancomplianceinstitute.com/products/data-protection-officer-dpo-certification-training

Has anyone taken this course? Would you recommend it in terms of content, practical usefulness, and recognition within the privacy profession?

I’d also appreciate recommendations for alternatives:

• Which GDPR courses or DPO certification programmes would you recommend?
• What did you pay, and did the price include the exam and certificate?
• How much practical training was included
• Would you suggest pursuing CIPP/E or CIPM instead of, or alongside, a DPO-focused course?

My priorities are solid content, practical application, and value for money. First-hand experiences—including courses you wouldn’t recommend—would be very helpful.

Thanks in advance!