Privacy and GDPR guides
The GDPR asks you to know what personal data you process, why, where it goes and how it is protected, and to be able to show it. These guides cover the records and assessments it requires and how to keep them current from your own systems.
- Deriving Your Article 30 RoPA From the CodebaseHow to generate a GDPR Article 30 record of processing from source code instead of maintaining it by hand: what to annotate, which fields derive cleanly, which require human judgement, and how the register stays current as the system changes.
- Wiring Privacy Records Into Your CI PipelineThe pipeline mechanics of keeping privacy records current: where the sync step belongs, what it should push, when to fail a build versus warn, and the failure modes that quietly stop a privacy manifest from being trustworthy.
- Fideslang: Describing Personal Data in an Open TaxonomyA practical guide to the fideslang privacy taxonomy — data categories, data subjects and data uses — why an open vocabulary beats a proprietary schema, and how to annotate a real codebase without boiling the ocean.
- International Data Transfers, From an Engineer's Point of ViewHow third-country transfers arise from ordinary infrastructure decisions — regions, CDNs, managed services, support access — how to detect them in your own stack, and what the privacy team needs from you when they do.
- The Record of Processing Activities: GDPR's Most Demanding Document, and How to Stop Maintaining It by HandThe Article 30 RoPA is the spine of GDPR accountability — and the document most likely to be quietly wrong. Here is what a RoPA actually has to contain, who really has to keep one, why the manual version drifts out of date the moment you ship, and how deriving it from your code keeps it true across every jurisdiction you operate in.
- Consent Monitoring: The Banner Is Not the ControlA consent banner proves you asked the question. It says nothing about whether your site actually honors the answer. Here is why continuous consent monitoring — not a one-time CMP setup — is the control regulators now expect, and how Noru makes it part of your living privacy program.
- Privacy Automation: From Code Scanning to Continuous CompliancePrivacy automation turns one-off audits into continuous, jurisdiction-wide compliance. Here's what it is, how an open privacy taxonomy standard lets you describe data once, and how scanning your source code keeps your data map, records, assessments, and audit evidence current across every regime you operate in.
- GDPR Compliance Guide: Complete Framework for Data Protection and PrivacyA complete guide to building a GDPR data protection programme: lawful bases, data subject rights, the implementation framework, tooling and common pitfalls.
- GDPR Implementation Guide: Step-by-Step Compliance for OrganizationsAchieve GDPR compliance with this step-by-step guide covering everything from initial assessment to continuous improvement, ensuring your organization's data protection practices meet regulatory standards.
- GDPR Data Protection Impact Assessment (DPIA): Complete Guide and TemplateLearn how to conduct GDPR Data Protection Impact Assessments (DPIAs) with our complete guide, including practical templates and steps to ensure compliance and protect individual privacy rights.
Trust, settled.
Reading about it is the slow way. See it running against your own systems.