Work as a privacy manager with GDPR as the anchor. Validate a record of processing against what the business really does, choose the Art. 6 lawful basis and spot when special category data needs an Art. 9 condition, screen projects for a DPIA and mark up a draft that would not survive a regulator, walk an access and erasure request step by step, and review a processor contract for an AI tool. Fictional organisations throughout; not legal advice.
A gym chain's record of processing for its membership activity looks complete. Compare it with what the business really does, then pick the lawful basis for six everyday activities and handle two classic traps: staff consent and legitimate interests without a test.
An access and erasure request arrives as a social media message. Walk the case log step by step - when the clock started, how identity was checked, what was searched, redacted, refused and deleted - then deal with an extension request and a 'fishing expedition'.
Seven proposed projects at a retailer, from a canteen form to facial recognition. Screen each for a DPIA, mark up the draft DPIA for warehouse wearables, separate risks to people from risks to the company, and choose proportionate measures.
A private clinic wants an AI symptom-triage tool from an outside vendor. Settle the lawful basis and Art. 9 conditions, review the processor contract, work out what the vendor becomes if it trains on patient data, and make the go-live call.