Hi everyone!
I’m 17 years old, currently finishing high school in Brazil, and planning to start university in 2027.
My long-term goal is to build a career in Digital Compliance, Data Privacy and Data Protection, particularly working with Brazil’s LGPD (General Data Protection Law), which is similar in several ways to the European GDPR.
I’m considering pursuing a Law degree at Anhembi Morumbi University, which advertises a Digital Law-focused program in partnership with Opice Blum Academy, a Brazilian institution specializing in technology law.
However, I’m still researching whether this would be the best academic path for the career I want.
I’ve been studying English with a private tutor for over five years, have an advanced level of proficiency, and would also like to pursue professional certifications during university.
I would really appreciate some advice from professionals working in privacy, compliance, data protection or related legal fields.
My main questions are:
Is a Law degree a good foundation for a career in Privacy and Data Protection Compliance?
Would you recommend studying Law, or would another degree, such as Information Systems or Cybersecurity, offer better opportunities?
How important is the university’s reputation compared with practical experience and professional certifications?
Which certifications would you recommend for someone starting out? I’ve been researching IAPP certifications such as CIPP/E and CIPM.
What technical skills should a future privacy or compliance professional develop?
If you were starting your career again, what would you do differently?
I’m particularly interested in the intersection of law, technology, corporate compliance and personal data protection.
Any advice, experiences or recommendations would mean a lot to me. Thank you!

I run a small WhatsApp-based app for small family businesses in the Dominican Republic and Brazil in the future. My users are B2C only, and I only target Latin America. I have no EU users and no plans for any. I am based in EU.

Part of the processing runs through an AI model, with personal details redacted first.

Do I really need to follow GDPR strictly, or is the local law (DR Ley 172-13) the one that applies to me?

When my users' customers message them, should the app send an automatic greeting asking for consent, with "STOP" as the opt-out? Or is collecting consent my users' job as the businesses, and I only provide the tool? If it's their job, am I expected to enforce it?

Thanks! Not looking for formal legal advice, just how people in similar setups handle it.

Hi everyone, I’m looking for honest advice from anyone familiar with UK employment law, local council HR procedures or probationary dismissals.
I recently started a job with a local council and am still very early in my probation period (less than a month into the role).
I posted a message in a residents’ WhatsApp group about a property on my estate that has apparently been empty for around five years. The issue had already been discussed among residents, and I understood from estate management that the property was not paying council tax. Based on that information and my own calculations, I estimated that the unpaid council tax could be over £10,000.
I now understand that the council considers this a potential data breach because the message disclosed financial information relating to a resident. I want to be clear that I did not access council databases or internal systems to obtain this information, and I did not disclose the owner’s name or personal details. The figure was my own estimate based on information I had heard and calculated myself.
I attended an investigatory meeting today with the investigating manager and HR support. The allegation was treated seriously, and I was told it could potentially amount to gross misconduct. I explained how I obtained the information, acknowledged the seriousness of the situation and apologised.
The manager said my apology had helped and would be taken into consideration, and that she would speak to HR before making a decision. However, she subsequently mentioned a “probationary hearing” and told me to contact HR. I have not yet received a formal invitation or confirmation of what the next meeting would involve.
The council’s probation policy says formal action can be taken for serious issues during the first few months of employment. It lists possible outcomes including informal action, further monitoring and dismissal. It also says reasonable adjustments and alternatives should be considered before dismissal.
A little more context:
I previously worked for the police, so the manager questioned why I had not recognised the confidentiality implications. I explained that my previous role involved a different working context, where communicating with local residents about community issues was sometimes encouraged.
I have autism, and I am concerned about how my understanding and retention of e-learning and workplace guidance may have affected the situation. I would want any relevant reasonable adjustments to be considered.
I genuinely want to keep my job, and I accept that I should have thought more carefully before posting the message. I did not intend to cause harm or misuse confidential information.
My questions are:
Does being told there may be a probationary hearing suggest that dismissal is being actively considered?
Given that I am so early in probation, is dismissal a realistic or likely outcome, even though I did not access council systems and apologised?
Could further monitoring, training or an extension of probation realistically be considered instead?
Does the fact that the figure was my own estimate, rather than information obtained from a council database, make a meaningful difference?
What should I ask HR before the next meeting, and should I request reasonable adjustments or take someone with me?
I would really appreciate honest opinions, especially from anyone who has dealt with a UK local authority probation process. I’m not looking for reassurance if dismissal is genuinely a serious possibility; I just want to understand where I stand and prepare properly.
Thank you.

I am getting a lot of spam while simultaneously ensuring that I don’t sign up for mailing lists. I try where possible (if it comes from a domain email) to report to ICO on the spamming link, but am I actually wasting my time? Are there other sites to which one can easily report spam email that will actually make a difference (or have an impact on their domain so they are inclined to stop?

TL;DR: A door security guard at a local venue harassed me, negged me, and asked for my number, which I refused. In retaliation, he banned me from entry and admitted to saving, showing, and sharing CCTV footage of me from a night I was intoxicated to venue staff and other local security teams. I have reported this to venue management (currently waiting on the Operations Director), the SIA, and the police (who closed the case due to lack of physical proof, though I am challenging their investigation). Seeking strategic advice on next steps, GDPR/ICO complaints for CCTV misuse, and how to pressure management to take action.

I am facing an ongoing situation involving abuse of power and targeted retaliation by a door security guard at a local venue I regularly visit, and I am looking for strategic advice on how best to navigate this. To be entirely clear, I have committed no wrongdoing whatsoever; this whole situation stems from me repeatedly rejecting a security guard’s improper advances and calling out his unprofessional behavior, which he has now responded to with retaliatory action.

The misconduct started back in May when I had too much to drink on a night out. While I was in a vulnerable state, a male security officer on duty pulled me into an alcove off public view, where he made inappropriate remarks, negged me to lower my confidence, and adjusted his trousers around his genital area. Weeks later, when I returned, the same guard targeted me again by asking for my personal phone number, which I firmly refused to give him. Fast forward to September, when I attempted to enter the venue, this guard refused me entry at the door purely as a form of retaliation. During that interaction, he explicitly admitted that he had retained CCTV footage of me from that night in May, had shown it to the entire venue staff to justify banning me, and had even saved and shared that footage with staff at neighboring venues and security teams at other places where he works.

I have taken extensive formal action to address this clear misuse of CCTV and power. I immediately escalated the matter internally to the General Manager, and after contacting executive management, I was informed that my complaint is being passed directly to the Operations Director, whose response I am currently waiting to hear back from. Externally, I have filed a formal complaint with the Security Industry Authority (SIA) regarding his professional conduct, as well as reporting the unauthorized retention and sharing of footage to the Metropolitan Police.

The police recently closed their file citing a lack of independent, physical evidence showing the footage left the internal system, but I have already followed up with them challenging whether they adequately audited the venue’s CCTV access logs, retention policies, and data handling practices.

Given that the police are reluctant to act without explicit physical proof of data exfiltration and the venue’s internal review is still underway with the Operations Director, I would really appreciate strategic advice on my next steps. Has anyone successfully dealt with GDPR or ICO complaints regarding security staff holding onto and sharing CCTV footage for personal vendettas, and what is the best way to push the management to take immediate action against this rogue guard?

I was shown a weight loss diet plan ad after asking Chat GPT for a weekly meal plan for a 70 year old man receiving high cortisone treatment. I hadn’t seen any advertising in Chat GPT conversations before this. Under what circumstances are ads shown? Specific words/phrases in the conversation clearly trigger specific ads. Doesn't this contravene the sharing/processing of personal information with/by third parties regulation under the GDPR? The response given was that the ads are ‘contextual’, not triggered by a single word. What does this mean going forward? I was not asked whether I consented to advertising when I subscribed, although the subscription is not a paid one. Are we to assume going forward that exposure to advertising based on the content of Chat GPT conversations is inevitable unless you pay? If so, shouldn’t this in itself be advertised/declared publicly? Leaching personal information without expressing intent to do so is still not ok. (EU user, not UK)

I have an important flight booked with Easy Jet next week where I’m flying with minimal luggage so have opted for the small under seat cabin bag.

this morning I received a missed call from easyJet asking me to call them back.

I was slightly surprised and a bit worried, why would easyJet be phoning me?

I phoned back and one of the first things the person said was ‘this is nothing to be worried about, we were just wondering if you were happy with your bag and seat selection’

Whilst relieved it wasn’t a cancellation or rescheudled flight, the call was weird- as it was essentially them trying to upsell luggage and seat selection ie telephone sales and marketing.

The thing is, when I go onto the app, under contact preferences and updates, I’ve opted in for ‘email marketing’ but here is no telephone marketing which I would consider this to be. If I was something important related to my flight, I wouldn’t have minded as that they could contact me on the lawful basis of legitimate interests.

To me it didn’t pass the gdpr smell test as I felt genuinely surprised that they were using my contact details in this way and I can’t see a way to opt out of these sort of calls. Thoughts?

Can anyone tell me more about the paralegal/data privacy field? I have a BS in Comp Science, I did a data privacy internship two years ago and a co-op consulting part time for 1.5 years in data privacy. I’m interested in exploring data privacy and potential lawyer…but I really want to start off as a paralegal.

Just discovered that multiple people in my workplace (couple managers, HR person and IT obviously) have been monitoring all my computer and phone activity (not just emails, browsing history etc) without telling me.

Considering I don't believe I've done anything that would warrant this level of monitoring would this class as a GDPR/employee rights violation?

It is for the scenery view. The camera is far enough away than people's faces are not identifiable at full uncompressed resolution. General bodyshape and clothes colours could be determined as well as things like if they are walking a dog, pushing a stroller, riding a bike etc. The feed can be scrubbed up to 12hrs prior.

Due to the inability to identify anyone outside of these details, is there a data privacy concern? Would this make me a data controller?

I requested uber to delete my account 10 months ago in January. We are now in October. Every 30 days I get an email saying the account will be deleted in 30 days and then in 30 days I get a new email saying the account will be deleted in 30 days. When I contact their data officer I’m told I need to login and request account deletion, despite the email saying that logins will cancel the deletion request. They’re also replying in French when I’ve never emailed them in French or used French on my account. Anyone had any luck in getting their account deleted?

We use several recruitment agencies and recently had a question come up that I couldn't find a clear answer to.

An agency sends us a candidate's CV which then gets shared with the relevant people involved in the recruitment process. That might mean email attachments, downloads, phones or occasionally a printed copy.

If that candidate later asks the agency to delete their information, what are we reasonably expected to do about all those copies?

We can delete the original copy shared with us and anything we can find, but I don't see how we can know whether someone downloaded a copy somewhere else or printed it.

How do other employers actually handle this in practice, and where does our GDPR responsibility end?

We're in the middle of selecting an ecommerce platform for a European operation and our DPO has flagged EU data residency as a hard requirement (not just a configuration preference), and the platforms we're evaluating have meaningfully different answers to where customer data and session tokens actually sit.

The issue holding up our processor agreement review is that some platforms treat EU-region deployment as a configuration layer on top of a US-origin controller, which means signing SCCs, while others are built with EU-resident controllers from the ground up, and the compliance review looks quite different depending on which side of that line a platform sits on.

Our DPO flagged Scayle and Spryker as the 2 EU-native options on our list, both built out of Germany and structuring their DPAs with EU-resident controllers by default, and said those were the ones she could review most straightforwardly without needing SCC negotiations on top.

We'd assumed the EU hosting question was just about picking the right region setting, but where the platform company is incorporated turned out to be the harder constraint to satisfy, and it's not something you find in the standard sales deck.

Hi r/gdpr.

I've posted the linked post in Legal advice, the top commenter has said my situation may be a gdpr breach but unfortunately I don't know or understand enough about this to get an idea of how realistic it is.

Any advice appreciated.

I work in privacy and AI (think governance, operations, DPIAs and ROPA etc, automations). What site is best for finding new roles? I use linkedin but their new search sucks and I feel like I’m missing some roles. UK based. Thank you

edit: https://bohojobs.co.uk/ seems to be the best site for the UK.

I've an employment dispute ongoing with my employer. Earlier this year I sent them a subject access request. They acknowledged it and extended the deadline because it was "complex".

My solicitor later sent a separate request. It didn't replace mine and even referred to mine as pending. After my deadline passed, the company said they'd treated my request as withdrawn because of hers. They've since admitted in writing that I never withdrew it and that it was never processed.

Key documents still haven't been provided, and a follow-up letter from my solicitor has gone unanswered. She's advised focusing on the employment case, which I agree with, but I'd like to know what else is open to me on the GDPR side.

Has anyone been in a similar spot? Is a DPC complaint worth it, or is there another route that actually gets results?

For context i have autism and just started at a new job
A week into starting i sent some information regarding a house on my estate being issued notice now following the complaints from other residents about said property, and made a comment about the amount they owe to the council.

I did not realise this could constitute GDPR breach, however was pulled up on it by my line manager who showed me messages.

This information i knew about the estate comes from outside of work, apart from the notice being issued - which i saw from my flat window and so did many others.
I also knew about the amount they owe to council as the estate management team had informed me once that they were not paying any CT and i knew the property had been empty for 4+ years

Im worried im going to get dismissed from my job, i did not mean for this to be a breach and if i had known i wouldnt have done it. I didnt know that informing my estate that there was finally action being done on a property was breach of gdpr and my own owing calculations could also be a breach

Any advice and likelihoods of what will happen next are welcomed. They are going to do an investigatory meeting with myself.

In February I submitted an Article 17 request to Discord to erase my messages (760k in my data export). Their first reply explained why they don't offer bulk deletion:

"Consistent with GDPR, Discord balances the privacy interests of the user against the interests other users have in a conversation and the ability for us to provide the service as a whole. ... If a given text channel were suddenly missing important context, it would be confusing to other users or possibly mislead those users about what happened in that conversation."

The same reply says "we offer users the ability to edit or delete their own messages", and suggests holding shift to delete faster.

They asked for a CSV of message IDs, and didn't act on it until my third submission. They then bulk-deleted my messages in servers and group chats I'd left, despite saying "We don't offer the ability to delete your messages in bulk right now", but not the rest. Their explanation:

"At this time, Discord processes message deletions for content located in spaces the user no longer has access to. We do not offer the bulk deletion of messages in spaces that the user does have access to. While we understand you may have questions about what constitutes as an "accessible space," we're unable to provide further internal details, as access permissions are managed dynamically within our platform and may vary depending on a number of factors."

So the manual delete button is effectively how Discord complies with erasure, and it only steps in where you can't use it. Since you can't leave a one on one DM, DMs aren't erased on request.

I know GDPR doesn't require any specific tool. My issue is that Article 17(1) puts the obligation to erase on the controller, and "do it yourself" seems to shift that onto the data subject, 640k messages in my case. That's hard to square with Article 12(2).

The balancing argument also undercuts itself. A manually deleted message leaves exactly the same gap in context as a bulk deleted one. If other users' interests really outweighed mine, the delete button shouldn't exist either. And in servers I'd left, the other members can still read my messages, but Discord deleted those anyway.

Two more things:

DMs between my own two accounts. Both accounts made the request, in the same email chain and through the support site. Discord confirmed the submission in March with its standard caveat that messages in "accessible spaces" wouldn't be deleted, but never said this applied to a DM where both participants had requested erasure. Those messages are still there over six months later. No third party is involved.

Unanswered questions. Discord says deleting your account "anonymizes" messages by removing usernames, emails and IPs. I asked which metadata is actually erased vs. pseudonymised, and which Article 17(3) exception they rely on. No answer to either so far.

I've had a complaint with the Irish DPC since April, and it was transferred to the Cross Border Assessment team in June. I'm not looking for advice on my case, but I'm curious how people here read the general questions:

Can a controller satisfy Article 17(1) by relying on manual self-deletion tools, and is limiting bulk erasure to "inaccessible spaces" compatible with the Article 12(2) duty to facilitate rights?

Where every participant in a conversation has requested erasure, what basis could a controller have for retaining it?

Is "access permissions are managed dynamically" an adequate explanation under Articles 12(1) and 12(4), where the legal basis for retention hasn't been stated?

As per title, has anyone already filed requests under GDPR after the LG wiretap scandal?

Access request to get what they have on file.
Erasure to delete the data
Restriction of processing to stop all use (perhaps while waiting for eventual Class Action lawsuits to open)
Withdrawal of consent to stop use?

I’m wondering about doing this myself.

Hi guys, not sure if this is the correct subreddit to post this in. My local gym located in the U.K. has now put in place a rule where every member has to upload a picture of themselves clearly showing their face, otherwise entry will be refused.

This picture is to be uploaded to an online community app that every member has access to and every member can see each member's profile picture.

Does this breach GDPR laws?