Practical guides, regulatory updates, and insights to help your business stay compliant.
A first look at what UK and EU privacy regulators fined businesses for: marketing calls, cookie banners, ignored requests, cameras and WhatsApp groups.
California's Opt Me Out Act requires browsers to offer a Global Privacy Control setting from 1 January 2027. Here is what your stack has to do when `Sec-GPC: 1` arrives, mapped to the fines that already happened.
A CIPA demand letter says your website's pixels or chat tool broke a California wiretap law. Here is what the letter is, what SB 690 changed, and the first things to do.
After six years away, a Singapore-based yoga teacher emailed and WhatsApped 1,200 former students from Manchester, Dubai and Singapore. Nobody complained. Here is why that was luck, and the simple setup that makes it not matter.
South Korea's amended PIPA takes effect 11 September 2026. The "10% of revenue" headline is not the standard fine. Here is what changed for a small business.
The EU AI Act's transparency obligations became applicable on 2 August 2026. If your small business uses an AI chatbot or publishes AI-generated content and sells into the EU, here's what changed — and the five things to do this week.
Most small-business breaches are not hackers — they are a newsletter with every address visible. What to do in the first 72 hours, hour by hour.
A two-person web studio kept getting the same client question — "are we OK on cookies?" — and kept dodging it. Here's how they turned the question they feared into their first new recurring revenue line in six years.
Japan's APPI reaches businesses outside the country that sell to people in Japan. Here is what it asks of you today, what the July 2026 amendment changes, and where the rules differ from the European model you may already know.
A plain-English look at where Australian privacy law actually stands for small businesses in 2026, including why the small business exemption still exists, the exceptions that quietly override it, and what the 2024 reforms changed.
A plain-English walkthrough of what the UK GDPR and the Data Protection Act 2018 ask of a small business in 2026 — the ICO fee almost everyone misses, cookie consent, access requests, breaches, and what the Data (Use and Access) Act 2025 actually changed.
California's privacy law reaches further than most small business owners expect, and the revenue threshold is only one of three ways in. Here is who is covered, what you owe, and what changed this year.
There is no single United States privacy law. There is a federal patchwork, a growing set of state laws, and one rule that reaches every business regardless of size: what your privacy policy says, you have to actually do.
A plain-English walkthrough of the privacy rules that apply to Canadian small businesses in 2026 — which law governs you, what PIPEDA and Quebec's Law 25 actually require, where CASL fits, and what Parliament is considering next.
Singapore's PDPA applies to your business no matter how small it is, and it includes one requirement almost every small business misses. Here is what it asks of you, what changes by the end of 2026, and where to start.
Malaysia's Personal Data Protection Act now carries breach notification deadlines, DPO duties and higher penalties after the 2024 amendments. Here is what a small business actually has to do, and what it can safely ignore.
Thailand's Personal Data Protection Act has been fully in force since 2022, and the regulator is now issuing fines. Here is what a small business collecting customer data actually has to do, and where the recent penalties came from.
Niche shops sell across a counter in one country to customers from a dozen others. This looks at Tokyo's second-hand vinyl trade to work out which privacy rules actually apply, and which only apply once you start selling abroad on purpose.
A friend launched a children's book brand — and it pulls in COPPA, the US kids'-privacy law with no small-business exemption. Here's what “directed to children” really means, the newsletter trap, the 2025 rule changes, and how to start kid-safe (and win parents' trust).
You give a small roastery your email for their updates — and a stranger's ad turns up. Sharing a mailing list is the fastest way to burn customer trust. Here's how Australia's Privacy Act and Spam Act actually see it, and how to run a list you'd be proud of.
You give your mobile number to help track reward points and your name lights up on the counter screen for everyone to see. As small businesses scale and add loyalty, privacy becomes dozens of tiny moments — here's how to design them well under Singapore's PDPA.
No website doesn't mean no data-protection duties. If you run your clients on a spreadsheet and WhatsApp, here's what you actually risk — and the one-page privacy notice (shared by QR code) that sorts it.
A wine shop, a mailing list, and a privacy policy that's still the WordPress template — the UK privacy gaps almost every small business has, what they actually risk in 2026, and the four cheap fixes.
Run a free privacy scan of your Shopify store — no sign-up. See where you stand on GDPR, UK GDPR, CCPA and more in under a minute, and exactly what to fix. From $10/month.
No website? You still collect customer data, so the law still applies. Take Dxtra's free 30-second privacy check for social and marketplace sellers — no website required, from $10/month.
A plain-English guide to Dxtra's free privacy scan for business owners — from the first click to a fixed, provable result. No legal background needed; the scan itself takes under a minute.
A free, regulator-grade privacy scan gives corporate-service firms a concrete reason to open the privacy conversation with every client. See how to turn it into a recurring practice line — on your margin, under your brand.
Most privacy scanners check cookies and stop. Dxtra's reads a site the way a regulator does, cites every finding to a named source, and publishes its methodology open-source so you can verify it — then gives you the API to fix what it finds.
An evidence-first look at Dxtra's privacy scanner: what it observes on a site's public surface, how each finding maps to a named source, and why the methodology and regulatory reference are published openly.
GDPR doesn't just apply to large enterprises. If you collect personal data from EU residents — even as a small business — you need to comply. Here's how to do it without hiring a consultant.
Both laws protect personal data, but the requirements differ. A practical breakdown for businesses operating in both the EU and California.
Customers want to know how their data is handled. A Transparency Center shows them — and builds genuine trust in the process.
Cookie consent requirements continue to evolve. Here's what small businesses need to know about compliant cookie banners and consent management.
When a customer asks 'what data do you have on me?', you need to respond within 30 days. Here's how to handle DSARs efficiently.
Selling online means collecting personal data. Product recommendations, abandoned cart emails, analytics — it all needs to be compliant.
India's Digital Personal Data Protection Act is now in effect. If you serve Indian customers, here's what it means for your business.
Consent banners are not enough. From California to the EU, regulators are demanding that opt-out and objection requests are honored everywhere data flows — from cookies to CRMs. Here is what that means for your business.
Get privacy compliance insights delivered to your inbox. No spam — just practical guides and regulatory updates.
We respect your privacy. Unsubscribe anytime.
