Practical guides, regulatory updates, and insights to help your business stay compliant.
A first look at what UK and EU privacy regulators fined businesses for: marketing calls, cookie banners, ignored requests, cameras and WhatsApp groups.
From 1 January 2027, browsers must offer Global Privacy Control. What your stack must do when Sec-GPC: 1 arrives, mapped to the fines already issued.
A CIPA demand letter says your site's pixels or chat tool broke a California wiretap law. What the letter is, what SB 690 changed, and what to do first.
A Singapore yoga teacher messaged 1,200 former students on email and WhatsApp after six years away. Why that was luck, and the setup that fixes it.
South Korea's amended PIPA took effect on 11 September 2026. The "10% of revenue" headline is not the standard fine. Here is what changed for small firms.
The EU AI Act's transparency duties have applied since 2 August 2026. If you use an AI chatbot or AI content and sell into the EU, here is what changed.
Most small-business breaches are not hackers — they are a newsletter with every address visible. What to do in the first 72 hours, hour by hour.
A two-person web studio kept dodging one client question: "are we OK on cookies?" How it became their first new recurring revenue line in six years.
Japan's APPI reaches businesses abroad that sell to people in Japan. What it asks of you, what the 2026 amendment changes and how it differs from the GDPR.
Australian privacy law for small businesses in 2026: why the small business exemption still exists, the exceptions that override it, and what changed.
What the UK GDPR, Data Protection Act 2018 and PECR ask of a small business in 2026: the ICO fee, cookies, access requests, breaches and the DUAA changes.
California's privacy law reaches further than many small businesses expect. Who is covered, what you owe, what changed in 2026, and what changes in 2027.
There is no single US privacy law: a federal patchwork, a growing set of state laws, and one rule for every business: do what your privacy notice says.
Privacy rules for Canadian small businesses in 2026: which law applies, what PIPEDA and Quebec's Law 25 require, where CASL fits, and what may come next.
Singapore's PDPA applies to every business, however small. What it asks, the DPO duty most miss, the 31 December 2026 NRIC deadline, and where to start.
Malaysia's PDPA now carries breach deadlines, DPO duties and higher penalties. What a small business has to do, and what it can safely ignore.
Thailand's PDPA has applied in full since 2022, and the PDPC issues fines. What a small business has to do, and what the first fines were for.
Tokyo vinyl shops sell across one counter to customers from a dozen countries. Which privacy rules apply, and which start once you sell abroad on purpose.
A friend's children's book brand falls under COPPA, the US kids' privacy law with no small-business exemption. What that means and how to start right.
A friend gave a roastery her email, then a stranger's ad arrived. How Australia's Privacy Act and Spam Act see a shared list, and how to run one well.
You give your number for reward points and your name lights up on the counter screen. How to design loyalty program privacy well under Singapore's PDPA.
No website does not mean no data-protection duties. What a UK yoga teacher with a spreadsheet and WhatsApp risks, and the QR-code privacy notice fix.
A wine shop, a mailing list and a template privacy notice: the UK privacy gaps most small businesses have, what they risk in 2026, and four cheap fixes.
Run a free privacy scan of your Shopify store, no sign-up. See where you stand on GDPR, UK GDPR, CCPA and more in under a minute. From $10/month.
Selling on Instagram, Etsy or at the counter? You still collect customer data. Take Dxtra's free 30-second privacy check. No website required.
A plain-English guide to Dxtra's free privacy scan, from first click to a fixed, provable result. No legal background needed; results in under a minute.
A free privacy scan gives accountancies and corporate-service firms a concrete way to open the privacy conversation and build a recurring practice line.
Dxtra's free scan reads a site the way a regulator does, cites every finding to a named source and publishes its method, with docs and an API to fix gaps.
What Dxtra's privacy scanner observes on a site's public surface, how each finding maps to a named source, and why the methodology is published openly.
Both laws protect personal data, but the requirements differ. A practical breakdown for businesses operating in both the EU and California.
Cookie consent requirements continue to evolve. Here is what small businesses need to know about compliant cookie banners and consent management.
When a customer asks 'what data do you have on me?', you need to respond within one month. Here is how to handle DSARs efficiently.
India's DPDP Rules were notified in November 2025, and most business duties apply from May 2027. If you serve customers in India, here is what to prepare.
Selling online means collecting personal data. Product recommendations, abandoned cart emails, analytics — it all needs to be compliant.
GDPR does not just apply to large enterprises. If you collect personal data from EU residents, even as a small business, you need to comply. Here is how.
Customers want to know how their data is handled. A Transparency Center shows them — and builds genuine trust in the process.
Get privacy compliance insights delivered to your inbox. No spam — just practical guides and regulatory updates.
We respect your privacy. Unsubscribe anytime.
