Insights

A mid-size hotel holds more sensitive data per customer than most banks: payment cards, passport numbers, loyalty data, and travel patterns in one place. This analysis covers the four attack surfaces that matter most, and what a credible security baseline actually looks like.

Healthcare AI is moving fast, but most tools that process health data create GDPR and EU AI Act obligations that generic guidance misses entirely. Five questions to ask before any clinical or administrative AI deployment.

DORA has applied across the EU since January 2025. Most financial services firms have addressed the five operational resilience pillars. Third-party ICT risk, where the real exposure sits, remains the gap.

Cyber insurers now require specific technical controls before binding cover and before paying claims. This guide covers what underwriters check, how claims get evaluated, and which exclusions are catching organisations out.

NIS2 became enforceable across EU member states on 17 October 2024. Most large and medium enterprises in the Netherlands are now subject to it whether they know it or not. This guide covers scope, the 10 mandatory measures, and notification timelines.

Eight years on, many organisations still have gaps in the basics: no lawful basis documented, breach response plans that miss the 72-hour window, and processing records that have never been updated. This guide covers the obligations that matter most.