Fortiton’s Post

The most load-bearing phrase in cookie compliance is "strictly necessary", and it gets used to cover far more than it means. The exemption is narrow. It exists for what a service genuinely cannot provide without the cookie — holding a session, keeping a shopping basket, balancing load, protecting against fraud and abuse. Those are functions the user asked for and cannot get otherwise. It is not a category for analytics. Measuring how people use the site is useful, and it is not necessary for the service to work. It is not a category for advertising, personalisation or A/B testing either. Those all rest on consent, and consent means a choice made before the cookies are set, not a notice shown after. The distinction matters because the sequence is the thing you may have to defend. A page that sets analytics cookies on first paint and then offers a banner has the banner in the wrong place: the processing already happened. That is precisely what the free scanner reports — which cookies and trackers fire, in what order, relative to any consent signal it can see on the page. It names them rather than scoring the site, so you can check the sequence yourself: https://lnkd.in/dDrx27AP Visit fortiton.com #CookieConsent #GDPR #Privacy #Trackers #Fortiton

The single most common way a data subject request goes wrong is not that nobody answered it. It is that it was answered late, because the clock was believed to have started when the request reached the right team. It does not work that way. The statutory window runs from the moment the request is received by the organisation, not from the moment it is recognised, forwarded, triaged or assigned a ticket number. A request that spends three days in a shared inbox before privacy sees it has still spent those three days inside the window. In practice this means the risk sits with everyone who talks to customers. A reply to a marketing email, a message to a sales rep, a form submission, a comment on a social profile — any of those can be a request, and none of them is less of a request for arriving in an unexpected place. Two things reduce the exposure. First, make sure anyone customer-facing can recognise a request and knows where to send it the same day. Second, work from the date of arrival rather than the date of discovery, so the response date is right even when internal routing was slow. Our free calculator does the second part. Give it the arrival date and the regime, and it returns the response date with any extension applied, plus the notice date that an extension carries. Work out a date: https://lnkd.in/dTvUD99F Visit fortiton.com #DSAR #GDPR #Privacy #DataSubjectRights #Compliance #Fortiton

Ask ten people what they want from a privacy notice and most will give the same answer: how long do you keep my data, and what are you doing with it. Notice how often that line is missing, or present in a form that does not answer the question. "We retain your data as long as necessary for the purposes described" is a sentence that restates the question. A reader cannot act on it, and neither can an assessor. Where a fixed period is not possible, the criterion that determines it is the next best thing — the event or rule that triggers deletion. That is a real answer, and it is what a reader is looking for when they scan the page for the word retention. The useful property of this kind of statement is that it is checkable from the outside, for presence at least. Nobody external can confirm the retention is actually happening, but anyone can confirm whether the notice says what it is. Our free privacy policy check fetches a site, finds the notice and reports which of the statements a reader would and would not find in it. No signup, and it shows what it looked for: https://lnkd.in/dxXkKk8S Visit fortiton.com #PrivacyPolicy #GDPR #Privacy #Compliance #Fortiton

We have eight free tools on the site. None of them asks you to sign up, and none of them ends in a sales call. Here they are, in the order privacy teams tend to use them: The DSAR deadline calculator works out the statutory response date for a data subject request across eight regimes, applies the extension rules, and returns the notice date as well as the deadline. The EU AI Act risk classifier places a system in its tier — prohibited, high-risk, transparency-only or minimal — and shows the obligations that follow from it. The website privacy checker scans a site for cookies, trackers and consent gaps and gives you a report you can hand to someone else. Then there are four readiness checks — GDPR, NIS2, the privacy policy check and DSAR readiness — which are the same scan read four ways, each on its own page. All eight are here: https://fortiton.com/tools They exist because these are questions with answers. A deadline is arithmetic with rules. A tier is a classification. None of that should sit behind a demo request. Visit fortiton.com #Privacy #GDPR #AIAct #NIS2 #Compliance #Fortiton

Compliance failures are usually described as failures of policy. Some of the most expensive ones are failures of arithmetic, and they have a single cause: the date was worked out from the wrong starting point. The statutory clock on a data subject request runs from the moment the organisation receives it. Not when privacy is told. Not when it is assigned an owner. Not when somebody finally has time to look at it. Internal routing, inboxes and workload are real constraints, and none of them changes the date the person is owed an answer by. Which means the only thing that legitimately changes the window is the regime the request falls under — and, where the rules allow it, an extension that carries its own notice deadline. Start from the arrival date and you get a date you can defend. Start from the discovery date and you get a date that is quietly wrong, right up until somebody checks. The free calculator takes the arrival date, applies the regime and any extension, and returns both the response date and the notice date: https://lnkd.in/dTvUD99F Visit fortiton.com #DSAR #GDPR #Privacy #Compliance #Fortiton

The statutory clock on a data subject request starts when the request arrives. Not when your team notices it, not when it reaches the right inbox, and not when someone opens a ticket. In practice requests arrive everywhere: a reply to a marketing email, a support chat, a message to a sales rep, a post on a social profile. Each of those starts a clock the moment it lands, and none of them is a defence for having started late. Two things follow. First, everyone who talks to customers needs to recognise a request when they see one. Second, you need the date out of someone's head and into something you can look at. Our free calculator does the second part: pick the regime, give the arrival date, and it returns the response date with the extension rules and the notice date applied — no signup. Work out a date: https://lnkd.in/dTvUD99F Visit fortiton.com #DSAR #GDPR #Privacy #DataSubjectRights #Fortiton

Most AI governance work is about what happens before a system goes live: the classification, the documentation, the oversight plan. The obligation teams are least prepared for is the one that starts when something has already gone wrong. Providers of high-risk AI systems have a serious incident reporting duty. When a system causes or contributes to a serious incident, the provider reports it to the market surveillance authorities of the member states where it happened, and the Regulation sets the time it has to do that in. The reason this is worth raising before it happens is that it is a duty with a clock attached, and clocks behave badly in the absence of a procedure. The questions it forces are unglamorous and specific: Do we know which of our systems are high-risk, so we know which incidents this applies to? Who decides that something has crossed into "serious"? Who can find the logs, the version, and the instructions the deployer was given? Most organisations can answer the first question only after walking the classification, which is exactly what the free classifier is for: https://lnkd.in/d2-Ca6-j Visit fortiton.com #AIAct #EUAIAct #AIGovernance #IncidentResponse #Compliance #Fortiton

The statutory clock on a data subject request starts when the request arrives. Not when your team notices it, not when it reaches the right inbox, and not when someone opens a ticket. In practice requests arrive everywhere: a reply to a marketing email, a support chat, a message to a sales rep, a post on a social profile. Each of those starts a clock the moment it lands, and none of them is a defence for having started late. Two things follow. First, everyone who talks to customers needs to recognise a request when they see one. Second, you need the date out of someone's head and into something you can look at. Our free calculator does the second part: pick the regime, give the arrival date, and it returns the response date with the extension rules and the notice date applied — no signup. Work out a date: https://lnkd.in/dTvUD99F Visit fortiton.com hashtag #DSAR hashtag #GDPR hashtag #Privacy hashtag #DataSubjectRights hashtag #Fortiton

There is a duty in the EU AI Act that almost never appears on a maturity assessment, because it does not produce a score or a dashboard: AI literacy. It requires providers and deployers of AI systems to take measures to ensure a sufficient level of AI literacy among their staff and anyone else dealing with the operation and use of those systems on their behalf. Note the two things that make it easy to underestimate. It applies to deployers as well as providers. You do not have to build anything to owe it. And it is about the people who actually work with the system, not just a specialist team. The analyst using a generated summary, the recruiter running a screening tool, the support agent with an AI drafting assistant — those are the people the duty is aimed at. The practical form of it is not a certification. It is being able to answer: do the people using this system understand what it does, where it fails, when they must not rely on it, and who to escalate to? And can you show that you have taken measures rather than intending to? Classify a system first — the tier and the role both matter here: https://lnkd.in/d2-Ca6-j Visit fortiton.com #AIAct #EUAIAct #AIGovernance #AILiteracy #Compliance #Fortiton

When teams first meet the EU AI Act, the instinct is to classify their model. The Act classifies the use. The same capability sits in different tiers depending on what it is doing. A system that scores people for credit sits in a different place from a system that sorts email, even when both are built on the same class of model. That is why "which tier is our model in" has no answer, and "which tier is this deployment in" does. Read the tiers as a decision tree over purpose and context, and most of the confusion drains away: — prohibited uses, which cannot be placed on the market at all; — high-risk uses, which carry obligations before deployment; — transparency-only uses, which carry disclosure duties; — everything else, which is the default remainder. The free classifier walks the tree with you and tells you the tier and the obligations attached to it, with the amended compliance dates. https://lnkd.in/d2-Ca6-j Visit fortiton.com #AIAct #AIGovernance #Compliance #Privacy #Fortiton