New: a ready-to-use data breach response checklist.New: data breach response checklist.Download the checklist

Editorial method

How we write our guides.

Each guide answers a concrete question and shows where every rule comes from. This page explains which sources we use, how we write, how we review and what we do when we get something wrong.

Official sources only

We always start from the text of the law and the authorities' guidance, not from other articles on the topic:

  • Legislation: the GDPR and other EU legislation on EUR-Lex, and national laws such as Portugal's Law 58/2019.
  • EU bodies: guidelines, opinions and reports from the European Data Protection Board (EDPB) and the European Data Protection Supervisor.
  • National authorities: the CNPD (Portugal's data protection authority) and, when they help explain the rule, the CNIL, the AEPD, the ICO and others.
  • Courts: judgments of the Court of Justice of the European Union.
  • Legislative process: Commission proposals and Parliament and Council documents, always labelled as proposals.

Each guide ends with a “Sources” section and links every legal statement to the article, guideline paragraph or decision it comes from.

How we write

Drafts are prepared with the help of artificial intelligence tools. Then a person checks every deadline, every obligation and every citation against the original source before the guide is published. Anything we can't confirm in an official source stays out.

The examples, such as Oficina Rocha, Marta or Inês, are fictional. They show the rule working in a concrete case. The rules, deadlines and the authorities' figures are real and sourced.

How we review

  • Each guide shows its last review date at the top and bottom of the page.
  • We review each guide at least every six months, and whenever the law, the EDPB or the CNPD changes something that affects it.
  • We only change the review date when the content actually changes.
  • When an amendment is in progress, we flag it in a separate box, with the date we checked it.

Corrections

If you find a mistake, an outdated source or a rule that's badly explained, tell us through the contact page. We check, correct the guide and update the review date.

Not legal advice

The guides and templates are general information about the GDPR. They help you understand the rule and organise the work, but they don't replace advice on a specific case. For that, consult a qualified professional.

See the guides