Blog
Personal Data Breach Under the GDPR: What a Company Should Do and When to Notify the Regulator
An employee sent a file to the wrong recipient, a storage system was left open to external access, or an attacker obtained administrator credentials. In each of these situations, the company needs to quickly determine whether personal data has been affected and whether any obligations arise under the GDPR
DPA Agreement: When an IT Company Needs a Personal Data Processing Agreement
A company sells a SaaS service to a client in the EU. The client uploads information about employees or customers to the system, the provider stores it, creates backups, and gives the support team access to it. When negotiating the contract, the client asks the company to sign a Data Processing Agreement, or DPA
EULA for Applications and Software: When It Is Needed and What It Should Regulate
A developer may publish an application in an app store, provide a link to a license agreement, and consider the legal side complete. However, the mere existence of an EULA does not mean that its provisions are suitable for the product or have become binding on the user
Company Registration Abroad: What to Consider Before Filing the Documents
Registering a company abroad often looks like a technical procedure: choosing a country, preparing the articles of association, and submitting documents to the registry. However, obtaining a certificate of incorporation does not yet mean that the business will be able to open a bank account, accept payments, apply the expected tax regime, and operate without additional permits
Economic Substance of a Foreign Company: Why Business Registration Alone Is No Longer Enough
A foreign company can be registered within a few days, provided with a registered office, and have a director appointed. However, formal presence in a public register is no longer sufficient to qualify for tax benefits, open a bank account, or take advantage of international treaties
Google Is Changing Android App Distribution Rules: What Developers from Sanctioned Jurisdictions Should Consider
Starting September 30, 2026, Google will begin applying new identity verification requirements for Android developers. Verification will apply not only to Google Play participants: it will gradually become part of the entire ecosystem of certified Android devices
Tax Residency After Obtaining a Spanish Residence Permit: What Happens to Foreign Income and Business
A residence permit allows a person to live in Spain, but by itself does not determine where that person must pay taxes. Tax residency is determined separately, taking into account the length of stay, economic interests, and family circumstances
Transfers of Personal Data Outside the EU: What IT Companies Should Check
An international transfer of personal data occurs not only when a database is hosted on a foreign server. Access by a foreign support team, the use of cloud infrastructure, or the storage of backups in another region may also fall under the rules of Chapter V of the GDPR