Longer pieces on the operational side of privacy: how requests get handled, what data maps cost, where the law stands, and how to choose tools and advisers.
- What is MLOps?
What is MLOps, what problems it solves, the lifecycle it covers, and the maturity levels teams move through, written for engineers who ship models.
- AI model deployment challenges in production
The AI model deployment challenges production teams hit most: skew, drift, latency, packaging, data quality, rollback and ownership, with concrete mitigations.
- Model deployment strategies
Model deployment strategies compared: shadow, canary, blue/green, A/B testing, and batch versus online serving, with guidance on when to use each.
- LLM monitoring and observability
LLM monitoring and observability for production apps: traces, quality and cost metrics, retrieval and agent signals, evaluation loops, and alerting that works.
- Multimodal RAG
Multimodal RAG explained for engineers: three ways to index images, tables and PDFs, how to retrieve and generate, evaluation, and where each approach breaks.
- MLOps interview questions
MLOps interview questions with substantive answers: pipelines, drift, deployment, monitoring, testing, system design and LLM operations, for candidates and interviewers.
- Learn MLOps: a practical learning path
How to learn MLOps in a sensible order: Python, Git, Docker, CI, experiment tracking, serving and monitoring, with a hands-on project at each stage.
- Personal data in LLM prompts and traces
How personal data gets into prompts, completions and traces, how regex, NER and LLM detectors trade off misses against false alarms, and how to redact before logging.
- Access and deletion requests against LLM logs and vector stores
Handling DSARs and erasure across LLM chat logs, traces, vector stores, eval sets, fine-tuned models, provider copies and backups, and what to tell the requester.
- Model providers as processors: DPAs and retention
What OpenAI, Anthropic, Google, Azure, Bedrock and Mistral say about retention, zero data retention, abuse monitoring, training and regions, as of October 2026.
- Self-hosting the LLM stack for data residency
Which LLM layers can be self-hosted, from open-weight models to gateways, tracing, vector DBs and evals, and what each does for GDPR transfers and residency.
- Where the EU AI Act and GDPR overlap
AI Act dates after the 2026 Digital Omnibus, provider vs deployer roles, Article 50 transparency, FRIA vs DPIA, Article 22 and sensitive data for bias testing.
- Handling data subject requests: a working guide
A working guide to data subject requests end to end, with a rights-by-law matrix for GDPR, UK GDPR, CCPA, Virginia, Colorado, LGPD and Quebec Law 25, and deadlines.
- How privacy request automation tools work
Inside privacy request automation tools: connectors, orchestration, identity resolution, redaction, their limits, and how to evaluate one.
- Requests from Mine, Privacy Bee and other agent services
Handling privacy requests from Mine, Privacy Bee, Incogni, DeleteMe, Permission Slip and similar services: validity, agent rules, verification, routing, DROP.
- Data maps and ROPAs: fields, template, techniques
The GDPR Article 30 record fields for controllers and processors, a copyable ROPA template, the 250-employee exemption, US state equivalents, and how to build one.
- What a manual data map really costs
Where the hours go when you build a data inventory and ROPA by hand, top-down vs bottom-up approaches, and a worked cost example you can rerun.
- The privacy tech stack, layer by layer
Consent management, DSR automation, data discovery, vendor risk, assessment tools and privacy engineering: what each layer does, how they connect, what you need.
- Building privacy datasets that stay usable
Tidy-data rules for privacy work: law trackers, vendor lists and data inventories with one fact per column, controlled vocabularies, IDs, sourcing and versioning.
- Canada's privacy law after Bill C-11
PIPEDA still governs Canadian private-sector privacy in 2026. What C-11 and C-27 tried to change, what Bill C-36 proposes now, and what it costs businesses.
- Quebec's Law 25 (Bill 64), fully in force
Quebec's Law 25 has been fully in force since September 2024: obligations, individual rights, penalty ceilings and how the CAI enforces, checked against the statute.
- The Utah Consumer Privacy Act in practice
The Utah Consumer Privacy Act as of October 2026: who it covers, the correction right added in 2026, the 30-day cure, and a prep checklist.
- California's CPRA and the 2026 regulations
California's CPRA as of October 2026: current thresholds and fines, sensitive data, the 2026 ADMT, risk assessment and audit rules, DROP, and enforcement so far.
- Who regulates privacy where: a map of the world's regulators
How privacy regulators differ: the EU lead authority and one-stop-shop, the US mix of FTC, state AGs and CalPrivacy, sector regulators, and registration fees.
- Choosing privacy software without regretting it
How to buy privacy software: when to build instead, how to run an evaluation and proof of concept, red flags in demos and contracts, and what total cost includes.
- Hiring a data privacy consultant
When to hire a privacy consultant vs. a lawyer or fractional DPO, which credentials matter, how fees are structured, how to scope the work, and red flags.
- Planning a privacy program: the first 90 days
A 90-day plan for a new privacy lead: map obligations and stakeholders, frame privacy as risk, pick NIST, ISO/IEC 27701 or SOC 2, land quick wins, measure.
- Website privacy audit: score your own site
Free self-audit of your website's privacy notice, cookies and consent (including Global Privacy Control) and request intake, scored live with each gap explained.