---
title: "Privacy & Data Protection · Academy · Guides | Pitch"
description: "Privacy & Data Protection: plain-English guides from the Pitch Academy, newest first."
url: https://www.pitch.law/academy/guides/topics/privacy
---

Academy · Guides

# Privacy & Data Protection

Privacy and data protection

Type

- [All](https://www.pitch.law/academy/topics/privacy)
- [Guides](https://www.pitch.law/academy/guides/topics/privacy)
- [News](https://www.pitch.law/academy/news/topics/privacy)

Topic

- [All topics](https://www.pitch.law/academy/guides)
- [Intellectual property](https://www.pitch.law/academy/guides/topics/intellectual-property)
- [Patents](https://www.pitch.law/academy/guides/topics/patents)
- [New gTLDs](https://www.pitch.law/academy/guides/topics/gtld)
- [Information Technology](https://www.pitch.law/academy/guides/topics/information-technology)
- [Privacy & Data Protection](https://www.pitch.law/academy/guides/topics/privacy)
- [Commercial](https://www.pitch.law/academy/guides/topics/commercial)
- [Corporate and M\&A](https://www.pitch.law/academy/guides/topics/corporate-m-a)
- [Tax](https://www.pitch.law/academy/guides/topics/tax)
- [Legal Aspects of Artificial Intelligence](https://www.pitch.law/academy/guides/topics/legal-aspects-of-artificial-intelligence)

* [Guide](https://www.pitch.law/academy/ai-under-swiss-fadp-and-gdpr)
  ### [AI under Swiss Law and the GDPR: Key Differences](https://www.pitch.law/academy/ai-under-swiss-fadp-and-gdpr)
  [What the revised Swiss FADP and the GDPR mean for companies that build or use AI services: scope, legal bases, impact assessments, transfers, sanctions and the EU AI Act.](https://www.pitch.law/academy/ai-under-swiss-fadp-and-gdpr)
* [Guide](https://www.pitch.law/academy/cookie-compliance-and-consent-management)
  ### [Cookies and Consent](https://www.pitch.law/academy/cookie-compliance-and-consent-management)
  [When a cookie banner is required, what valid consent looks like and how the ePrivacy rules and the GDPR work together.](https://www.pitch.law/academy/cookie-compliance-and-consent-management)
* [Guide](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown)
  ### [GDPR Breach Notification: the 72-Hour Rule](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown)
  [Article 33 GDPR: notify the authority within 72 hours of becoming aware of a personal data breach. When to notify, how hours count, when to tell people.](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown)
* [Guide](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data)
  ### [GDPR Data Retention: How Long to Keep Personal Data](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data)
  [The GDPR sets no fixed retention period: Article 5(1)(e) allows no longer than necessary. How to set retention periods, handle backups and delete data.](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data)
* [Guide](https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide)
  ### [How to Answer a DSAR Within the GDPR Deadline](https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide)
  [Answer a data subject access request within one month, extendable by two (Articles 12 and 15 GDPR): what to send, what you may refuse, how to keep time.](https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide)
* [Guide](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii)
  ### [International Data Transfers](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii)
  [How Chapter V GDPR works after Schrems II: adequacy decisions, the EU-US Data Privacy Framework, standard contractual clauses and the assessment that goes with them.](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii)
* [Guide](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know)
  ### [Records of Processing Activities (RoPA)](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know)
  [What Article 30 GDPR requires you to record, who must keep a register, and how to keep it useful.](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know)
* [Guide](https://www.pitch.law/academy/website-technology-audits-and-gdpr)
  ### [Website Technology Audits and the GDPR](https://www.pitch.law/academy/website-technology-audits-and-gdpr)
  [What a website technology audit examines, why privacy notices and actual data flows drift apart, and which legal duties it checks.](https://www.pitch.law/academy/website-technology-audits-and-gdpr)

## Let’s talk

Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free.

[Schedule a meeting](https://www.pitch.law/schedule)