---
title: "Privacy & Data Protection · Academy | Pitch"
description: "Privacy and data protection: Cookies and Consent, Data Breaches: the 72-Hour Rule, Data Subject Access Requests, How Long May You Keep Personal Data?,…"
url: https://www.pitch.law/academy/topics/privacy
---

Academy

# Privacy & Data Protection

Privacy and data protection

- [All](https://www.pitch.law/academy)
- [Intellectual property](https://www.pitch.law/academy/topics/intellectual-property)
- [Patents](https://www.pitch.law/academy/topics/patents)
- [New gTLDs](https://www.pitch.law/academy/topics/gtld)
- [Information Technology](https://www.pitch.law/academy/topics/information-technology)
- [Privacy & Data Protection](https://www.pitch.law/academy/topics/privacy)
- [Commercial](https://www.pitch.law/academy/topics/commercial)
- [Corporate and M\&A](https://www.pitch.law/academy/topics/corporate-m-a)
- [Tax](https://www.pitch.law/academy/topics/tax)
- [Legal Aspects of Artificial Intelligence](https://www.pitch.law/academy/topics/legal-aspects-of-artificial-intelligence)

* ### [Cookies and Consent](https://www.pitch.law/academy/cookie-compliance-and-consent-management)
  [When a cookie banner is required, what valid consent looks like and how the ePrivacy rules and the GDPR work together.](https://www.pitch.law/academy/cookie-compliance-and-consent-management)
* ### [Data Breaches: the 72-Hour Rule](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown)
  [When a personal data breach must be notified to the data protection authority and to individuals, how the 72 hours are counted and what to document.](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown)
* ### [Data Subject Access Requests](https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide)
  [How the right of access works under Article 15 GDPR, how to handle the deadline, what you may refuse and what a good response contains.](https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide)
* ### [How Long May You Keep Personal Data?](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data)
  [The storage limitation principle in Article 5(1)(e) GDPR, how to set retention periods and how to delete in practice.](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data)
* ### [International Data Transfers](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii)
  [How Chapter V GDPR works after Schrems II: adequacy decisions, the EU-US Data Privacy Framework, standard contractual clauses and the assessment that goes with them.](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii)
* ### [Records of Processing Activities (RoPA)](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know)
  [What Article 30 GDPR requires you to record, who must keep a register, and how to keep it useful.](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know)
* ### [Website Technology Audits and the GDPR](https://www.pitch.law/academy/website-technology-audits-and-gdpr)
  [What a website technology audit examines, why privacy notices and actual data flows drift apart, and which legal duties it checks.](https://www.pitch.law/academy/website-technology-audits-and-gdpr)

## Let’s talk

Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free.

[Schedule a meeting](https://www.pitch.law/schedule)