Data protection and privacy compliance
PCI DSS is the card industry's standard for anyone handling card data, enforced by the card brands and your acquirer. How a hosted, tokenised checkout keeps you on the lightest self assessment (SAQ A), and what it all costs.
Every shop owner wants to know what the competition charges, and every one asks the same question first: are we allowed to? A plain language map of the rules in the UK, the EU, Germany and Austria: why prices are facts, where the database right reaches, what the Ryanair cases decided, where logins and blocks draw the line, text and data mining, GDPR, and the competition law trap nobody mentions.
SOC 2 Type II is an attestation report, not a certificate, issued only by a licensed CPA firm. What the five trust services criteria are, who needs it, who does not, and what it really costs.
On 21 October 2026 the NCSC warned that two critical PHP flaws let attackers run code on web servers without a login, and advised taking unpatchable systems offline. What really happened, why the plugin model keeps exposing businesses, and what I build instead.
What companies really risk with AI built software: invisible security flaws, agents with production keys, critical paths that change by accident, architecture debt, compliance, insurance exclusions and lock in. And how an experienced developer uses AI to deliver faster and for less.
Quality is not one thing. It is four tiers: being a regulated institution, the certifications a vendor earns, the laws that apply to you, and the engineering discipline that actually makes software reliable.
ISO 27001 is the international certificate for an information security management system, issued by an accredited body you commission, not by a developer. What it is, who needs it, how it compares with SOC 2, and what it really costs.
The OWASP Application Security Verification Standard is a free, open checklist for building and verifying secure web applications. It is not a certificate anyone holds, so I build to it and an independent pen test verifies against it.
WCAG 2.1 at Level AA is the standard almost every accessibility law points at. What its four principles ask, why AA is the target, how you really test it, and the failures I fix most, with a Leeds shop worked through.
DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025. It governs ICT resilience for EU financial entities, and it reaches the developers who serve them through the contract. Who is in scope, the five pillars, and what lands in a supplier's build.
Chrome kept its third party cookies, and it barely matters. What Safari, Firefox and the consent banner really remove, what first party data is and is not, and how to measure without following people.
Browsers have closed most of the gaps and UK law asks for a yes before you personalise. How to build personalisation on consent, your own server and data people give you on purpose, with the Rails code.
Germany and Austria share the EU AI Act and the GDPR but not the enforcers. Switzerland has neither, and a data protection act that already covers AI. What a British business needs to know, and how to build one Rails codebase for all three.
A developer's walkthrough of the processing contract, data protection by design and the impact assessment for AI features, under the UK GDPR and, for EU customers, the EU GDPR. The law first, then the Rails code.
Deleting a customer's rows is easy. Their influence on a trained model is not. What Article 17 says in the UK and the EU, what regulators have actually said about models, what machine unlearning research can do, and the Rails architecture that keeps you out of the problem.
The Digital Omnibus moved the high risk rules to December 2027 and August 2028, but the transparency duties already apply. Here is where a SaaS product sits, what it owes and how to build for it on Rails.
Three American companies hold 70% of Europe's cloud market, and US law follows the data wherever it sits. What the CLOUD Act says, what governments are already doing, what I use instead and how to cost a move.
NIS2 covers cloud services, managed service providers and online marketplaces that serve the EU, with a 24 hour reporting clock and fines from €7 million. Who is in scope, what it asks, and where a UK business stands.
The Cyber Resilience Act sets security rules for almost every product with software in it that is sold in the EU. Reporting has been live since 11 September 2026, and the rest applies from 11 December 2027.
Cloud AI, self hosted models or a hybrid of both: what each can do, what goes wrong when staff paste the wrong thing, what the GDPR and the EU AI Act actually require, and how to route sensitive work so it never leaves the building.
DuckDuckGo, Ecosia and Brave Search carry about 1% of UK search referrals, and most borrow Bing's or Google's index. The bigger privacy shift is in the browser and the law, and that touches every visitor you have.
Does data protection really build trust and cut churn? I separate what UK adults say, what experiments show and what real companies saw, and show how to measure it yourself.
Two UK laws decide whether you may email someone you collected. How I build sign up forms, checkouts, gated guides and onboarding so every address on the list is one you can actually use.
Pre ticked boxes, banners without a reject button, shaming pop ups and countdown clocks that reset. Which UK law each one breaks, what the ICO and CMA expect, and what I build instead, worked through on an invented Leeds tea shop.
What a British shop's tracking code may do before and after a visitor presses accept, what Google's consent mode really sends on a no, and how to estimate the sales your ad platform cannot see.
The UK cookie rule changed in February 2026. Germany and Austria did not follow. What a British shop must do in each market, what fires when a visitor says no, and what that does to the numbers in your ad account.
1%of every invoice goes to a UK charity you pick.
A donation, never sponsorship. You choose the cause at onboarding.
The story behind the pledge →Questions about pricing, contracts or how we work together?
Read the FAQ
