Compliance, sector by sector

Sole traders, small companies, dental and medical practices, pharmacies. They process sensitive data about clients and patients without dedicated legal or IT resources.

• Health data is a special category under Article 9 — consent alone is rarely the right basis
• A data protection officer is required in more cases than most practices assume
• Copies of identity documents kept "for the file" are the most common excess
• Proportionate documentation, not a corporate framework scaled down badly

Automotive, chemicals, metals, plants running IoT and SCADA. Employee data and B2B partner data, plus AI systems used in quality control.

• Likely an important entity under NIS2 Annex II, with incident reporting to DNSC
• Quality-control AI and predictive maintenance belong in the AI system inventory
• Workplace monitoring: cameras, access control, biometric clocking
• Supply chain risk assessment, which NIS2 makes explicit

Farms, abattoirs, cooperatives. Seasonal workers, precision-agriculture platforms and traceability through the supply chain.

• Seasonal workers mean high personnel turnover and short-lived records
• Agri-tech platforms often process location and vehicle data
• Traceability obligations sit alongside, not instead of, data protection
• Shared equipment and cooperatives raise questions of joint controllership

Hospitals, clinics, laboratories. The most sensitive category of personal data, and an essential entity under NIS2.

• Essential entity under NIS2 — the stricter supervisory regime applies
• Diagnostic and triage AI systems are high-risk under the AI Act
• A data protection officer is mandatory
• Patient rights requests arrive often and have to be answered properly

Software firms, SaaS providers, managed service providers, IT repair. Client data is touched at every interaction.

• Usually a processor for clients and a controller for your own staff — both roles at once
• Devices brought in for repair contain other people’s personal data
• An AI use policy for developers using assistants on client code
• Processor agreements that survive a client audit

Banks, lenders, fintech, crypto exchanges. Highly sensitive data combined with AI decision systems and, increasingly, distributed protocols.

• Credit scoring and fraud detection are high-risk AI under Annex III
• Anti-money-laundering obligations require retention that data minimisation does not override
• Wallet addresses are, in most cases, personal data
• DORA and NIS2 apply alongside the GDPR

Shops and online stores, hospitality, photographers, marketing agencies. Data is collected about customers, attendees and staff at every interaction.

• Cookie consent and email marketing are the most frequently complained about
• Event photography needs a basis that is not buried in the ticket terms
• Customer lists bought or inherited are rarely usable as they stand
• Loyalty schemes involve profiling, which has its own requirements