GDPR and UK GDPR – Data Processing Obligations and Fine Exposure

Where it comes from

Every signal starts from a named source, tiered by how close it sits to the authority that actually decides the question. A Tier 1 source is the regulator, legislature or court itself. Lower tiers are reporting about those bodies, useful for noticing a development early but not for settling what the rule is. The source is linked above so the underlying document can be read directly rather than taken on trust.

What the four scores mean

Business impact, legal complexity, urgency and confidence are scored separately because they move independently. A settled rule can be high impact and low complexity; a fast-moving proposal can be urgent and low confidence at once. Confidence tracks how firmly the underlying position is established, so a low confidence score is a statement about the state of the evidence rather than a hedge about the analysis.

What the counsel flag is for

The outside counsel flag marks signals where the next step turns on a judgement a qualified lawyer in that jurisdiction should make: an obligation whose trigger is genuinely contested, a deadline with consequences attached, or a question where national implementation diverges from the headline rule. It is a routing instruction, not a severity rating.