R Digital

03/08/2026

When Convenience Becomes an Identity Oracle

The next major privacy risk may not come from a data breach. It may come from a product feature millions of people use every day.

Imagine typing a guessed email address into a calendar invitation. Before you've even sent it, the application displays a name or profile photo.

For most people, that's simply a helpful feature.

What interested me was something else. It may also be confirming that the email address belongs to the person you were trying to find.

AI changes the risk because it can automate what used to be a slow, manual process.

That raises a bigger question about privacy by design and how products should behave in the age of AI.

➜ I explore that question in my latest article.
🔗 https://aesirx.io/blog/compliance-one/when-convenience-becomes-an-identity-oracle-the-hidden-privacy-risk-in-google-calendar

A calendar invitation can reveal more than intended. Explore how AI can turn everyday identity lookup features into scalable privacy risks and why privacy by design must evolve.

27/07/2026

Your Website Probably Isn't the Same as It Was Six Months Ago

Have you...
➜ added an AI assistant?
➜ launched a new marketing campaign?
➜ updated your analytics?
➜ installed a new plugin?
➜ embedded a video?
➜ added a chat widget?

Every one of those changes has the potential to change what your visitors' browsers load.

Learn more about AesirX Privacy Scanner and scan your website for free: https://aesirx.io/services/privacy-scanner

Free tool to check your website's compliance with privacy laws. Get detailed reports and practical solutions for violations. Based on EU's EDPS software

22/07/2026

AesirX Privacy Scanner continuously detects tracker and cookie drift, consent issues, and privacy risks across your websites before they become problems.

02/07/2026

AesirX is hiring a Country Manager Vietnam to build the partner channel and enterprise customer base for ComplianceOne, our in-market GRC platform for privacy, consent, data governance, audit evidence, and operational compliance. This is a commission-based, sweat-equity role with 1% equity and no base salary for the first 6 months.

https://aesirx.io/careers/country-manager-vietnam

AesirX, a privacy-first technology company, is hiring a Country Manager in Vietnam to lead sales and partnerships for privacy and GRC solutions.

24/06/2026

New article published:
Pseudonymization After SRB/Deloitte, Part 2: Re-Identification Is Now an Engineering Test

The article looks at why pseudonymization and de-identification can no longer be treated as legal labels alone.

The real question is whether re-identification is reasonably likely, considering the data, the recipient, auxiliary datasets, available technology, cost, time, controls, and the lifetime of the data.

I cover:
SRB/Deloitte and recipient-specific identifiability
CNIL’s recent IQVIA decision in France
LLM deanonymization and why unstructured text is risky
why free-text data can remain identifying after redaction
quantum computing as a future risk to cryptographic separation
what a defensible de-identification evidence pack should include

Main point:
Pseudonymization is a control. It is not a conclusion.

Read the full article and practical guidelines to apply the engineering test: https://aesirx.io/blog/aesirx/pseudonymization-after-srb-deloitte-part-2-re-identification-is-now-an-engineering-test

Pseudonymization is not anonymity. Learn how SRB/Deloitte, CNIL/IQVIA, GDPR Recital 26, LLMs, and quantum risk turn re-identification into an engineering test.

18/06/2026

Vietnam Economy / VnEconomy has published an article covering our Vietnam Website Privacy Scan 2026, based on privacy scans of the websites of large companies in Vietnam.

The main point is simple:

Personal data compliance is no longer only about having a privacy policy or a cookie banner.

It is about what actually happens when a visitor opens a website.

Are third-party scripts, cookies, pixels, analytics tools, embedded videos, or advertising technologies loaded before the user has made a clear choice?

Can the business prove what was shown, what was accepted, what was refused, and which technologies were blocked or allowed?

Can users withdraw consent as easily as they gave it?

This is where many companies still have a gap.

The positive message is that this is fixable.

With the right governance, technical controls, consent records, and audit trail, companies can move from “banner compliance” to real operational privacy governance.

Thank you to VnEconomy for highlighting this important issue for Vietnam’s digital economy.

https://vneconomy.vn/techconnect/du-lieu-ca-nhan-dang-duoc-quan-tri-den-dau-tren-website-cua-cac-doanh-nghiep-viet.htm

See the full study here: https://aesirx.io/blog/aesirx/vietnams-corporate-websites-and-the-consent-gap-executive-summary

Chỉ cần một cú nhấp chuột, người dùng đã đồng ý về các điều khoản dữ liệu mà các website đặt ra, nhưng lại cần đến nhiều bước để từ chối hoặc rút lại lựa chọ...

10/06/2026

Most companies think consent compliance starts and ends with the cookie banner.
It does not.

The banner is where the user sees consent. The governance system is where the organization proves it. That proof has to cover the approved purpose, the live CMP setting, the cookies and trackers that actually load, the vendor list, the user’s choice, the withdrawal flow, and the audit trail behind every change.

🇻🇳 In Vietnam’s new personal data protection environment, consent must become operational. A screenshot of a banner is not enough if the browser, vendor stack, tag manager, or downstream systems tell a different story.

This week’s article (43 minute read) explains how organizations can move from cookie banners to consent governance at scale - with purpose governance, drift detection, withdrawal propagation, sensitive-data controls, and audit-ready evidence.

🔗 Read the full article: https://aesirx.io/blog/aesirx/consent-governance-at-scale-from-cookie-banners-to-operational-proof

🛡️

Consent governance goes beyond cookie banners. Learn how to prove user choices, legal basis, controls, and audit-ready evidence at scale.

07/06/2026

Cookie compliance is no longer just a legal policy exercise.

It is technical.

It lives in cookies, pixels, scripts, tags, CMP settings, consent signals, analytics tools, marketing platforms, and the evidence trail behind every classification decision.

That is where many organizations struggle.

Legal and privacy teams understand the law.

Tech and marketing teams understand the tools.

But cookie compliance breaks down when nobody owns the bridge between the two.

That is why I am introducing a new practical service from AesirX:
Cookie Compliance Training & Review

A 2-hour live online session for DPOs, legal teams, privacy teams, internal audit, marketing, web teams, and technical teams.

We use your own website as the working example and walk through:
How to identify cookies, pixels, trackers, and scripts
How to classify them by purpose, type, risk, and region
How to justify strictly necessary, analytics, functional, and advertising categories
How classifications connect to CMP settings, tag blocking, and consent flows
What evidence should be documented for audit readiness

This is not a generic GDPR cookie course.

It is hands-on technical privacy training for real-world website tracking compliance across EU, US, Vietnam, and global teams covering all tracking technologies, not just cookies.

Introductory price: US$995
Includes one 2-hour live online session.

The goal is simple:
Help teams move from “we have a cookie banner” to “we can explain, evidence, and defend how website tracking is actually governed.”

Privacy by design.
Trust by default.
Growth by choice.

03/06/2026

A company can have a privacy policy, a vendor list, a risk spreadsheet, and a compliance manager who knows where everything is stored.

❓ Then the questions arrive.

A regulator asks when a data subject request was received and whether the deadline was met. A bank asks for control evidence before onboarding. An enterprise customer asks for proof before procurement. An auditor asks who approved the last risk acceptance.

Suddenly the question isn't "do we have compliance documents?"

It's "can we reconstruct the truth?"

That gap, between having compliance material and being audit-ready, is what this week's article is about.

We break down 5 operational maturity markers that separate organizations with policies from organizations that can survive inspection:
1️⃣ Obligations mapped to operational records
2️⃣ Ownership assigned before deadlines arrive
3️⃣ Evidence captured during the work, not after
4️⃣ Deadlines managed as regulatory workflows
5️⃣ Decision lineage preserved, especially when AI is involved

Audit readiness doesn't mean being perfect. It means being coherent enough to show your gaps, own them, and prove what you're doing about them.

🔗 Full article: https://aesirx.io/blog/compliance-one/building-an-audit-ready-organization-the-5-operational-maturity-markers

🛡️

What makes an organization audit-ready? Learn five maturity markers for compliance, governance, evidence management, and accountability.

27/05/2026

🔍 We scanned 500 of Vietnam's top company websites.

244 out of 340 were flagged high risk.

Not because of anything exotic. Google Analytics, Meta Pixel, YouTube embeds, Google Tag Manager, the standard toolkit of corporate websites across Vietnam, firing before visitors had seen a consent banner or made any real choice.

Vietnam's PDPL has been in force since 1 January 2026. A banner that appears after the browser has already called Google or Meta isn't compliance. It's decoration. 🇻🇳

Most of these sites were built by agencies. Nobody reviewed the tag stack through a compliance lens. That's the gap.

✔️ Scan what your website actually loads
✔️ Block non-essential scripts before consent, not after
✔️ Name your vendors, “analytics partners” isn't disclosure
✔️ Keep records that prove the user's choice controlled the technology

🔗 Full report https://aesirx.io/blog/aesirx/vietnams-corporate-websites-and-the-consent-gap

🛡️

A scan of 500 Vietnamese company websites reveals widespread third-party tracking, cookies, beacons, and PDPL consent risks.