redCOMPONENT

24/06/2026

New article published:
Pseudonymization After SRB/Deloitte, Part 2: Re-Identification Is Now an Engineering Test

The article looks at why pseudonymization and de-identification can no longer be treated as legal labels alone.

The real question is whether re-identification is reasonably likely, considering the data, the recipient, auxiliary datasets, available technology, cost, time, controls, and the lifetime of the data.

I cover:
SRB/Deloitte and recipient-specific identifiability
CNIL’s recent IQVIA decision in France
LLM deanonymization and why unstructured text is risky
why free-text data can remain identifying after redaction
quantum computing as a future risk to cryptographic separation
what a defensible de-identification evidence pack should include

Main point:
Pseudonymization is a control. It is not a conclusion.

Read the full article and practical guidelines to apply the engineering test: https://aesirx.io/blog/aesirx/pseudonymization-after-srb-deloitte-part-2-re-identification-is-now-an-engineering-test

Pseudonymization is not anonymity. Learn how SRB/Deloitte, CNIL/IQVIA, GDPR Recital 26, LLMs, and quantum risk turn re-identification into an engineering test.

18/06/2026

Vietnam Economy / VnEconomy has published an article covering our Vietnam Website Privacy Scan 2026, based on privacy scans of the websites of large companies in Vietnam.

The main point is simple:

Personal data compliance is no longer only about having a privacy policy or a cookie banner.

It is about what actually happens when a visitor opens a website.

Are third-party scripts, cookies, pixels, analytics tools, embedded videos, or advertising technologies loaded before the user has made a clear choice?

Can the business prove what was shown, what was accepted, what was refused, and which technologies were blocked or allowed?

Can users withdraw consent as easily as they gave it?

This is where many companies still have a gap.

The positive message is that this is fixable.

With the right governance, technical controls, consent records, and audit trail, companies can move from “banner compliance” to real operational privacy governance.

Thank you to VnEconomy for highlighting this important issue for Vietnam’s digital economy.

https://vneconomy.vn/techconnect/du-lieu-ca-nhan-dang-duoc-quan-tri-den-dau-tren-website-cua-cac-doanh-nghiep-viet.htm

See the full study here: https://aesirx.io/blog/aesirx/vietnams-corporate-websites-and-the-consent-gap-executive-summary

Chỉ cần một cú nhấp chuột, người dùng đã đồng ý về các điều khoản dữ liệu mà các website đặt ra, nhưng lại cần đến nhiều bước để từ chối hoặc rút lại lựa chọ...

10/06/2026

Most companies think consent compliance starts and ends with the cookie banner.
It does not.

The banner is where the user sees consent. The governance system is where the organization proves it. That proof has to cover the approved purpose, the live CMP setting, the cookies and trackers that actually load, the vendor list, the user’s choice, the withdrawal flow, and the audit trail behind every change.

🇻🇳 In Vietnam’s new personal data protection environment, consent must become operational. A screenshot of a banner is not enough if the browser, vendor stack, tag manager, or downstream systems tell a different story.

This week’s article (43 minute read) explains how organizations can move from cookie banners to consent governance at scale - with purpose governance, drift detection, withdrawal propagation, sensitive-data controls, and audit-ready evidence.

🔗 Read the full article: https://aesirx.io/blog/aesirx/consent-governance-at-scale-from-cookie-banners-to-operational-proof

🛡️

Consent governance goes beyond cookie banners. Learn how to prove user choices, legal basis, controls, and audit-ready evidence at scale.

07/06/2026

Cookie compliance is no longer just a legal policy exercise.

It is technical.

It lives in cookies, pixels, scripts, tags, CMP settings, consent signals, analytics tools, marketing platforms, and the evidence trail behind every classification decision.

That is where many organizations struggle.

Legal and privacy teams understand the law.

Tech and marketing teams understand the tools.

But cookie compliance breaks down when nobody owns the bridge between the two.

That is why I am introducing a new practical service from AesirX:
Cookie Compliance Training & Review

A 2-hour live online session for DPOs, legal teams, privacy teams, internal audit, marketing, web teams, and technical teams.

We use your own website as the working example and walk through:
How to identify cookies, pixels, trackers, and scripts
How to classify them by purpose, type, risk, and region
How to justify strictly necessary, analytics, functional, and advertising categories
How classifications connect to CMP settings, tag blocking, and consent flows
What evidence should be documented for audit readiness

This is not a generic GDPR cookie course.

It is hands-on technical privacy training for real-world website tracking compliance across EU, US, Vietnam, and global teams covering all tracking technologies, not just cookies.

Introductory price: US$995
Includes one 2-hour live online session.

The goal is simple:
Help teams move from “we have a cookie banner” to “we can explain, evidence, and defend how website tracking is actually governed.”

Privacy by design.
Trust by default.
Growth by choice.

03/06/2026

A company can have a privacy policy, a vendor list, a risk spreadsheet, and a compliance manager who knows where everything is stored.

❓ Then the questions arrive.

A regulator asks when a data subject request was received and whether the deadline was met. A bank asks for control evidence before onboarding. An enterprise customer asks for proof before procurement. An auditor asks who approved the last risk acceptance.

Suddenly the question isn't "do we have compliance documents?"

It's "can we reconstruct the truth?"

That gap, between having compliance material and being audit-ready, is what this week's article is about.

We break down 5 operational maturity markers that separate organizations with policies from organizations that can survive inspection:
1️⃣ Obligations mapped to operational records
2️⃣ Ownership assigned before deadlines arrive
3️⃣ Evidence captured during the work, not after
4️⃣ Deadlines managed as regulatory workflows
5️⃣ Decision lineage preserved, especially when AI is involved

Audit readiness doesn't mean being perfect. It means being coherent enough to show your gaps, own them, and prove what you're doing about them.

🔗 Full article: https://aesirx.io/blog/compliance-one/building-an-audit-ready-organization-the-5-operational-maturity-markers

🛡️

What makes an organization audit-ready? Learn five maturity markers for compliance, governance, evidence management, and accountability.

27/05/2026

🔍 We scanned 500 of Vietnam's top company websites.

244 out of 340 were flagged high risk.

Not because of anything exotic. Google Analytics, Meta Pixel, YouTube embeds, Google Tag Manager, the standard toolkit of corporate websites across Vietnam, firing before visitors had seen a consent banner or made any real choice.

Vietnam's PDPL has been in force since 1 January 2026. A banner that appears after the browser has already called Google or Meta isn't compliance. It's decoration. 🇻🇳

Most of these sites were built by agencies. Nobody reviewed the tag stack through a compliance lens. That's the gap.

✔️ Scan what your website actually loads
✔️ Block non-essential scripts before consent, not after
✔️ Name your vendors, “analytics partners” isn't disclosure
✔️ Keep records that prove the user's choice controlled the technology

🔗 Full report https://aesirx.io/blog/aesirx/vietnams-corporate-websites-and-the-consent-gap

🛡️

A scan of 500 Vietnamese company websites reveals widespread third-party tracking, cookies, beacons, and PDPL consent risks.

20/05/2026

When most compliance teams spend 2 days getting a DPIA question answered, Forseti, the AI advisor inside AesirX ComplianceOne, drafts it in 2 minutes; with citations and a full audit trail.

✅ Every answer is grounded in the customer's installed regulatory packs and their own records, not in general model training.

✅ Twenty cross-module workflows draft DPIAs, transfer assessments, vendor evidence collections, contract obligations, consent gaps, breach timelines, remediation plans, and audit walkthroughs.

✅ Forseti drafts; humans accept. Memory is scoped to the customer organisation and cannot leak across tenants.

✅ External tools reach Forseti through MCP, and every write proposal lands in an in-product approval queue that a human reviews before anything runs.

Autonomous AI optimises for speed. Auditable AI optimises for survival under inspection. In regulated compliance work, only one of those passes an inspector's first question.

🔗 Read the full article: https://aesirx.io/blog/aesirx/forseti-the-auditable-ai-legal-advisor

Forseti inside AesirX ComplianceOne delivers auditable AI for compliance, with grounded answers, human approval flows, and audit lineage.

15/05/2026

📈 How much are you actually paying, per client site, for analytics?

⛔️ For agencies managing multiple WordPress sites, most analytics tools punish growth or limit function.

💵 More traffic means higher bills, usage caps, and forced upgrades before clients have even asked for anything advanced.

AesirX Analytics Freemium for WordPress is built the other way around:
✅ No traffic limits
✅ No pageview caps
✅ No forced upgrades
✅ First-party data, no third-party routing

It covers what you need for everyday client reporting right out of the box: acquisition analytics, UTM campaign tracking, on-site behavior, and first-party data collection.

Use the Freemium version long term across all your client sites.

👉🏾 Start free🔗 https://aesirx.io/solutions/analytics/freemium/wordpress

AesirX Analytics Freemium for WordPress provides free, first-party analytics with clean insights into traffic, campaigns, and behavior, without third-party platforms.

13/05/2026

Sector overlays arrive in Vietnamese GRC

🇻🇳 Vietnam's State Bank has issued Thông tư số 83/2025/TT-NHNN, the new internal control circular for commercial banks and foreign bank branches. It is not a personal data law. It is not a copy of ISO 27001. And it has zero monetary fines: enforcement runs through a supervisory risk model with severity tiers.

➡ AesirX ComplianceOne now ships the first sector overlay in the platform: a Circular 83 pack with the four annual SBV reporting templates, the supporting internal control records, the supervisory risk model, and a phased deadline engine.

What the article covers:
- Why a sector overlay is structurally different from PDPL or ISO 27001.
- How direct mode and reference mode let multi sector groups install a banking overlay without breaking non banking tenants.
- How the phased deadline engine wires the 2028 obligations and the ten day early implementation notice window into the workflow.
- The four annual SBV reports walked end to end.
- Why monetary fines are not the operating currency under Circular 83.

🔗 Read the full article: https://aesirx.io/blog/aesirx/when-a-banking-circular-sits-on-top-of-your-privacy-stack-the-rise-of-sector-overlays-in-vietnamese-grc

Vietnam’s Circular 83 introduces sector overlays in GRC. Learn how banks handle SBV reporting, layered compliance, and sector-specific workflows.

05/05/2026

When a regulator asks whether your audit log was edited, restored from a backup, or assembled retrospectively, a screenshot is not the answer.

🇻🇳 Vietnam's QĐ 8297/QĐ-BCA-A05 now expects audit logs that are detailed, complete, and immutable. ISO 27001 Annex A.8.15, SOC 2 CC7.3, GDPR, NIS2, and DORA are converging in the same direction.

AesirX ComplianceOne now ships Immutable Audit Trails. Every protected compliance event becomes cryptographically linked to a privacy-preserving proof on Concordium. No personal data leaves the platform. The proof layer proves integrity, not content.

This week's master class explains how it works in practice, what an Integrity Pack contains, and why the future of compliance is not more paperwork but better proof.

🔗 https://aesirx.io/blog/compliance-one/immutable-audit-trails-when-your-audit-log-becomes-cryptographic-proof

Immutable audit trails turn audit logs into cryptographic proof. Meet PDPL and Vietnam compliance with verifiable, tamper-proof evidence.