Data Protection Impact Assessment

Legal safeguards that protect individuals who report illegal, unethical, or dangerous activities within organisations from retaliation, including dismissal, demotion, or harassment. In the EU, the Whistleblower Protection Directive (2019/1937) requires companies with 50+ employees to establish internal reporting channels, while the UK's Public Interest Disclosure Act 1998 provides employment tribunal remedies.

The documented lifecycle of data as it moves through an organisation's systems, showing its origin, transformations, dependencies, and destinations. Data lineage provides visibility into how data is created, processed, and consumed, enabling organisations to ensure data quality, comply with regulatory requirements (particularly GDPR's right to explanation), debug data pipeline issues, and assess the impact of system changes.

A clause in an investment agreement that protects existing investors from ownership dilution if the company raises a subsequent round at a lower valuation (a down round). Common mechanisms include full ratchet and weighted-average anti-dilution.

The process of determining the period over which an intangible asset is expected to contribute to the cash flows of an entity, which governs the amortisation period under IAS 38 and ASC 350. Useful life may be finite (based on contractual, legal, regulatory, technological, or economic factors) or indefinite (when there is no foreseeable limit to the period over which the asset will generate net cash inflows).

A chronological record of system activities, transactions, or document changes that provides a verifiable history of who did what, when, and why. Audit trails are essential for regulatory compliance, fraud detection, and internal controls, and are required by standards including SOX, GDPR, and ISO 27001.

The California Consumer Privacy Act, a US state privacy law granting California residents rights over their personal information, including the right to know what data is collected, the right to delete it, the right to opt out of its sale, and the right to non-discrimination for exercising these rights. As amended by the CPRA (2023), CCPA closely mirrors certain GDPR provisions and has influenced privacy legislation in other US states.

Contractual mechanisms that protect existing investors from the dilutive effects of a subsequent financing round at a lower valuation than the round in which they invested. Common forms include full ratchet anti-dilution (which adjusts the conversion price to the new lower price) and weighted average anti-dilution (which adjusts based on the relative size of the new round).

An approach to systems engineering and product development that embeds data protection principles into the design and architecture of IT systems and business practices from the outset, rather than retrofitting them. Privacy by Design is codified as a legal requirement under GDPR Article 25 and encompasses data minimisation, pseudonymisation, and purpose limitation as default settings.

Flat, Up or Down: Bridge Valuation Mechanics

How should founders structure and maintain their cap table?

A well-structured cap table tracks all equity ownership, options, convertible instruments, and vesting schedules on a fully diluted basis — founders should maintain it from day one using dedicated software.

How does equity dilution work across funding rounds?

Equity dilution occurs when new shares are issued in a funding round, reducing existing shareholders' ownership percentages — though not necessarily the value of their holdings if the company's valuation increases.