Celestine Bahr
Celestine Bahr
Director Legal, Compliance & Data Privacy
Celestine Bahr oversees all legal issues at Usercentrics, including IT and data protection law, compliance, and contract and competition law. In her career she has also focused on employment and product law and has specialized legal training in IT and employment law. Celestine has worked at large and small organizations, from Deutsche Telekom to joining Usercentrics as it was coming out of startup mode. She is trained as a data protection officer and mediator, and provides mentorship to junior legal staff.
You can find Celestine on:
Contributions (68)
Article
Nov 12, 2025
What is cookie compliance and how can you achieve it?
If your website collects data from visitors, you’ll need to comply with cookie laws and privacy regulations. However, becoming cookie-compliant doesn’t have to be challenging if you follow the right steps.
Read more
Article
Nov 11, 2025
Canada's Personal Information Protection and Electronic Documents Act (PIPEDA): An Overview
Canada’s data privacy law has been active since 2000, through big changes in digital markets and business and personal reliance on the internet. PIPEDA has been updated multiple times, and is again due for an overhaul. Learn about PIPEDA compliance requirements, the 10 Fair Information Principles, and more.
Read more
Article
Nov 11, 2025
A step-by-step guide to conducting a GDPR audit
A GDPR audit is necessary to ensure that your company is compliant with the requirements of the GDPR. During a compliance audit, you’ll review your company’s data processing activities and identify any areas of non-compliance.
Read more
Article
Oct 9, 2025
A guide to GDPR countries: Do you need to comply?
Get a clear picture of the GDPR across the globe. From EU member states to countries with strict enforcement, this guide provides insights and examples to help your business understand where and how to comply.
Read more
Article
Oct 8, 2025
GDPR and Australia: what Australian businesses must know
We explore the GDPR's global reach and its implications for Australian businesses. Get clarity on when the GDPR applies, key compliance requirements, and consequences of noncompliance, and differentiation from Australia's Privacy Act. We also provide practical tips and best practices for achieving and maintaining GDPR compliance.
Read more
Article
Oct 8, 2025
CRM and the GDPR: A guide to compliant customer relationship management
From consent management to secure data handling, GDPR requirements shape proper CRM usage. This guide shows you how a compliant CRM can help you protect data, meet legal standards, and win customer trust.
Read more
Article
Oct 6, 2025
The Digital Markets Act (DMA): DMA compliance for companies
The Digital Markets Act (DMA) has reshaped how large online platforms — and their millions of business customers — handle privacy, transparency, and user consent. This guide explores DMA compliance requirements, its impact on user experience and privacy, technical aspects like APIs and CMS integration, risks of noncompliance, and practical steps for companies to build trust and growth.
Read more
Article
Oct 3, 2025
PHI vs PII: What’s the difference?
Understanding the difference between PHI and PII isn't just regulatory semantics. It determines which privacy compliance frameworks apply to your business, what security controls you need, and the penalties you face for getting it wrong.
Read more
Article
Oct 3, 2025
GDPR consent form examples and expert advice: Tips for creating your own
This guide details GDPR consent, covering valid consent requirements and real-world examples. It outlines best practices for creating privacy-compliant, user-friendly forms that build trust, optimize opt-in rates, and meet legal requirements.
Read more
Article
Oct 3, 2025
E-commerce and the GDPR: how to keep your business compliant
GDPR compliance is complex for e-commerce businesses, with customer data flowing across checkout, payments, shipping, and more. This guide breaks down the key principles behind this privacy law and outlines ten steps to protect data, build trust, and future-proof your company.
Read more
Article
Sep 22, 2025
Understanding the European Digital Markets Act (DMA law) and its impact on businesses
Learn about the European Digital Markets Act (DMA law), its objectives, enforcement timeline, and impact on businesses. We look into what it means for data privacy and consent management requirements, as well as web development and digital technologies.
Read more
Article
Sep 19, 2025
GDPR data mapping explained: what it means and how to comply
Find out why GDPR data mapping matters and how it supports compliance with this important data privacy law. From RoPAs to DSARs and breach notifications, this guide details how you need to map data to meet GDPR requirements, plus best practices for doing so.
Read more
Article
Sep 19, 2025
Data discovery explained: best practices for GDPR compliance
Data discovery is a key step for achieving GDPR compliance. It helps identify, classify, and map personal data across systems. Companies can better protect sensitive information, respond to DSARs, provide transparency, and demonstrate accountability on an ongoing basis. We look at best practices for effective ongoing data discovery.
Read more
Article
Jul 31, 2025
The CAN-SPAM Act: Compliance guide with best practices
The CAN-SPAM Act regulates electronic mail messages sent within the US and to US residents. Understand how it affects your email marketing, how to achieve compliance, and best practices to maintain trust with your target audience.
Read more
Article
Jul 22, 2025
GDPR data subject rights: An in-depth guide with examples
The GDPR gives individuals control over how their personal data is collected, stored, and used. This article breaks down all eight data subject rights with real-world examples and tips on how to uphold them and maintain compliance at scale
Read more
Article
Jul 21, 2025
EU cookie compliance explained: A 2025 guide
Learn about EU cookie compliance requirements under the GDPR and the ePrivacy Directive. This guide covers what EU cookie laws mean in practice, common pitfalls to avoid, and managing cookies in line with evolving standards.
Read more
Guide
Jun 26, 2025
Facebook privacy policy: A complete guide for businesses
Learn how Facebook’s privacy policy affects your business. See what data is collected, how it’s used, and what your responsibilities are.
Read more
Article
Jun 9, 2025
GDPR enforcement that doesn’t make headlines
Most GDPR enforcement actions don’t make headlines, but smaller fines and penalties are far more common than billion-Euro judgements. This lack of publicity can lead smaller organizations to think that GDPR compliance doesn’t need to be a priority. We look at why taking that risk isn’t worth it.
Read more
Article
Jun 3, 2025
What is the GDPR right to be forgotten? Data deletion requests explained
The GDPR right to be forgotten enables individuals in EU/EEA to request the deletion of their personal data under specific circumstances. Learn the six grounds for erasure, the time limit to take action, and how organizations can handle deletion requests properly.
Read more
Article
May 13, 2025
GDPR penalties: What is the maximum fine for GDPR breaches?
GDPR fines make headlines because of their high dollar values. We look at why companies may be fined, who enforces the GDPR, who is responsible for compliance, and how companies can protect themselves against GDPR violations.
Read more
Article
May 9, 2025
Who is responsible for GDPR compliance?
Data controllers and processors are mainly responsible for ensuring that their data collection and processing is GDPR-compliant. Data protection authorities in EU countries manage GDPR enforcement.
Read more
Article
Mar 27, 2025
The ePrivacy Directive, GDPR, and future of EU privacy regulation: What it means for your business
The ePrivacy Directive and GDPR impact companies doing business in the EU. How are their requirements evolving, and how will data privacy compliance and enforcement change now that the push for the ePrivacy Regulation has been abandoned? We look at ePrivacy, cookies and data protection in the EU.
Read more
Article
Mar 5, 2025
UK government demands access to Apple users’ encrypted data
Under a controversial law, the UK government demanded that Apple provide access to currently encrypted files and user data stored in Apple’s cloud servers. The action would give the UK government access to worldwide user data, however, not just Apple users in the UK.
Read more
Article
Feb 27, 2025
European Court of Justice fines European Commission for US data transfer violation
A login option on a conference website the European Commission managed made it possible for personal data to be transferred to the United States without authorization or adequate security measures. We look at the complaint, how the violation happened, and how it was resolved.
Read more
Article
Feb 19, 2025
EU regulators scrutinize DeepSeek for data privacy violations
Chinese AI company DeepSeek has caused a stir with its R1 model. EU regulators are also paying attention and expressing concern over the app’s collection and use of EU residents’ personal data. We look at why data protection authorities are investigating and what action they’re taking.
Read more
Article
Feb 3, 2025
New regulatory updates for cookie use in Norway: What to know and how to comply
Norway’s data privacy protections have become stricter and in line with EU standards, with regulatory updates for cookie use taking effect as part of the E-Com Act (Ekomloven). We explore what the new rules are, how companies can comply with them, and what penalties are for violations.
Read more
Article
Jan 30, 2025
The BeReal case: Use of dark patterns for app consent?
Privacy advocacy group noyb filed a complaint against social networking app BeReal for allegedly manipulating its users into consenting to specific uses of their data. Is consent by banner fatigue a violation of the GDPR? We look into the case.
Read more
Article
Jan 13, 2025
CCPA penalties and fines: What are the consequences of noncompliance?
Read more
Article
Jan 8, 2025
Québec Law 25: an overview
Québec Law 25 modernizes privacy laws for the Canadian province, introducing stricter rules for obtaining consent, protecting personal information, and individuals' rights. Learn what this means for organizations that operate in Québec, and how they can comply with the law’s requirements.
Read more
Article
Jan 3, 2025
What is a Data Protection Officer and does your company need one?
A Data Protection Officer can be essential for complying with privacy regulations and protecting personal data. By understanding evolving legal requirements, a DPO helps build a strong foundation for data protection and long-term success.
Read more
Article
Jan 3, 2025
Australia’s Online Safety Amendment (Social Media Minimum Age) Bill: Will the social media ban for teens work?
Australia has passed a strict new law banning much social media access for children under age 16. The ban is intended to address safety and mental health concerns for children and teens online. Access to various social platforms is prohibited and implementing age-gating measures is required.
Read more
Article
Dec 17, 2024
A complete overview of student privacy laws around the world
Student data privacy laws protect confidential information about students’ enrollment, academic performance, financial arrangements, and more. Understand worldwide regulations that educational institutions must abide by.
Read more
Article
Dec 13, 2024
The European Accessibility Act (EAA): an overview
The European Accessibility Act (EAA) sets accessibility standards for products and services across the EU, aiming to improve inclusion for people with disabilities and older adults. Learn what it covers, who must comply, and how to prepare for the June 2025 enforcement deadline.
Read more
Article
Dec 12, 2024
What you need to know about the 7 principles of GDPR
If you operate in the EU or serve EU customers, it’s important to understand the 7 GDPR principles and how to apply them to your data practices. Below are clear examples and actionable steps you can take to help your business stay compliant and build trust.
Read more
Article
Dec 3, 2024
CCPA vs GDPR: key differences and similarities
The CCPA/CPRA and the GDPR are landmark data privacy regulations that impact organizations worldwide. We look at the differences and similarities between the two laws, and how organizations can achieve compliance with both.
Read more
Article
Dec 3, 2024
CCPA vs CPRA: Key differences for businesses to know
The CCPA and CPRA give consumers control over their personal information and impose obligations on businesses. This guide explains differences between the two laws, ways the CPRA amends or replaces the CCPA, new consumer rights under the CPRA, and businesses’ compliance requirements.
Read more
Guide
Nov 28, 2024
Fair use disclaimer: complete guide with template
Learn what a fair use disclaimer is and whether your website could need one, then create your own with our customizable template.
Read more
Guide
Nov 26, 2024
Terms of Service: what it means, with examples
Learn what a Terms of Service agreement is, how to create one, and whether you need one for your website.
Read more
Article
Nov 25, 2024
What you need to know about data processing agreements (DPAs)
A Data Processing Agreement (DPA) is a legal contract that outlines how personal data should be shared, processed, and secured between businesses and their third-party providers. It ensures that businesses remain compliant with data protection laws.
Read more
Article
Nov 25, 2024
A guide to CIPP certification: What it is and how to get it
Data privacy is only growing in importance, and CIPP certification could be a valuable credential to those working in or transitioning into the field. Learn about what this certification is, how it can benefit your career, and how to earn it.
Read more
Article
Jun 26, 2024
Understanding Andorran cookie guidelines: a comprehensive overview
The Andorran data protection authority (APDA) issued guidelines on the use of cookies in Andorra, requiring compliance from January 2024. We take a look at the Andorran cookie guidelines to learn about cookie banner and privacy policy requirements, and how you can be compliant.
Read more
Article
Jun 13, 2024
Understanding the Washington My Health My Data Act: a comprehensive guide
The Washington My Health My Data Act is a state-level data privacy law that focuses solely on consumer health data, but it has wide-reaching implications for businesses both in and out of the state.
Read more
Article
Jun 3, 2024
Brazil’s General Data Protection Law / Lei Geral de Proteção de Dados (LGPD) – an overview
Brazil’s LGPD builds on existing Brazilian law and the legislation was influenced by the GDPR. We look at how it addresses consumer rights, companies’ responsibilities, and enforcement.
Read more
Article
May 30, 2024
Understanding Google’s new consent requirements for Switzerland
Effective from July 31, 2024, Google has extended its EU User Consent Policy to encompass users in Switzerland. What does this policy expansion mean for businesses? And what are the necessary steps for compliance?
Read more
Article
May 26, 2024
How the EU Data Act affects businesses and consumers
The European Union's Data Act sets new rules to regulate the way data holders and users can manage and use the vast amounts of data generated from connective devices. We look at what this means for personal and non-personal data sharing, and the obligations laid down by the regulation.
Read more
Checklist
May 21, 2024
Consent Management Checklist for GDPR Compliance
If you do business or serve customers in the EU, then the GDPR applies to you. Easily achieve compliance by reading our GDPR compliance checklist and downloading it to complete the steps.
Read more
Article
Apr 18, 2024
Digital Markets Act uncovered: top 30 DMA questions answered
We provide answers to the most frequently asked questions about the Digital Markets Act (DMA). Gain insights into the latest regulatory measures and discover how they are shaping the digital landscape and impacting businesses.
Read more
Article
Mar 28, 2024
The EU’s General Data Protection Regulation (GDPR) – an overview
The EU’s GDPR is a well-known, influential European data privacy law. We look at how it addresses consumer rights, companies’ responsibilities, and enforcement.
Read more
Article
Mar 18, 2024
Tailoring Asian businesses’ marketing strategies for European privacy compliance and success
Both Asia and Europe are large geographies with significant audience and business opportunities. However, there are particular business challenges, and data privacy regulation is an especially important consideration for Asian companies looking to establish a foothold in European markets.
Read more
Article
Mar 5, 2024
What is a sovereign cloud why is it important for your data protection strategy?
Companies increasingly take to the cloud to store data, and sovereign clouds can help comply with regulatory requirements. Learn how an EU Sovereign Cloud impacts data sovereignty and residency as required by EU laws like the General Data Protection Regulation (GDPR).
Read more
Article
Jan 16, 2024
What is the Google EU user consent policy?
Google's EU user consent policy sets the foundation for responsible data handling in digital advertising. We explore how websites that have received a noncompliance notice from Google can use a Consent Management Platform (CMP) to enable compliance and avoid suspension from Google's platforms.
Read more
Article
Jan 3, 2024
Data privacy regulation in 2024: what we’re watching
Data privacy saw a lot of change and advancement in 2023. More regulations, more requirements from businesses and more consumer expectations. There is unprecedented opportunity for innovation and 2024 promises that change will accelerate even faster. Let’s look at what to expect in data privacy.
Read more
Article
Nov 2, 2023
US privacy law compliance for EU companies
If you are an EU company looking to do business in the US, this article provides you with some of the answers you will need to know about the US Privacy Law.
Read more
Article
Aug 18, 2023
Saudi Arabia Personal Data Protection Law (PDPL): An Overview
The Saudi Arabia Personal Data Protection Law came into effect in March 2022, though enforcement did not begin for a year. The PDPL is quite similar to the EU’s GDPR in scope.
Read more
Article
Aug 17, 2023
Understanding the EU-U.S. Data Privacy Framework: What it means for your data?
The European Union and United States again have an adequacy agreement governing privacy and security for international data transfers. The Data Privacy Framework went into effect July 10th, providing new safeguards for EU residents and enabling US companies to self-certify.
Read more
Article
Aug 16, 2023
What is the best protection method for sharing PII?
Companies collect consumers’ data to improve user experiences, target advertising, and more. When organizations obtain and share personally identifiable information (PII) in the course of business operations, they have to ensure that it’s protected.
Read more
Article
Jul 25, 2023
How does the GDPR affect B2B sales?
GDPR compliance applies to personal data used for B2B sales and marketing operations just as it does to B2C operations. It’s as important to build trust with partners as with customers. We look at how the GDPR affects the B2B outbound sales process and how organizations can achieve compliance.
Read more
Article
Jul 21, 2023
Switzerland's Federal Act on Data Protection (FADP)
Switzerland’s new FADP replaces the previous 30-year-old data privacy act, bringing it up to date with new technologies and giving Swiss citizens new rights.
Read more
Article
Jul 18, 2023
Guide to the EU AI Act
The EU AI Act was adopted in March 2024, making it the world’s first comprehensive AI regulation. It has become influential on future AI legislation around the world. Usercentrics delves into what the EU AI regulation includes, who it affects, and what it means for data privacy.
Read more
Article
Feb 1, 2023
Japan Act on the Protection of Personal Information (APPI): An Overview
Japan has had data privacy laws for two decades. The APPI has notable differences from the GDPR, and was most recently amended in 2020.
Read more
Article
Apr 14, 2022
South Africa’s Protection of Personal Information Act (POPIA): A complete guide
South Africa’s POPIA is a data privacy law that preceded the GDPR by five years. We look at how it addresses consumer rights, companies’ responsibilities and enforcement.
Read more
Article
Nov 18, 2021
The Telecommunications Telemedia Data Protection Act (TTDPA): what’s changed for companies
As of December 2021, a new data protection law with an expanded scope will apply to companies in or operating in Germany.
Read more
Article
Nov 3, 2021
China’s Personal Information Protection Law - An Overview of PIPL
We look at what China’s Personal Information Protection Law means for the data privacy rights of citizens and for companies’ responsibilities.
Read more
Article
Oct 18, 2021
Italian DPA announces new guidelines and tighter deadlines
How can you make sure to navigate data privacy correctly? This article provides you with the relevant information regarding GDPR in Italy.
Read more
Article
Sep 13, 2021
European Data Protection Board guidelines for consent
In this article, we have compiled a summary of the most important points from the European Data Protection Board's, new guidelines for Consent.
Read more
Article
Aug 30, 2021
POPIA vs GDPR: an overview
What is POPIA compliance, and how does it compare to GDPR compliance? You can learn this and more in our POPIA Vs GDPR article.
Read more
Article
Aug 31, 2020
Poland: New data protection regulations including consent under GDPR
Read more
Article
May 24, 2019
European elections: Websites of German top candidates checked on GDPR compliance
European elections: A check shows that the candidates' websites are far from being GDPR compliant. Learn more!
Read more