This site uses cookies. You can read how we use them in our privacy policy.
When can an organisation process personal data because it is in its legitimate interests, and how does it demonstrate that those interests do not override people's rights? Legitimate interests is one of the lawful bases available under Article 6. It can be flexible, but that does not make it a
Subject Access Requests can present a significant burden on organisations. They are the most frequently exercised GDPR right and organisations need a clear process to handle subject access requests. This ensures they meet their statutory duties under the Data Protection Act and can cope with the work involved. The risks
Consent is one of the lawful bases for sharing data under GDPR but it is only one – and suitable for only limited situations. Here we discuss when it does, and does not, work.
Data protection risk is much more than the odds of receiving a fine from the Information Commissioner's Office (ICO). Poor management of personal data can harm the people whose information an organisation holds, but it can also create significant risks for the organisation itself. These can include financial loss, disruption
