Blog

When can an organisation process personal data because it is in its legitimate interests, and how does it demonstrate that those interests do not override people's rights? Legitimate interests is one of the lawful bases available under Article 6. It can be flexible, but that does not make it a

Subject Access Requests can present a significant burden on organisations. They are the most frequently exercised GDPR right and organisations need a clear process to handle subject access requests. This ensures they meet their statutory duties under the Data Protection Act and can cope with the work involved. The risks

Data protection risk is much more than the odds of receiving a fine from the Information Commissioner's Office (ICO). Poor management of personal data can harm the people whose information an organisation holds, but it can also create significant risks for the organisation itself. These can include financial loss, disruption

Every organisation that processes personal data must understand the lawful bases for processing personal data. Under the UK GDPR, these reasons are known as the lawful bases for processing. Choosing the correct lawful basis is an important part of data protection compliance. It affects whether you can process personal data

The Principle of Accountability means organisations cannot simply claim to comply with the GDPR. They must be able to demonstrate that compliance through policies, records, governance arrangements and day-to-day practices. This is the purpose of the accountability principle. It requires organisations to take responsibility for protecting personal data and to

Every organisation that processes personal data has a responsibility to protect it. Whether information is stored electronically, on paper or shared verbally, individuals expect it to remain accurate, available when needed and protected against unauthorised access, loss or misuse. The GDPR's integrity and confidentiality principle establishes the security and governance

Caldicott Guardians have a central role in the ethical and safe use of patient information. Their key contribution to data protection and information governance is set out in the Caldicott Principles but they must also be mindful of a range of wider guidance and legislation such has the GDPR. One

Storage limitation matters because every item of personal data has a lifecycle. Information is collected, used, shared and eventually reaches a point where it is no longer needed. The GDPR recognises that retaining personal data indefinitely increases privacy risks, creates unnecessary costs and undermines public trust. The storage limitation principle

WuDo Solutions has been providing world-class governance expertise to the public, private and charity sectors for 11 years. This support has taken many forms, from interim management to project delivery, training and reviews. Going forward we will continue to do so, but with a narrower (but deeper) focus.    

Grievances and disciplinary processes are among the highest-risk areas for conflicts of interests. HR teams are responsible not only for ensuring fairness but also for ensuring that justice is seen to be done. A failure to identify and manage conflicts can result in successful employment tribunal claims, damaged employee relations,

Many people have second jobs in order to make ends meet, to help fill up their time outside of the usual 9 to 5, or because they have a passion for a cause, project or sector that doesn’t pay well (so their ‘first job’ is there to provide an income).