Blog

A Data Protection Impact Assessment (DPIA) doesn’t always need to focus on a single, isolated processing activity. In many organisations—especially those with interconnected systems and overlapping workflows—it makes sense to complete one DPIA that covers multiple related processing activities, provided it remains clear, usable, and defensible. Done properly, a “multi-activity

What Employers Must Include in an Employee Privacy Notice (Worker-Facing Privacy Statement) to Be GDPR Compliant An employee privacy notice (sometimes called a privacy statement or privacy policy) sets out how an employer collects, uses, stores, and shares personal data about its workforce. Under the UK GDPR, this notice plays

GDPR Basics for HR: why is it important to understand the lawful bases for employee data processing? Employee data is core to HR functions. This is true before, during, and after employment. For example, during recruitment, for payroll, absence management, performance reviews, learning and development, safeguarding, workplace investigations, references and

The UK National Data Opt Out: What It Is and How It Relates to the GDPR The use of patient data plays a vital role in improving health and care services. It supports research, planning, and the delivery of safer, more effective treatment. At the same time, patients rightly expect

Responding to a subject access request within statutory timescales is a real challenge. Finding, reviewing and collating all the information you hold about a person in 30 days or less involves a lot of steps, and can involve a lot of people. It can be easy to lose track, miss

The Biggest GDPR Compliance Challenges for Businesses — and How Expert-Led Training Helps Overcome Them GDPR compliance is rarely undone by bad intentions. More often, it fails because organisations underestimate the complexity of the regulation, overestimate their internal capability, or treat data protection as a purely technical issue. The result

A Data Protection Impact Assessment (DPIA) is a structured risk assessment used to identify and reduce privacy risks in a project or process that involves personal data. Under the UK GDPR, organisations must complete a DPIA before they start certain types of processing—especially where that processing could create a high

Here’s a practical, step-by-step guide to handling a Subject Access Request (SAR) under UK GDPR / GDPR within statutory timescales, plus a downloadable checklist is at the end. We'll start by explaining the legal background, before taking you through the key steps - and why they are important - to

In health and social care, protecting people’s confidential information is more than a legal requirement — it is a core ethical responsibility. One of the most important roles in maintaining this trust is that of the Caldicott Guardian. Yet, outside clinical governance circles, many people are unfamiliar with what a

The Data Use and Access Act (DUAA) has introduced an important new right into UK data protection law — a right for individuals to complain directly to data controllers if they believe their personal data has been mishandled. This right, set out in section 164A of the Data Protection Act

If you’re a smaller or newer business, or you just don’t share personal data very often, then it is more than likely you won’t have your own standard template data sharing agreement. Instead, you’re likely to rely on the equivalent template provided by organisations you get personal data from or

As workplaces become increasingly digital, employers have greater access to employee monitoring. Whether it’s tracking websites visited during working hours, using CCTV in the workplace, or monitoring emails, employee surveillance has become a common — and often controversial — feature of modern management. The rise of remote and hybrid working