Blog

Download your GDPR Maturity Matrix with five maturity levels (1 = Initial, 5 = Optimised) across the requested domains. It’s written so you can lift it straight into a governance pack or audit framework. Get the template here:   [gravityform id="58" title="false" description="false"] [su_box title="About the Author" box_color="#020a4a"]Michael has many

Subject Access Requests (SARs) are one of the toughest parts of GDPR compliance. They’re also one of the most common — and most time-consuming — rights organisations people exercise. A client recently asked me if we can use AI to help manage SARs. That’s a complex question. As an experienced

Most people understand a Subject Access Request (SAR) as a request for a copy of personal data. That’s true—but it’s also incomplete. Article 15 of the GDPR requires organisations to provide not only the personal data itself, but also a package of supplementary information that explains how and why the

The Data Use and Access Act changes the Data Protection Act, the UK GDPR, and the Privacy and Electronic Communication Regulations. In this briefing we cover some of the main changes, what they mean, and crucially what they mean for you. Be sure to scroll down to the bottom and join

The General Data Protection Regulation (GDPR) provides individuals with several rights regarding their personal data. Two of the most important — but often confused — rights are: Right of Access (Article 15) Right to Data Portability (Article 20) Below is a comparison and contrast of these two rights, including practical

Email and subject access requests do not go together well. Under the UK GDPR and Data Protection Act 2018, organisations are required to respond to a Subject Access Request (SAR) within one calendar month. While this timeframe may seem manageable in theory, the reality is that emails often present the

A privacy statement is also frequently referred to as a privacy notice or privacy policy. It is a public declaration by an organisation that explains how it collects, uses, stores, shares, and protects the personal data of individuals. [su_box title="About the Author" box_color="#020a4a"]Michael has many years' experience supporting, developing and

In this guide on GDPR for employers and HR we explore some of the key challenges, and steps you can take to ensure compliance. Although many organisations forget this, GDPR applies to workers and staff as much as it does to customers and service users. Data protection is not optional.

The NHS National Data Opt Out: what it is and why it Matters [su_box title="About the Author" box_color="#020a4a"]Michael has many years' experience supporting, developing and improving effective data protection and GDPR compliance systems. He has worked in this field in the public, private and charity sectors including at Board level.

Understanding a Record of Processing Activity (RoPA) and its importance for GDPR compliance. [su_box title="About the Author" box_color="#020a4a"]Michael has many years' experience supporting, developing and improving effective data protection and GDPR compliance systems. He has worked in this field in the public, private and charity sectors including at Board level.

The UK Government has reintroduced a bill (The Data (Use and Access) Bill) to amend the UK GDPR. This Bill is based on the previous government’s proposals, but omits some key changes. The Data (Use and Access) Bill introduces several amendments to the UK's data protection framework. These amend the

Do I need to Register with the ICO? Under UK data protection law, the Data Protection (Charges and Information) Regulations 2018, most organisations and businesses that process personal data are legally required to register with the Information Commissioner’s Office (ICO) and pay a data protection fee. The fee funds the