Free Data Protection Review
Blog

Notes on UK data protection, written for people with other jobs to do

Short pieces on what changed, what it means in practice, and what we see going wrong in small organisations.

Laptop on a desk beside printed papers and a plant
Featured ·
GDPR basics

What a subject access request actually requires you to do

The one-month clock, what you can withhold, and why the first week matters more than the last. Written for the person who opens the inbox, not the legal team.

28 October 2026
·
6
min read
Laptop on a desk beside printed papers and a plant
Sector notes

Why "We've Always Done It This Way" Is the Biggest DPIA Risk in Primary Care

New software, scribes and messaging tools reach GP practices every month. Why habit is the biggest risk when deciding if you need a DPIA, and a simple way to check.

12 November 2026
·
6
min read
Network cable plugged into a switch in an IT cupboard
Breaches & incidents

8.8 Million Records Through One Small Company: Who Is Looking Up Your Data?

Attackers abused one small firm's legal access to Denmark's population register. What UK organisations should learn about supplier access and monitoring.

11 November 2026
·
5
min read
Two people signing a document at a desk
Breaches & incidents

When Records Disappear: What the £150,000 ABRSM Penalty Teaches Any Organisation About Keeping the Right Data

Ofqual fined ABRSM £150,000 over lost exam recordings and 72,000 wrongly titled certificates. What it means for retention and accuracy of your records.

10 November 2026
·
6
min read
Two developers working on code at monitors
GDPR basics

Pseudonymised Is Not Anonymous: What the €7 Million IQVIA Fine Means for Anyone Sharing Data for Analysis

Italy's regulator fined IQVIA €7m for calling patient data anonymous when it could be tracked over time. What it means for health, retail and analytics data.

9 November 2026
·
5
min read
Colleagues around a meeting table listening to a speaker
Breaches & incidents

Innovation Must Not Outpace Your Data Protection: What the Met Police Reprimand Teaches Every Organisation

The ICO reprimanded the Met over an unapproved intelligence-sharing platform and a missing DPIA. Five lessons for any organisation adopting new tools.

8 November 2026
·
5
min read
Laptop on a desk beside printed papers and a plant
GDPR basics

DPIAs Aren't Paperwork: They're a Design Tool

A data protection impact assessment is a design tool, not a form to file. How to run a short, useful DPIA in seven steps, with a worked example.

7 November 2026
·
5
min read
Two developers working on code at monitors
AI

Data Protection by Design for AI Startups: A Founder's Checklist

Building an AI product that uses personal data? A practical UK GDPR checklist for founders: lawful basis, DPIA, minimisation, suppliers and human oversight.

6 November 2026
·
6
min read
Colleagues around a meeting table listening to a speaker
GDPR basics

What a GDPR Gap Analysis Actually Finds (and What It Doesn't)

What happens in a GDPR gap analysis, the gaps we find most often, what you get at the end and what it cannot tell you. A plain-English guide for UK organisations.

5 November 2026
·
5
min read
Two small business owners standing in their cafe
Sector notes

"Continue Without Accepting" Must Mean What It Says: What France's €7 Million Fnac Fine Teaches Retailers Before Black Friday

France fined Fnac Darty €7m because its app kept tracking users who refused consent. A pre-Black Friday checklist for UK retailers and e-commerce teams.

4 November 2026
·
5
min read
Network cable plugged into a switch in an IT cupboard
Breaches & incidents

Cyber incidents and data breaches: preparing for two reporting clocks

The Cyber Security and Resilience Bill adds a 24-hour reporting deadline on top of the 72-hour UK GDPR breach clock. Two clocks, different regulators, the same incident.

3 November 2026
·
3
min read
Two small business owners standing in their cafe
GDPR basics

GDPR for small businesses: the five things that actually matter

You don't need a 40-page policy. For most small businesses, getting five things right covers most of the risk: know your data, be open about it, have a lawful basis, keep it secure and be ready.

2 November 2026
·
4
min read
Two developers working on code at monitors
Breaches & incidents

"Password1" is not a security control: lessons for anyone with an IT provider

A test account from 2012, a password of "Password1" and a ransomware attack twelve years later. What the ICO's reprimands of two Welsh organisations mean for anyone who relies on an IT provider.

1 November 2026
·
4
min read
Colleagues around a meeting table listening to a speaker
GDPR basics

Data protection and directors: when the risk becomes personal

Data protection used to be a corporate risk. In 2026 it is becoming a personal one. What the law says about directors, what is driving the change, and what it means in practice.

31 October 2026
·
3
min read
Quiet office with a desk, chairs and a computer
GDPR basics

Monitoring staff: what UK GDPR already requires, and what's coming

1 in 3 UK organisations now monitor their employees' digital activity, and the law around it is about to change. What UK GDPR already requires and where most organisations go wrong.

30 October 2026
·
3
min read
Two people signing a document at a desk
Breaches & incidents

When your supplier has a data breach, it's still your problem

Your supplier had a breach and your customers are affected. Under UK GDPR, that is your problem. What the law says, what recent fines show, and three things to do now.

29 October 2026
·
3
min read
No charge · no obligation

Want to know how your own organisation would handle this?

The free review looks at your records, contracts, staff practice and security, and tells you in writing what to fix first.

Get Your Free Data Protection Review
Or book a discovery call if you'd rather talk first.