A practical guide to personal data breaches under UK GDPR, including what counts as a breach, when the ICO must be notified, when affected individuals need to be informed, and the steps organisations should take after an incident.
Businesses need a clear process for handling data protection complaints, especially where individuals raise concerns about how their personal data has been used. This guide explains what organisations should have in place under UK GDPR, including complaint routes, response records, escalation steps, and links to wider accountability.
Many organisations collect personal data but are less certain about when it should be deleted. Under UK GDPR, personal data must not be kept for longer than necessary. This guide explains the storage limitation principle, how retention periods are determined, and what businesses should include in a retention schedule.
A practical guide to what GDPR privacy notices are, what businesses need to include, and how clear privacy information helps organisations meet UK GDPR transparency requirements.
Consent under UK GDPR is not always required, but when organisations rely on it, the standard is high. Learn when consent is needed, what valid consent looks like, and the common mistakes organisations make.
Legitimate interests is one of the six lawful bases under the UK GDPR, but it is often misunderstood. This guide explains when organisations can rely on legitimate interests, how the balancing test works, and where businesses commonly get it wrong.
Understanding lawful basis under UK GDPR is essential because organisations must have a valid legal reason before processing personal data. This guide explains the six lawful bases, when each applies, and common mistakes organisations make.
Personal data under UK GDPR includes any information that can identify a person directly or indirectly, from names and email addresses to IP addresses, customer records, and online identifiers. This guide explains what counts as personal data, what does not, and why the distinction matters for compliance.
Special category data under UK GDPR includes highly sensitive personal information such as health data, racial or ethnic origin, political opinions, religious beliefs, biometric data, and information about a person’s sex life or sexual orientation. This guide explains what counts as special category data, why stronger protections apply, and the additional conditions organisations usually need before processing it lawfully.
Understand the difference between data controllers and data processors under UK GDPR, including who decides the purpose of processing, who acts on instructions, and why the distinction matters in practice.
