All Articles

GDPR Chapter 5 – International Data Transfers GDPR recognises that personal data transferred outside the UK may not be subjected to the same legal standards. As such, GDPR Chapter 5 (GDPR Artic…

GDPR Article 32 on Information Security For most businesses, information security is the biggest risk associated with GDPR. However, GDPR provide very little guidance for organisations regar…

Controller-Processor Data Processing Agreements (DPA) If a company (a Data Controller) is outsourcing the processing of personal data to a third party (a Data Processor), GDPR states that there…

The following information is a full copy of the UK Data (Use and Access) Act 2025 (DUAA). The UK Data (Use and Access) Bill (DUAB) received Royal Assent on 19th June 2025. Data (Use and Acce…

QR Code Scam – UK Fraud Alert Beware of fake QR Codes. QR Codes Scams are rapidly on the rise in the UK. Fake QR codes are expected to cause more than £2m fraud in the UK, in 2024. Each v…

Is your Data Protection Officer (DPO) qualified? Are Data Protection Officer qualifications a GDPR legal obligation? What qualification should a DPO have? How do we know if the DPO is doi…

What is the Minister of State for Data Protection and Telecoms? The Minister of State for Data Protection and Telecoms is a government role. Responsibilities of the role vary between differe…

What is PECR? PECR is part of UK law, with a focus on direct marketing, website cookies and telecommunications data protection legislation. Fines for failing to comply with PECR can be as hi…

What is GDPR? GDPR is part of UK law, providing us with part of our data protection legislation. What does GDPR stand for? GDPR is an acronym that stands for the General Data Protection R…

The Cyber Security and Resilience Bill was announced in the Kings Speech, on 17th July 2024. The recently voted Labour government has suggested that this will keep personal data safer. The B…

CrowdStrike, a US cybersecurity company, saw it’s shareprice drop by more than 10% today, after an update (patch) crashed computer systems around the world. Who is CrowdStrike? CrowdStrike, …

The Digital Information and Smart Data Bill was announced in the Kings Speech, on 17th July 2024. The government has suggested that this will make better use of digital data. But …

The 7 GDPR Principles for Data Protection The GDPR, a UK data protection law, gives us 7 principles for processing personal data. Complying with these 7 principles is a legal obligation. …

Grindr, the self claimed “world’s largest social networking app for LGBTQ” has been fined (July 2024) €5.65m under GDPR, by the Oslo District Court in Norway.

Are you sure that your marketing referral scheme is lawful under GDPR and PECR data protection laws? Refer-a-Friend, Member-get-Member and Customer-get-Customer schemes can be a great way to gr…

There’s still a lot of confusion in companies around when DPIAs (Data Protection Impact Assessments) are legally required under GDPR – the UK and EU data protection legislation. We’ve found tha…

On 17th October 2023, the 10 most recent ICO fines were: £65k fine (21/9/23) RHAP made 15,288 marketing calls £55k fine (21/9/23 – House Hold Appliances 247 Ltd made 19,069 marketing calls…

As at 17 October 2023, the biggest GDPR fines across UK and Europe were: €1.2bn GDPR fine (2023) for Meta Platforms Ireland Ltd. Transfers to US without adequate safeguards. €746m GDPR fin…

What is GDPR Article 13 – Privacy Notice? The correct title of GDPR Article 13 is actually “Information to be provided where personal data are collected from the data subject.” Essentially, …

What is GDPR Article 6 Lawfulness of processing? Under GDPR, each purpose of processing must be assigned a lawful basis. Consent is only one type of lawful basis, so you can chose other lawf…

What is GDPR Article 5 – Principles of Processing? GDPR provides several core principles (considerations / requirements) for processing personal data. GDPR Article 5 defines those processes …

What is GDPR Article 4 Definitions? GDPR Article 4 Definitions quite simply defines a number of the key terms that apply in the regulation. What does GDPR Article 4 Definitions actually say?…

What is GDPR Article 30 Records of Processing Activities (RoPA)? Under GDPR, organisations must maintain a Records of Processing Activities, if they “employ” 250 people of more, processes data …

What is GDPR Article 25 – Data protection by design and by default? Data protection by Design requires organisations to consider data protection through the lifecycle of the processing, from pr…

Data Processing Agreements – GDPR Contracts for Controllers and Processors Under GDPR, data can only be shared between Data Controllers and Data Processors if there is an adequate written agree…

6/9/22 ICO has fined UK retailer Halfords £30k for sending 498,179 direct marketing emails unlawfully. The email contained an offer related to a “Fix Your Bike” government scheme, which prov…

18/9/22 It is thought that Rockstar Games, producers of Grand Theft Auto (GTA), has suffered a security breach. Teapotuberhacker posted 90 short videos, which appears to show footage of the…

20/9/22 Morgan Stanley agreed to pay $35m fine to US SEC, down from the original suggestions of $60m in January 2022, over allegations that they failed to secure customer data when disposing of…

Rumour has it that Uber has suffered a cyber security breach. Uber Tweet 15/9/22 News suggests an 18 year old claims having gained access via Slack, and posted images that appear to show fu…

What is a ISO 27001 Statement of Applicability SoA ? What is a Statement of Applicability (SOA) for ISO 27001 in 27002? ISO 27001 in the International Standard Organisation’s (ISO) I…

Top 11 Things a GDPR Website Privacy Notice or Privacy Policy Must Have What MUST be on a GDPR Website Privacy Notice or Privacy Policy? Under GDPR, Every website probably needs a GD…

GDPR Website Privacy Policy or Privacy Notice? This is a conversation that we’ve been having more than expected over the last 5 years, so it’s time for a blog… Should your website …

The Three Lines of Defence Risk Management Model What is the Three Lines of Defence model? The Three Lines of Defence model helps business leaders to manage risk effectively. It facilitat…

What Skills Do DPOs Need? GDPR Data Protection Officers DPOs require quite a multi-disciplinary skill set. GDPR says they must be designated on the basis of professional qualities and, in pa…

What are the mandated tasks for DPOs in UK GDPR? EU and UK Data protection law – the GDPR – mandates that the DPO must fulfil certain obligations and tasks. This includes: Informing and adv…

Do we need a Data Protection Officer (DPO) for GDPR? If you process process personal data in UK or EU, GDPR probably applies and you may need a Data Protection Officer (DPO). When Does GDPR …

Cathay Pacific airway fined £0.5m by ICO for cyber-attack Part of the cost of cyber-attacks 4th March 2020 Cathay Pacific airways has been fined £0.5m (the pre-GDPR maximum) by the UK ICO…

Morrisons found not vicariously liable for data breach Lucky for Morrisons and everyone else 4th April 2020 The UK’s top court has ruled that Morrisons can’t be held liable for a 2014 dat…

€50k fine part due to DPO assignment Keeping DPOs independent 28th April 2020 The Belgian Data Protection Authority (28/4/20) fined a company €50k, for: Having a DPO that lacked indepe…

£18bn lawsuit filed against EasyJet after cyber-attack Part of the cost of cyber-attacks 26th May 2020 Law firm PGMBM has issued a £18bn “no-win-no-fee” class action claim in the High Cou…

US Privacy Shield invalid – Schrems – GDPR – Data Protection European Court of Justice finds EU – US Privacy Shield invalid 16th July 2020 Max Schrems, an Austrian activist known for camp…

ISO 27002:2013 Standard Information Security What is ISO 27002:2013? ISO 27001 suppliments ISO 27001 (The Information Security Management System or ISMS) by providing a list of comm…

The UK Data Protection Act We believe the following to be accurate transcription of the legislation, but provide no guarantee about its accuracy or completeness. Links to particularly useful…

Privacy and Electronic Communications Regulation (PECR) We believe the following to be accurate transcription of the legislation, but provide no guarantee about its accuracy or completeness. …

The EU General Data Protection Regulation (GDPR) We believe the following to be accurate copy of the legislation, but this is not a guarantee. For data protection matters, always consult a s…