Discover the comprehensive range of data protection services at Data Protection People. Tailored to meet the unique needs of your organisation, our expert team has successfully handled every challenge imaginable. Whether you’re navigating compliance complexities or enhancing data security, trust DPP to be your partner in safeguarding information.
Data Protection People have a wide range of training services catering for every need. Whether its general training for operational or admin staff or specific training for specialist roles, we have something for you. watch the short video below to meet the team and find out more about our training services.
Contact Us
DataWise is the original privacy tech platform designed to simplify GDPR compliance management. Since its inception in 2011, DataWise has continuously evolved, solidifying its reputation as the pioneering "privacy tech" solution.
Contact Us
Unlock Compliance Excellence with Our GDPR Consultancy Services. Navigating the intricate realm of data protection laws and standards demands expert guidance.
Contact Us
A data protection officer doesn't have to be a full time employee and in many respects it's better to have a company like DPP take on the role. Watch the video below to find out more about our outsourced DPO and privacy officer services or reach out and get in touch with us.
Contact UsAt Data Protection People, our cyber security services are designed to fortify your digital defences. With a proven track record spanning diverse sectors in the UK, our seasoned team brings a wealth of experience in handling a wide array of cybersecurity challenges. Reach out to us and explore how DPP can enhance your organisation’s cyber resilience.
A PCI assessment is an audit for validating compliance with the Payment Card Industry Data Security Standard (PCI DSS), a set of security standards for merchants who accept, process, store or transmit credit card information.
Contact Us
A PCI assessment is an audit for validating compliance with the Payment Card Industry Data Security Standard (PCI DSS), a set of security standards for merchants who accept, process, store or transmit credit card information.
Contact Us
Our experts can support you with Dark Web Monitoring - Data Protection People offer a free dark web scan for your organisation.
Contact Us
Our tailored program, guided by industry-certified experts, supports your ISO 27001 compliance journey. Whether you need advice on certification scope, assistance with remediation work, or comprehensive ISO 27001 consultancy, we’re here to guide you every step of the way.
Contact Us
At Data Protection People, we recognise the dynamic challenges and unique responsibilities of the Data Protection Officer (DPO) role. Beyond offering standard support, we provide a comprehensive suite of services crafted to empower DPOs at every step.
Collaborative Community: Navigating the intricate landscape of data protection can be isolating. That’s why we’ve fostered a collaborative community of privacy professionals. As a DPO with us, you’re never alone. Our network serves as a forum for insightful discussions, sharing solutions, and building a sense of camaraderie.
Expert Guidance and Advice: The journey of a DPO is often filled with complex decisions. Our seasoned team of experts is your reliable resource, offering timely advice and strategic guidance. We’re not just a service provider; we’re your dedicated partners in overcoming challenges and making informed decisions.
Advanced Training for Continuous Growth: Stay ahead in your role with our advanced training programs. Tailored for DPOs, our courses delve into intricate aspects of data protection, providing you with a competitive edge. It’s not just about meeting the present challenges but ensuring your continuous growth and excellence in your role.
Audits, Assessments, and Document Reviews: Our services extend beyond conventional boundaries. From comprehensive audits and assessments to meticulous document reviews, we ensure that your data protection strategies are not only compliant but also optimised for efficiency.
Simplifying Complexity for Future Ease: Beyond addressing current challenges, our mission is to simplify the complexities inherent in data protection. By partnering with Data Protection People, you’re not just solving problems – you’re ensuring a smoother, more efficient role in the future. We streamline processes, making your responsibilities more manageable and your decisions more impactful.
At Data Protection People, our expertise spans across diverse sectors, ensuring that businesses of all sizes and orientations receive tailored Data Protection and Cyber Security solutions. From the dynamic commercial sector and agile SMEs to the impactful third sector and expansive multi-nationals, we extend our services to fortify the digital defences of every business entity.
Elevate your data protection and cybersecurity standards in the bustling landscape of the Commercial Sector. We offer tailored solutions designed to safeguard your sensitive information, ensuring compliance and resilience against evolving threats. Partner with us to fortify your digital assets and foster a secure environment for sustained growth.
Small and Medium Enterprises (SMEs) form the backbone of innovation. Our data protection and cybersecurity services are crafted to match the agility of SMEs. Navigate the digital landscape securely, optimize your operations, and scale confidently with our tailored solutions that prioritize your unique business needs.
For organisations in the Third Sector driven by purpose, our data protection and cybersecurity expertise align with your mission. Safeguard sensitive data, build stakeholder trust, and amplify your positive impact. Let our solutions be the backbone of your technology infrastructure, ensuring that your focus remains on making a difference.
For the global footprint of Multi Nationals, our data protection and cybersecurity services provide a comprehensive shield. Navigate the complexities of international regulations with confidence. From compliance strategies to threat intelligence, we've got your data security needs covered, empowering your multinational endeavors with resilience.
In the Public Sector, trust and accountability are paramount. Our data protection and cybersecurity consultancy ensures that your operations align seamlessly with regulatory requirements. From confidential citizen data to streamlined governance, our solutions empower public entities to serve with integrity and technological excellence.
Data Protection People have the UK’s #1 Data Protection Podcast with over 150 episodes available across all audio streaming platforms, we also post regular content designed to simplify complex areas of data protection and cyber security, check out some of the podcasts and articles below and make data protection easy today.
A recent RTÉ Prime Time investigation exposed how the real-time movement of tens of thousands of smartphones was being sold on the open market. The story, though focused on Ireland, is a stark warning for UK organisations that process or share location data. If location data can be traced back to individuals, it is personal data under UK GDPR. Misusing it could lead to serious enforcement action and loss of public trust.
Undercover journalists posed as a data analytics company and purchased location data showing two weeks of movement for around 64,000 mobile phones. The dataset revealed daily routines, routes and even visits to sensitive sites like government buildings and prisons. Despite claims of “anonymisation”, investigators easily re-identified users by tracing data to home addresses and workplaces.
In response, Ireland’s Data Protection Commission launched an investigation into the data broker’s practices. The case mirrors ongoing global concerns about the misuse of mobile location data, issues that are equally relevant under UK GDPR and PECR.
UK GDPR explicitly treats location information as personal data. In its definition of personal data, the UK GDPR lists “location data” alongside names and online identifiers. In practice, this means a person’s physical movements, whether by GPS, Wi-Fi or cell towers, identify them and are protected. GDPR examples of “private and subjective” data include location data on the same list as religion or political views. In other words, even though raw GPS coordinates aren’t a “special category”, location trails can quickly become as revealing as declared sensitive information.
Long-term tracking of movement patterns can expose highly personal traits. For example, ICO guidance emphasises that a 24/7 log of someone’s whereabouts is “highly intrusive”, as it “is likely to reveal a lot of information about them, including the potential to infer sensitive information such as their religion, sexuality, or health status.”
FTC regulators in the US have made similar points. In a complaint against a location-broker, the FTC noted that “Location data can expose sensitive information such as medical conditions, sexual orientation, political activities, and religious beliefs.”
In practice, detailed location logs can be cross-referenced with public data to infer private traits. For example, regular attendance at a particular church or mosque can reveal faith, frequent visits to a clinic or mental-health centre can imply medical issues, and patterns of travel to political rallies or social venues can hint at ideologies or sexuality.
Simply stripping names off GPS data is not enough to make it safe. Mobility records are notoriously unique. The EU’s data protection board warns that supposedly “anonymised” location traces “are known to be notoriously difficult to anonymise.” They cite research showing that even a few points of a person’s movement make them re-identifiable.
In one landmark study, only four random spatio-temporal points (latitude/longitude plus time) were enough to uniquely identify 95% of individuals in a large mobility dataset. Even coarse data (such as cell-tower regions and hours rather than exact GPS minutes) proved only marginally safer, most people remained unique with just a handful of points. In short, an “anonymised” location database can often be re-linked to individuals by matching with outside information, such as known home or work addresses or social media check-ins.
Beyond official cases, everyday privacy concerns arise with location tracking:
By following these principles and keeping abreast of ICO and EDPB guidance, organisations can handle location data more responsibly. The Home Office case shows regulators will scrutinise any 24/7 monitoring. With “always-on” location services on our phones and devices, businesses and governments alike must respect that location trails reveal the contours of people’s private lives.
At Data Protection People, we help organisations conduct DPIAs, assess anonymisation standards, and audit third-party data flows. If your organisation collects or shares location data, now is the time to act before regulators come knocking.
The RTÉ revelations underscore a growing issue: location data is among the most valuable, but also the most dangerous, forms of personal data. For UK businesses, this means tightening internal controls, demanding transparency from suppliers, and taking accountability seriously. “Anonymous” data is not always anonymous, and claiming so will not protect you from enforcement.
The ICO has already signalled a tougher stance on data brokers, consent mechanisms, and dark patterns. Organisations that proactively embed privacy-by-design and transparency will not only avoid penalties, but also strengthen customer trust in an era of growing data awareness.
Yes. Location data can directly or indirectly identify an individual, which makes it personal data under Article 4 of the UK GDPR.
Only if it is genuinely anonymous and cannot be re-identified. If there is any realistic possibility of re-identification, it remains subject to UK GDPR.
You remain responsible for compliance. Review contracts, verify privacy practices, and complete DPIAs where tracking or profiling occurs.
Yes. Examples include Experian’s enforcement notice (2023) and Clearview AI’s £7.5 million fine (2022) for unlawful data scraping. Location data misuse could attract similar penalties.
If you’re unsure about your obligations, Data Protection People’s support services can help with audits, DPIAs and policy reviews.
If you process, share or purchase location data, take action now. Our team at DPP can help ensure your practices are compliant, ethical and defensible.
The Information Commissioner’s Office (ICO) has cracked down on two energy firms, fining them a combined £550,000 for making unlawful automated marketing calls (robo-calls).
The firms used voice-avatar software to make millions of calls that misled recipients into believing they were speaking with local UK agents. In reality, the calls originated overseas and were generated using pre-recorded scripts voiced by actors.
This case highlights the rising risks in automated marketing as businesses adopt AI-driven communication tools, especially when organisations push boundaries with limited oversight.
As automated and AI-driven tools become more accessible, companies may see robo-calls as an efficient outreach method. But the ICO’s enforcement shows regulators are watching closely.
Also, robo-calls are not a grey area. Under the Privacy and Electronic Communications Regulations (PECR), organisations must have clear, prior consent before making any automated marketing call. The ICO’s latest fines are a reminder that:
This action reflects a wider regulatory trend. In recent months, the ICO and Ofcom have publicly warned of increasing misuse of AI-driven telemarketing. In the US, the Federal Trade Commission (FTC) has also fined firms for voice cloning and avatar call scams. The message is clear on both sides of the Atlantic: consent and transparency are non-negotiable.
The ICO fined Home Improvement Marketing Ltd (HIM) in Pembrokeshire £300,000. HIM used overseas call centres to make roughly 2.4 million automated calls from May to August 2023, using avatar software that masked the origin.
The ICO also fined Green Spark Energy Ltd (GSE) £250,000 after it made 9.5 million calls. Complaints poured in, nearly 500 people contacted the ICO or the Telephone Preference Service (TPS), including elderly and vulnerable individuals.
Key findings included:
The ICO executed a search warrant in March 2024, seizing phones and documents that revealed instructions for evading detection and converting the calls into insulation product sales.
As Andy Curry, ICO Head of Investigations, commented:
“Advances in technology may make detection harder, but the rules remain the same. Companies using these systems must ensure they are lawful, transparent and fair.”
PECR: Automated marketing calls require prior, informed, and recorded consent. Organisations must identify themselves and provide an opt-out option.
UK GDPR: Organisations must handle personal data lawfully, transparently and fairly. When automation processes personal data for marketing, businesses must ensure people can understand how their data is used, including in decision-making.
ICO Direct Marketing Code of Practice: This statutory code sets out good practice and is essential reading for any organisation engaged in marketing.
Consumers should remain vigilant. The ICO offers practical tips to recognise robo-calls:
Reports can be made directly to the ICO or via the Telephone Preference Service (TPS), which remains a key enforcement tool.
If your organisation uses or plans to use automated calling or avatar-based outreach, follow these steps to stay compliant:
We recommend running a Direct Marketing Audit as part of your data protection governance. You can integrate this into a broader GDPR Audit. Technology should support compliance, not bypass it.
At Data Protection People, we see this case as a clear signal from the ICO: using advanced technologies like avatar software and automated script systems does not exempt organisations from compliance. If anything, it heightens risk.
Compliance is not a barrier to innovation, it is a framework for deploying new technologies responsibly. Organisations that invest in consent, transparency, and accountability will not only stay on the right side of the law but also build lasting trust with customers.
No. Some automated calls are lawful, for example, where individuals have given prior, informed consent. Without consent, they breach PECR.
Yes. Whether calls use avatar software or a live agent, you must have explicit consent to make automated marketing outreach.
Consent must be freely given, specific and informed. Keep detailed records showing the consent method, time and purpose.
Investigate immediately, suspend suspect activities, review consent records, and cooperate with the ICO. Use our Data Protection Support if necessary. Consider SAR Support if the call involved personal data.
If your business engages in automated marketing, we can help you:
Contact us today to make sure your automated marketing complies with the law.
References:
Jenny runs a small bakery in Manchester. When GDPR first came into force, she panicked and copied a cookie banner from a template website. Two years later, she discovered that her innocent-looking banner was breaking the law in several ways. Her family bakery website had unknowingly drifted out of cookie compliance and risked fines of up to £17 million. What began as a simple online presence had turned into a potential compliance nightmare.
Jenny’s story is far from unique. Many UK businesses, large and small, have faced confusion over cookie compliance. In January 2025, the Information Commissioner’s Office (ICO) assessed the top 200 UK websites and found that 134 of them failed to meet cookie compliance standards. These findings formed part of the ICO’s wider strategy to ensure users have meaningful control over how their personal information is tracked and used online. The regulator has since expanded its review to the top 1,000 websites, highlighting just how widespread the problem remains.
Against this backdrop, the introduction of the Data Use and Access Act (DUAA) 2025 marks a major turning point. This legislation reshapes cookie compliance and introduces new rules that will affect almost every UK business with an online presence.
Cookies are small files that websites place on a user’s device. Some are essential, like those that keep you logged in, remember your shopping basket, or provide security settings. Others, such as tracking cookies, follow your behaviour across the internet and build detailed profiles, often sold to data brokers. The distinction matters because under UK GDPR and PECR, organisations must treat different categories of cookies differently.
Common cookie compliance failures include:
These issues have already triggered significant enforcement. LinkedIn received a €310 million fine from the Irish Data Protection Commission for unlawful data processing and transparency failures. WhatsApp was fined €5.5 million for forcing users to consent through its terms of service. Both cases underline how regulators treat cookie compliance as central to data protection law.
The Data Use and Access Act 2025 rewrites cookie rules and expands exemptions for cookies that no longer require consent. Section 112 and Schedule 12 of DUAA insert a new Schedule A1 into PECR, creating broader categories of “strictly necessary” cookies. For businesses, this means some analytics and optimisation cookies may now operate without explicit consent — provided strict conditions are met.
Under DUAA 2025, consent is no longer needed for cookies used in the following scenarios:
1. Traditional Strictly Necessary Functions: security protection, fraud detection, technical fault prevention, user authentication, and maintaining website selections.
2. Analytics and Website Optimisation: statistical data collection, performance monitoring, and user behaviour analysis for service improvement.
3. User Experience Enhancement: adapting websites to user preferences, optimising functions across devices, and improving interface elements.
4. Emergency Assistance: geolocation data for emergency services and facilitating critical communications.
The DUAA exemptions do not create a free-for-all. Paragraph 5 of Schedule A1 sets out strict conditions. To qualify, analytics and optimisation cookies must serve only statistical or improvement purposes. They cannot be shared with third parties other than technical service providers. Organisations must also provide clear and comprehensive explanations of cookie use and give users a free, simple objection mechanism. In practice, this means exempt cookies may operate by default, but only until a user objects.
The DUAA 2025 introduces a new middle ground between essential cookies and invasive tracking cookies. Businesses gain flexibility but must adopt higher transparency standards. Compliance now requires action on several fronts:
Achieving cookie compliance costs far less than regulatory fines. ICO penalties under PECR and GDPR can range from £10,000 to £500,000, not including reputational damage. Compliance is not optional, it’s the smarter business decision.
For users, DUAA 2025 reduces banner fatigue while strengthening transparency. People should expect clearer explanations of cookie functions, simple objection rights, and better website performance from legitimate optimisation. But vigilance remains important. The line between analytics and tracking is thin, and some organisations may attempt to misuse exemptions. Users must continue exercising their rights to object.
Regulators will adapt their focus in the DUAA 2025 era. They will check whether exempt cookies genuinely serve their stated purposes, whether transparency is truly clear, whether objection mechanisms work, and whether data remains in-house. Cookie compliance enforcement will target organisations that attempt to stretch exemptions or obscure practices. In other words, businesses cannot use DUAA as cover for old habits.
DUAA 2025 represents a pragmatic shift in cookie regulation. It recognises that not all data collection undermines privacy. Some analytics genuinely improve websites for users. But businesses must meet stricter transparency obligations to stay compliant. For many, this will mean investing in clearer communication and more robust governance.
At Data Protection People, we believe cookie compliance in 2025 will separate organisations that embrace transparency from those that cling to outdated practices. Businesses that adopt open, user-focused cookie strategies often see stronger loyalty and better conversion rates than those that rely on manipulation.
For users, rights remain strong. People can still object to cookies they don’t want, and regulators will hold businesses accountable for misuse. The cookie chaos of the past is giving way to a more balanced, transparent model but only if organisations play by the rules.
If you’re unsure whether your website meets the new cookie compliance standards, contact us for a GDPR Audit. Our experts can help you review cookies, update policies, and implement objection mechanisms. We also offer Data Protection Support and Training to keep your team ahead of regulatory changes. Don’t wait for an ICO review, take action now and secure your compliance.
The Information Commissioner’s Office (ICO) has issued a formal enforcement notice to Bristol City Council after uncovering serious, ongoing failures in how the Council manages Subject Access Requests (SARs). This action follows years of complaints and evidence of systemic delays. The message from the ICO is clear: organisations that fail to take SAR compliance seriously will face enforcement.
The ICO’s investigation revealed that Bristol City Council has struggled with a growing backlog of SARs since 2020. A Subject Access Request gives individuals the right to ask for a copy of their personal data and to understand how that data is used. Failing to respond in time undermines public trust and breaches data protection law.
Between April 2023 and January 2025, the ICO received 63 complaints from individuals waiting too long for responses. Many reported that the delays caused them harm and distress, leaving them unable to resolve personal matters or defend their rights. The ICO found that the Council had made limited progress despite repeated engagement and guidance. As a result, enforcement became the only option.
SARs are not a formality. They are a cornerstone of data protection rights under the UK GDPR and Data Protection Act 2018. By making a SAR, an individual can see exactly what information an organisation holds about them, why it holds that data, and who it is shared with. For some, this is about transparency and reassurance. For others, especially vulnerable individuals, a SAR can directly affect access to housing, social services, or justice.
When organisations delay or ignore SARs, people lose trust and may face real-world consequences. The ICO has repeatedly emphasised that SAR compliance is fundamental. Sally-Anne Poole, Head of Investigations at the ICO, summarised the issue:
“Subject access requests are a fundamental right that allows people to know what information organisations hold about them and how it is being used. Despite our repeated engagement with Bristol City Council over a sustained period of time, limited progress has been made to clear a backlog of requests. Our investigation has found that the Council’s approach towards compliance demonstrates a poor organisational attitude towards data rights and compliance with the law.”
The enforcement notice issued to Bristol City Council sets out a strict list of actions. These include:
The ICO’s demands highlight that responding to SARs is not simply an administrative task. Councils and public bodies must show they can manage the process consistently, transparently, and within the one-month statutory deadline.
Bristol City Council’s enforcement notice should serve as a warning for all public authorities and organisations. The ICO expects SARs to be treated as a legal obligation, not an afterthought. Failing to respond on time risks enforcement, reputational damage, and potential fines.
Every organisation should ask itself some key questions:
Do we have a clear process for managing SARs from start to finish?
Do we have enough staff, technology and resources to respond within the legal timeframe?
Are we training employees so they understand SAR rights and know how to respond appropriately?
Can we evidence our compliance if the ICO asks?
If the answer to any of these questions is “no,” then urgent action is needed. The ICO has shown that it will not hesitate to escalate matters where organisations repeatedly fail to meet their obligations.
SAR backlogs are not unique to Bristol. Many councils, charities, and businesses struggle with the volume and complexity of requests. However, the law is clear: SARs must be answered within one month unless an extension is justified. Even then, organisations must explain the reasons for any delay to the individual making the request.
Technology can help reduce SAR risks. Case management systems, redaction tools, and specialist support can speed up responses and reduce errors. But technology alone is not enough. Organisations also need strong governance, clear policies, and a culture that treats data rights as a priority. Without these, the risk of enforcement grows.
At Data Protection People, we believe the Bristol City Council case highlights two critical points. First, SARs are central to data protection compliance and public trust. Second, enforcement action is not limited to fines; the ICO will impose detailed corrective measures when organisations fail repeatedly. Councils, businesses, and charities should take this case as a clear sign that SAR processes must be robust, well-staffed, and monitored closely.
We recommend that organisations run regular compliance checks, train staff to handle SARs effectively, and seek support where needed. By doing so, you protect both your organisation and the people whose data you process.
If your organisation is struggling with Subject Access Requests, we can help. Our SAR Support service provides expert assistance to manage requests on time and in line with the law. We also offer GDPR Audits to identify gaps, ongoing compliance support, and staff training to build confidence in handling SARs. Contact us today to protect your organisation and deliver on data rights.
Hosts, Catarina Santos with guests Oluwagbenga Onojobi (Gbenga) and Holly Miller. A brief cameo from Phil Brining.
In this 30 minute session we explain what cookies are, how the main types work, and what the 2025 UK reforms mean in practice. We look at PECR and UK GDPR, rising enforcement in Europe, consent or pay models, fingerprinting, Google Topics API, and the differences between the UK and EU approaches. The goal is simple, give you clear next steps that reduce risk without killing conversions.
Also available on all major platforms, Spotify, Apple Podcasts, Audible, and popular Android apps. Many DPOs tell us they listen back on walks, in the gym, or while cooking, so feel free to enjoy this one at your leisure.
You can always get in touch via our website or on LinkedIn. If you enjoy the podcast, share it with a colleague who looks after cookies, consent, or analytics.
Data Protection Made Easy is one of the UK’s largest data protection communities, over 1,500 subscribers, with more than 200 episodes available on major audio platforms.
Last week we marked not one, but two major milestones, 10 years of Data Protection People and the 5th birthday of the Data Protection Made Easy Podcast. To celebrate, we hosted a special live session with Philip Brining, Caine Glancy, Catarina Santos, and returning host Joe Kirk. Together, we looked back at the Top 10 Most Streamed Episodes from the past five years, revisiting the conversations that have shaped our community.
The team also reflected on why topics like ROPA and audits don’t always feature as highly among listeners, and why broad themes resonate more strongly than sector-specific discussions.
Our special guest Joe Kirk shared valuable insights from moving into an in-house DPO role, including the importance of tackling cookie compliance and ensuring correct ICO registration. The panel also discussed the ICO’s new guidance on complaints handling and recognised legitimate interests, highlighting the practical steps organisations should take ahead of expected implementation in June 2026.
To celebrate our 10-year anniversary and the continued growth of our community, we are excited to announce that the Data Protection Made Easy Podcast is returning to a weekly schedule. Every Friday at lunchtime, we’ll be live with fresh discussions, community insights, and practical guidance for data protection professionals.
You can sign up on our Events Page to join future live sessions, or contact us here to subscribe and become part of the UK’s biggest data protection community.
If you missed it live, you can catch up now on Spotify using the player below:
Here’s to 10 years of making data protection easier, and 5 years of building a community where professionals can learn, share, and grow together. Thank you to everyone who has been part of the journey so far.
Recorded on Friday 29 August 2025, this live episode of Data Protection Made Easy brings together Catarina Santos, Caine Glancy and Philip Brining to explain what the latest Online Safety Act changes mean in practice. The team walk through how age verification works, why VPN downloads have surged in the UK, and the real impact on privacy, user experience and compliance.
Episode: 218, Data Protection Made Easy
Recorded: late August, Leeds and online
Hosts: Philip Brining, Catarina Santos, Caine Glancy
We are Data Protection People, a consultancy and a community. More than 1,500 practitioners join our live sessions for practical help and straight talking advice. We keep things human, current, and useful.
Prefer Spotify in a new tab,
open the episode,
or browse the full show feed.
Scope and categories. Ofcom guidance gives the most usable overview. Scale drives duties, category one providers face the heaviest lift. Smaller services still need proportionate controls.
“The Act is about content, the Children’s Code is about design, together they set expectations for what people actually see and share.” — Philip
Age checks in practice. Facial estimation and ID checks can help, they are not perfect. People will try VPNs and workarounds, so policy and education must sit alongside technology.
“There is no magic potion for age checks, the solution cannot be technology alone.” — Catarina
“If suppliers rush controls without thinking about retention and purpose limitation, we move risk rather than reduce it.” — Caine
Supply chain failures. Contracts need clear migration and deletion steps, restore tests must be real, controller oversight must be active, not paper based.
“Where is the weak link, backups, migration steps, subprocessors, or the missing instructions in the DPA.” — Philip
Freedom of expression and harm. Public concern is real. The intent is to reduce harm to children, not silence debate. Practical application will need careful balancing.
Data Protection Made Easy is the live podcast and discussion space run by Data Protection People. More than 1,500 members join to share cases, templates, and practical steps. We will return to weekly sessions in September, short and focused, with time for questions.
We are always looking for contributors and topics, case studies, SAR puzzles, transfer questions, or views on the Online Safety Act. Get support or advice, or pitch a slot for an upcoming episode.
Explore more in our Resource Centre, including recent episodes and guides.
On Thursday, 18th July 2025, we hosted Part Two of our DUA Act discussion, with over 200 live attendees joining us for a deeper dive into the Data (Use and Access) Act 2025.
Led by Phil Brining and Caine Glancy, this session focused on answering the questions raised in Part One, exploring complex scenarios, and sharing practical advice for professionals preparing for the new regulations.
If you couldn’t attend live or want to revisit the insights, you can now listen back to the full recording and access the presentation slides shared during the event.
Click below to listen to Part Two on Spotify or search ‘Data Protection Made Easy’ on Apple Podcasts, Audible or any major platform.
Download the Slides
We’ve made the full slide deck from Part Two available to download and share:
Download Part Two Presentation Slides
By joining our free community, you’ll get:
We’re here to help you transition confidently into the new data protection landscape, making compliance clearer, simpler, and more achievable.
We host events on a weekly basis for the community of data protection practitioners and have built up a network of over 1200 subscribers, who tune in each week to listen to discussions about the hot topics from the fast-paced and evolving world of data protection and cyber security. Check out our upcoming events and become part of our growing community.
View AllOur mission is to make data protection and cyber security easy: easy to understand and easy to do. We do that through the mantra of benchmark, improve, maintain.
