GDPR Radio, S2 Ep2: Data Protection News

Grok, the Online Safety Act, and UK AI Regulation

GDPR Radio is our regular news roundup, where we break down the biggest stories from the world of data protection, privacy, and emerging tech. In this episode, Catarina Santos and Caine Glancy cover early year enforcement activity from the ICO, debate what “valid consent” really looks like in modern digital ecosystems, and explore the growing pressure on social media platforms to protect children online, including age assurance and content moderation.

Listen back on Spotify

Episode highlights

This session covers three big themes that many organisations are grappling with right now.

1) PECR enforcement is back on the agenda
We discuss recent ICO fines linked to unsolicited marketing activity and PECR compliance, including the practical lessons for opt-outs, consent language, and third-party data sources.

2) Third-party marketing lists and the “consent problem”
A key discussion point is what “informed” consent looks like when individuals are presented with long lists of third parties, and whether any approach is truly usable, granular, and easy to withdraw in practice.

3) Social media, under-16s, and age assurance
We explore the UK conversation about restricting under-16 access to social media, and the operational reality behind age verification, predictive age estimation, and the privacy and security risks that can come with them.

Key takeaways for organisations

• If your marketing activity relies on PECR, ensure opt-out routes are clear and effortless, and your lawful basis and consent language stand up to scrutiny.
• If you use third-party data, check what individuals were actually told, what they agreed to, and whether withdrawal can realistically be managed.
• If you operate services used by children or young people, start stress-testing your age assurance approach now, including supplier due diligence, security, and data minimisation.
• When new tech risks emerge, reactive fixes often fall short, governance and risk management need to be built in from day one.

Useful links

• Privacy notice
• Claim CPE credits
• Register for the podcast / join the community
• Listen on Spotify

Related from Data Protection People

• STAIRs event, 5 February, Leeds (limited tickets remaining)
• Upcoming session: DPIAs that actually protect people
• SARs content and events coming soon, plus an upcoming article on weaponising SARs and recent ICO guidance

About GDPR Radio

GDPR Radio is part of the Data Protection Made Easy podcast. Join live to ask questions, share views in the chat, and keep up with what’s happening across regulation, enforcement, and practice.

Speakers

Catarina Santos, Data Protection Consultant, Data Protection People
Caine Glancy, Data Protection Consultant, Data Protection People

How to Create a Culture of Privacy in Your Business

Most businesses deal with data, whether that’s collecting it for marketing, generating it through customer purchases or processing it for payroll. Without a robust data privacy culture, your business is at risk of accidental data breaches, attacks from hackers and non-compliance with GDPR regulations. 

In this article, we’ll discuss the steps you can take to create a culture of privacy that protects your business and the data that you use day-to-day.

Build Clear Policies & Processes

The first step to creating a culture of privacy is creating clear guidelines for handling, storing and sharing personal information within the organisation. Your policies should be aligned with GDPR principles to ensure compliance. 

Policies should be easily accessible to all employees so they always know where to find the most up-to-date information. Any roles that are particularly important for data privacy should have specific responsibilities so employees understand their day-to-day responsibilities. 

You should regularly review your policies to ensure that they’re up to date with changes in the law, technology or industry standards. Communicate any updates with your team as they happen. 

Lead by Example

Any change that you want to see in your business needs to be modelled from the top down. Your senior leadership needs to be displaying privacy-first behaviour if you want the rest of the business to do the same. 

A Data Protection Officer (DPO) or an internal privacy champion can help make this focus on data privacy more visible. A DPO oversees all aspects of data privacy compliance and can provide support for employees. They can be externally outsourced or an existing employee. 

Invest in GDPR Training

The most important thing you can do in creating a culture of privacy is to train and educate your staff. Data breaches often occur unintentionally because of human error, so employee awareness is crucial. 

From understanding the core GDPR concepts and data subject rights to designing with data protection in mind, there’s lots to navigate. Data Protection People’s GDPR training can be tailored to your organisation’s needs, ensuring that your team has the knowledge they need for handling customer data or having secure communications.

Strengthen Your Infrastructure & Technology

Your organisation’s infrastructure and the technology your staff use should support your privacy culture. Assess all of your tools for their security measures, data minimisation features and access controls. 

Embedding privacy into your infrastructure may be slightly harder as it involves evaluating processes and procedures, and setting up others for reporting risky practices. 

Reinforce, Monitor and Improve

Privacy culture isn’t built overnight. To keep it top-of-mind, regular training, updates on new threats and regulations and audits are key. 

Make it an ongoing conversation, rather than something to forget about. This is where those privacy champions or your DPO will come in useful. 

Create a Robust Privacy Culture with Data Protection People

Need help creating an organisation of privacy-first people? With GDPR training that’s tailored to your business’s practices, we can work with you to create a culture of privacy to be proud of. Get in touch today. 

5 Habits That Are Putting Your Business’s Data At Risk

Whether it’s clicking a link in a phishing email or sending sensitive data to the wrong person, it’s often a simple error that could leave your business dealing with financial losses and reputational damage due to a major data breach or cyber attack.

In this article, we’ll look at five small habits that can have a big impact on your data security, including:

• Using weak passwords
• Oversharing on email and IM tools
• Ignoring software updates
• Storing data anywhere
• Falling for phishing

Using Weak Passwords

A habit that we might all be guilty of. Using weak passwords or reusing the same passwords across multiple accounts allows attackers to exploit one breach across a number of different systems.

Brute-force and credential-stuffing attacks are successful largely because of weak passwords. 

The solution: Use unique passwords for each account, combined with multi-factor authentication (MFA) where possible. A password manager can help you keep track of different passwords and even obscure passwords from employees so they can have access to accounts without being able to view the password itself.

Oversharing on Email and IM Tools

Are your employees sending personal data, customer information, or confidential files through unsecured channels? Casual internal messaging platforms like Slack and Teams are great for quick communication, but they can lead to data leaks. 

Even email is risky – it’s not designed for secure data transmission, and it can be intercepted, especially when sent to external recipients. 

The solution: Always use secure file-sharing platforms that have end-to-end encryption enabled. Make sure your team is trained to avoid transmitting sensitive information via unprotected channels. 

Ignoring Software Updates

Software updates aren’t just nice-to-haves; they’re an important part of data security. Attackers target out-of-date systems as they’re likely to have well-known vulnerabilities that will let them in easily. 

Whether it’s a laptop, a browser, a mobile app or an important business system, delays in updating these systems leave your company open to attack. 

The solution: Enable automatic updates and centralised patch management for all devices, systems and apps. Training staff on the importance of updating software will also support this solution.  

Storing Data Anywhere

Do you know where your employees are saving their work files? From personal clouds, USB drives, and desktops to unauthorised, unvetted storage platforms, unsecured locations might be convenient for your employees, but they’re really bad for data protection. 

Scattered data increases the risk of data breaches, leaving your business data exposed to bad actors. 

The solution: Use approved platforms, write a clear policy on how and where to store your data, and ensure your staff know and understand it.  

Falling for Phishing

With the advent of AI, phishing scams have become very sophisticated and increasingly more common. Whether it’s a message from the boss asking you to pick up a gift card for a client or Microsoft asking you to click the link to update your Teams, they often look very legitimate. 

Any one of your employees falling for a phishing attack could result in a serious breach of sensitive data.

The solution: Preventative training is one of the most effective ways to prevent phishing attack success, along with email filtering and verification procedures. 

Stay Secure And Compliant With Data Protection People

Whether you’re looking to improve your data protection policies or ensure that you’re compliant with GDPR law, we can help. Our experts are seasoned professionals with a deep understanding of the current regulations and best practices to help keep your data secure. Get in touch with us today. 

Synthetic Data Explained: The Future of Data Protection

Synthetic data is a solution to the tension between the need for real data to train AI, test systems and run analytics, and the need to stay compliant and protect individuals’ data. If you’re worried about using sensitive personal information and GDPR, this could be the answer you’re looking for. 

In this article, we’ll talk about what synthetic data actually is, how it’s becoming an important data protection tool, what the benefits and limitations are and more.  

What Is Synthetic Data?

Synthetic data is artificially generated data that’s designed to mimic real-world data. It has the same statistical patterns, structures and properties of real data, so it can supplement or even replace real datasets. 

In contrast to anonymised or pseudonymised data, synthetic data is made from original data but does not map directly to real individuals. 

Synthetic data is primarily used in sectors where data is in limited supply, difficult to access or time-consuming to obtain, like in finance and healthcare. It is currently most notably used to train AI and machine learning models. 

Types of Synthetic Data

• Fully synthetic data is entirely artificial and doesn’t include any authentic information. It estimates relationships, patterns and attributes to emulate the real data as closely as possible. 
• Partially synthetic data replaces some of the original data, particularly sensitive information, with artificial values, but the rest remains real. This technique helps protect personal data while preserving the complexities of authentic data. 
• Hybrid synthetic data combines real data with fully synthetic information, which allows organisations to scale data sets. 

How is Synthetic Data Generated?

Synthetic data is generated by AI that is trained on real-world datasets. These AI models take the structure, patterns and statistical properties of that real data and create similar data points, but without the personal information that real data would include.

Why Is Synthetic Data Important for Data Protection?

There are a number of applications for synthetic data, but one of the most exciting is to help minimise the exposure of real personal information and help businesses stay compliant with GDPR. 

Elimination of Identifiers

In synthetic data, no actual personal data is present; instead, there are artificial data points that simply mimic the original personal data. It means that there is no link with real individuals, making it inherently private.   

Enables Safe Data Sharing

In some sectors, like finance and healthcare, using real, sensitive data is often restricted due to privacy concerns. Synthetic data provides an alternative. It allows different departments and external partners to collaborate on data without exposure to sensitive information. 

Supports Compliance

When generated properly, fully synthetic data that consists of entirely artificial data points falls outside of the GDPR scope as non-personal data. Using it can therefore help businesses stay compliant. 

However, if you’re the one creating the synthetic data, then the original personal data will still fall under GDPR, as well as any data where there is a residual risk of re-identification. 

Benefits of Synthetic Data for Businesses

Synthetic data has a number of benefits, including:

• Reduced breach risk. If synthetic data is leaked, it will only cause minimal harm compared to the potential of real datasets. 
• Facilitates data minimisation. Synthetic data reduces the need to collect and store real user data, which aligns with the data minimisation principle of GDPR. 
• Reduced operational timeframes. Developers, analysts and researchers no longer have to wait for approval to access sensitive data – because the data is no longer sensitive!
• Lower compliance costs. Synthetic data reduces the need for manual anonymisation and redaction, avoids costs associated with breaches and streamlines data sharing. 

Limitations and Risks of Synthetic Data

While synthetic data has lots of benefits for data sharing, it does come with limitations. These include:

Lack of Realism

Synthetic data is an approximation of real-world data and may lack some of the nuances and complexities of authentic information. 

Bias Amplification

If the source data contains bias, synthetic data will replicate or exaggerate it, which may lead to discrimination or unfair outcomes in downstream applications. 

Risk of Re-Identification 

Synthetic data is not automatically anonymous. High-fidelity data that closely mirrors the original data, or data derived from unique data sets, can still contain patterns that could enable the re-identification of individuals. 

Attackers can exploit this weakness through:

• Linkage attacks. This is where an attacker links two or more records belonging to a data subject in a dataset or across multiple datasets by exploiting extraordinary characteristics, such as a rare disease. 
• Attribute inference attacks. This is where attackers query a trained model and observe its outputs to deduce sensitive or private information.
• Regulatory uncertainty. As synthetic data is relatively new, the legislation around it is still evolving. While fully synthetic, truly anonymous data falls outside of GDPR, the risk of re-identification means that some datasets will still fall under the regulations.

Best Practices for Using Synthetic Data

Determine The Data Quality 

Many factors affect the quality of synthetic data, so it’s very important to ensure the quality and accuracy of the data you’re working with. 

Compare the synthetic data to real-data baselines to see how well it mimics authentic data. There are metrics like Inception Score and FID score that can help you do this. 

Assess Re-identification Risk

Rigorous assessments should be conducted to determine the likelihood of re-identification. This will then guide the governance you need to apply to the data.

Implement Privacy-Enhancing Techniques

There are additional techniques you can use to add another layer of privacy to the data, such as replacing direct identifiers or using Privacy-Enhancing Technology. 

Need Data Protection Support?

Synthetic data is at the forefront of data protection practices. If you’d like to review your protection processes and make sure that you’re fully compliant with GDPR regulations, then get in touch with our team today. We offer data protection audits designed to test your compliance with the law, covering everything from data mapping to DPIA services. 

Lessons For Data Retention

Santa’s Naughty List, Lessons For Data Retention

Data Protection Made Easy Podcast, Episode 228 – Hosted by Caine Glancy and Special Guest Katerina Douni

This week’s episode takes a festive look at one of the most common challenges in data protection, knowing what to keep, what to delete, and what to safely archive. Inspired by Santa’s famous naughty list, Caine Glancy and first time guest host Katarina Douni lead a lively discussion on data retention, storage limitation, and the practical steps organisations can take to stay compliant without holding information for longer than needed.

Katarina joined the podcast for her debut session and quickly set the tone with a clear message, many organisations continue to struggle with retention. She explored why data decisions matter, how retention periods should be approached, and why email is often the biggest culprit for uncontrolled storage. The session sparked strong engagement from our live audience and the chat was filled with questions, examples, and shared challenges around retention, erasure, and day to day pressures inside busy teams.

Caine and Katarina walked listeners through common problems such as the over use of email as a filing system, storing information long after its purpose has expired, and the difficulty teams face when deciding how long is long enough. They also discussed the risks of under collecting or over collecting information, the impact this has on storage limitation, and how organisations can simplify their retention rules to reduce confusion and avoid unnecessary risk.

As always, the live chat added a valuable layer to the discussion. Attendees shared their own retention periods, debated tricky scenarios, and raised questions that pushed the session further. The interactive nature of the podcast remains one of its key strengths and gives practitioners the chance to test ideas, compare approaches, and learn from each other in real time.

This episode is ideal for anyone who handles personal data, manages email systems, or oversees compliance. It provides clear explanations, relatable examples, and practical steps that can be applied immediately. With year end approaching, the timing could not be better for organisations reviewing their retention schedules or tackling email backlogs.

If you listened back on Spotify and want to join a future episode live, you can request an invite by emailing info@dataprotectionpeople.com. Live attendees can take part in the chat, ask questions, and access the deeper insight that comes from community discussion.

We host Data Protection Made Easy every Friday at 12:30 and new listeners are always welcome. Our community continues to grow each week with hundreds joining live and many more tuning in through audio platforms.

If you work in the housing sector, you may also be interested in our upcoming in person STAIRs event taking place on the 5th of February. Details can be found on our website and on LinkedIn.

Listen below and enjoy this festive and practical dive into data retention.

GDPR Radio – Digital Omnibus, Personal Data and SAR Reform

Digital Omnibus, Personal Data Changes and What They Mean for You

Episode 227 of the Data Protection Made Easy Podcast hosted by experts at Data Protection People. This episode was hosted live via Microsoft Teams in front of a live audience of listeners.

What We Covered in This Session

A Catch Up from Caine and Catarina

The episode opens with a look at what the team have been working on. Catarina reflects on a very busy week supporting a major client project alongside her team. Caine shares updates on ongoing STAIRs sessions for social housing providers and hints at an in person STAIRs event coming soon.

Both hosts also discuss their guest appearance on another organisation’s podcast where they explored how users understand privacy information, how organisations communicate their obligations and why cross functional training is so important.

The Digital Omnibus Package Explained

The main focus of the episode is the European Commission’s Digital Omnibus package, announced on 19 November. The discussion highlights several of the most significant proposals, including:

1. A New Approach to Personal Data

The proposal introduces a major shift. Information would be classed as personal data only if the controller has means reasonably likely to identify the individual.
The team explore:

• how this could narrow the scope of personal data
• what this means for indirect identifiers and pseudonymised data
• how case law from Europe is already pushing towards this direction
• how this might affect UK organisations if mirrored in future reforms

2. Changes to Data Breach Reporting

Catarina outlines proposals that:

• raise the threshold so only high risk breaches need regulator notification
• extend the deadline from 72 to 96 hours

Caine questions whether reducing low risk reporting could hide patterns of poor practice and the group debate what this means for real world compliance.

3. Reforms to Cookie Rules

The Digital Omnibus seeks to simplify cookie requirements by reducing reliance on consent for low risk purposes such as security and aggregated analytics. The team draw comparisons with the UK DUA Act and consider how consent fatigue has shaped this direction.

Insights from Guest Contributor David Appleyard

David shares two important observations:

1. SAR Purpose Tests

Under the new proposals, organisations may reject or charge for a SAR if the purpose is not to access personal data, for example in an employment dispute. This could be a significant change for many organisations that currently process large volumes of tactical or grievance based SARs.

2. High Risk AI Processing

David explains that the EU is pushing back deadlines for identifying high risk AI processing due to a lack of clear guidance, with expectations now set for no later than December 2027.

CNIL Research on Selling Personal Data

Caine introduces a study from the CNIL which found that 65 percent of surveyed French citizens would sell their personal data for between 1 and 100 euros. The hosts explore:

• why people undervalue their own data
• how advertising, profiling and AI training increase the true value
• the growing need for public awareness and transparent communication

Looking Ahead

The session closes with a reminder that the next podcast will explore data retention, followed by an update that the team are working on the new in house DPP studio.

About the Data Protection Made Easy Community

Our podcast community is one of the most active privacy networks in the UK with more than 150 regular live attendees and over 1,600 subscribers across all audio platforms. Joining the community gives you access to:

• free weekly live sessions with the chance to ask questions
• practical guidance from experienced consultants
• early access to slides and resources
• networking with other privacy and security professionals
• invites to in person events, workshops and sector focused discussions
• exclusive content only available to our community members

Attending live offers clear benefits. You can join the conversation, shape the discussion, raise real world challenges and take part in polls, chat and Q and A. Many listeners tell us they get far more value from attending live than listening back later.

We also have a strong line up of sessions taking us through to the end of the year, covering topics such as data retention, AI risk, international transfers, STAIRs, marketing compliance and more.

If you are not yet part of the Data Protection Made Easy community, you can join for free and get involved straight away.

Subject Access Requests in Practice, Community Q and A

Subject Access Requests in Practice, Community Q and A

After our first SARs session, we picked up the phone and asked our listeners what they struggle with most in real life. They shared questions, tricky scenarios and points of disagreement. In this follow up episode of the Data Protection Made Easy podcast, Caine Glancy and Oluwagbenga Onojobi work through those issues live with members of our community.

What we discussed

In this session we explore:

• Where to draw the line on property information as personal data in social housing
• How far to go when providing repair history and tenancy records
• SARs linked to disrepair claims, when to push back and when to provide more to be helpful
• Redacting staff names in emails and HR files, and what counts as excessive redaction
• How different organisations approach employment SARs and grievances
• Using the third party exemption to protect staff and witnesses
• Applying a reasonable and proportionate search so you focus your effort where it matters most
• The importance of documenting decisions and communicating clearly with data subjects

Listeners share how they handle these issues in housing and HR, which gives a rounded view of what is happening on the ground, not just what the legislation says.

Who this session is for

• Data Protection Officers and privacy leads
• SAR handlers and information governance teams
• Housing providers dealing with disrepair and complaint driven SARs
• HR professionals managing employment SARs and grievances

If you are trying to balance transparency with protecting third party rights, you will find this discussion especially useful.

Listen back and join the community

You can listen back to this episode now on Spotify and all major podcast platforms.

If you are not yet part of the Data Protection Made Easy community, complete our contact form and ask to join. Membership is free. You will receive a weekly invite to our live Friday sessions, access to visual materials, and ongoing support from over 1,500 like minded data protection practitioners.

Coming up next, GDPR Radio

This week our live Friday session is a GDPR Radio episode. Caine, Catarina and the team will be back to look at the latest news, enforcement action and real world challenges from across our community. If you would like to receive an invite, fill in our contact form and the team will add you to the mailing list.

Cookies in 2025 – Trick or Treat, Part Two