Data Protection & Information Security Experts

Unlock Data Protection Expertise with the DPM Cert Training Course

DPM Cert Training Course

Understanding and navigating the complex landscape of data protection is crucial for businesses of all sizes. With new regulations constantly shaping the way organisations handle personal data, it’s no longer just a compliance requirement but a core component of building trust and safeguarding your reputation. At Data Protection People, we believe in making data protection simple and accessible, which is why we’re excited to offer our Certificate in Data Protection Management (DPM Cert) training course. Whether you’re a Data Protection Officer (DPO), a Privacy Advisor, or simply someone looking to enhance your understanding of data protection, our course is designed to provide you with the skills you need to succeed.

Why is Data Protection Training So Important?

Data protection laws are constantly evolving, and organisations face growing pressure to comply with regulations like the UK GDPR and the Data Protection Act 2018. The risks of non-compliance are significant, with penalties, reputational damage, and loss of consumer trust at stake. However, understanding the nuances of these laws can be challenging.

That’s where our DPM Cert comes in. Our training course offers a comprehensive foundation in data protection, focusing on essential principles of privacy, information rights, and lawful data processing. With a blend of practical skills and theoretical knowledge, this course will ensure you’re prepared to support data protection in any organisation.

Who Should Take the DPM Cert?

This course is ideal for:

• Data Protection Officers (DPOs)
• Data Protection Managers (DPMs)
• Privacy Advisors and Practitioners
• Compliance Professionals
• HR Personnel and IT Staff overseeing data protection
• Managers seeking to strengthen their understanding of data protection laws

Whether you’re new to the field or looking to build on your existing knowledge, our course is designed to provide you with the practical skills and legal understanding required to navigate today’s data protection landscape.

What You’ll Learn

The Certificate in Data Protection Management provides a robust curriculum that spans 12 weeks, combining theoretical knowledge with real-world application. Key topics covered include:

1. Week 1: Understanding Data Protection Law
   • Introduction to UK GDPR, the Data Protection Act 2018, and PECR.
2. Week 2: Validating Your Use of Personal Data
   • Understanding lawful basis for processing data and creating Records of Processing Activities (ROPAs) and Information Asset Registers (IARs).
3. Week 3: Accountability for Personal Data
   • The role of Data Controllers, the Board, Data Protection Officers, and the Information Commissioner’s Office (ICO) in ensuring compliance.
4. Week 4: Risk and Personal Data
   • Conducting Data Protection Impact Assessments (DPIAs) and embedding Data Protection by Design and Default into your organisation.
5. Week 5: Individual Rights and Expectations
   • Subject Access Requests (SARs), privacy information, direct marketing, and cookies regulations under the Privacy and Electronic Communications Regulation (PECR).
6. Week 6: Working with Others
   • Managing relationships with third-party processors and navigating data sharing, disclosures, and international transfers.
7. Week 7: Security and Breaches
   • Ensuring security under the GDPR and handling personal data breaches effectively.
8. Week 9: Learner-Led Session, Recap, and Q&A
   • A session for learners to consolidate their knowledge with interactive discussions and Q&A.
9. Week 12: Open-Book Assessment
   • A comprehensive open-book assessment featuring multiple-choice questions, scenario-based exercises, and practical application.

Why Train with Us?

At Data Protection People, we take a hands-on approach to data protection. Our course isn’t just about understanding the theory; it’s about applying that knowledge in real-world scenarios. Here’s what sets our course apart:

• Practical Learning: Real-world case studies and interactive discussions help you apply what you’ve learned.
• Expert Tutors: Our experienced instructors guide you through key concepts, ensuring you understand how to implement best practices in your organisation.
• Flexible Format: The course is designed with flexibility in mind, featuring one full-day workshop each week over nine weeks. Plus, you’ll have access to recorded sessions and additional reading materials to enhance your learning.
• Ongoing Support: Join a dedicated Microsoft Teams chat where you can ask questions and connect with both tutors and fellow participants. You’ll never be alone in your learning journey.

Built for Flexibility

We understand that time is valuable. That’s why our course is structured for maximum flexibility, with workshops held once a week from 09:30 to 15:30 over nine weeks. You’ll also benefit from a one-week revision period leading up to your open-book assessment. The sessions are delivered via Microsoft Teams, and all materials are recorded, so you can learn at your own pace and revisit content as needed.

Additionally, you’ll receive a digital copy of our comprehensive Information Governance Framework, ensuring you have access to the tools you need long after the course is complete.

Enrol Today and Simplify Data Protection in Your Organisation

Data protection doesn’t have to be complex. With the right knowledge, tools, and strategies, you can manage data protection confidently and effectively. Our Certificate in Data Protection Management equips you with the expertise to interpret and apply data protection laws, making compliance and security easier to navigate.

Take the first step towards mastering data protection and empowering your organisation. Sign up for the DPM Cert today!

With our expert guidance and flexible learning environment, you’ll finish the course ready to tackle the most pressing data protection challenges, all while ensuring your organisation remains compliant and secure.

Download our DPM Cert training brochure here!

How to Become a Data Protection Officer: Skills & Qualifications You Need

How to Become a Data Protection Officer

The demand for Data Protection Officers (DPOs) has surged. Under the UK Data Protection Law certain organisations are required to make a statutory appointment of a DPO, while others choose to do so to enhance their compliance efforts. But what does it take to become a Data Protection Officer? This guide outlines the essential skills, qualifications, and responsibilities required on how to become a data protection officer.

What is a Data Protection Officer (DPO)?

A Data Protection Officer is a designated individual responsible for overseeing an organisation’s data protection strategy and ensuring compliance with UK GDPR, the Data Protection Act 2018, and other relevant privacy laws. The DPO acts as a bridge between regulators, organisations, and data subjects.

Key Responsibilities of a DPO

• Advising organisations on data protection obligations – Ensuring that the company follows GDPR requirements and other relevant regulations.
• Monitoring compliance with GDPR and internal policies – Regularly assessing and reviewing internal data protection measures.
• Conducting data protection impact assessments (DPIAs) – Identifying risks associated with data processing and implementing mitigating measures.
• Acting as a point of contact between the company and the Information Commissioner’s Office (ICO) – Handling official inquiries and ensuring smooth communication.
• Educating employees about data protection practices – Running workshops, training sessions, and issuing guidelines on compliance.
• Managing data breaches and advising on incident response – Ensuring that breaches are reported within the required timeframe and remedial actions are taken.

Who Needs a DPO?

Under Article 37 of UK GDPR, appointing a DPO is mandatory for organisations that:

• Are public authorities or bodies (excluding courts acting in a judicial capacity).
• Conduct regular and systematic monitoring of individuals on a large scale, such as tracking user behaviour online.
• Process special category personal data on a large scale (e.g., health records, biometric data, criminal conviction data).

Even if your organisation isn’t legally required to appoint a DPO, having one can demonstrate a strong commitment to data protection and help mitigate compliance risks.

Essential Skills Required to Become a DPO

1. In-Depth Knowledge of Data Protection Laws

DPOs must have a thorough understanding of data protection laws, including UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR). They must also stay updated on evolving regulations and industry best practices.

2. Legal and Regulatory Expertise

Since a DPO provides guidance on compliance, they must be able to interpret complex legal documents, draft policies, and advise senior management on regulatory obligations.

3. Risk Assessment & Management

A DPO should be skilled in identifying, assessing, and mitigating risks related to data processing. This includes conducting Data Protection Impact Assessments (DPIAs) and ensuring that organisational processes align with legal requirements.

4. Strong Communication & Training Skills

A DPO must be capable of explaining complex regulations in a simple, understandable manner. They should be able to provide training for employees, communicate policies clearly, and liaise effectively with regulators and external stakeholders.

5. Problem-Solving & Analytical Thinking

DPOs must be adept at identifying privacy issues, finding practical solutions, and balancing business needs with regulatory requirements.

6. Technical Understanding of Data Security

While not necessarily an IT expert, a DPO should understand cybersecurity concepts such as encryption, access control, and breach response protocols.

7. Ethical Decision-Making

Handling sensitive personal data comes with ethical responsibilities. A DPO must ensure that data protection measures align with legal obligations and uphold individuals’ rights.

Qualifications & Certifications for DPOs

While there is no single qualification required to become a DPO, certain certifications and degrees can significantly enhance your credibility.

Recommended Educational Background

• Law Degree – Specialising in data protection or privacy law.
• Information Security Degree – Providing insights into technical security measures.
• Business Management Degree – Useful for implementing data protection policies within corporate structures.
• Postgraduate Diploma or Master’s in Data Protection & Privacy Law – Offers a focused curriculum on regulatory compliance.

Industry-Recognised Certifications

• Certified Information Privacy Professional (CIPP/E) – Specialises in European data protection laws and GDPR.
• Certified Information Privacy Manager (CIPM) – Focuses on operational compliance strategies.
• Certified Information Systems Security Professional (CISSP) – Covers IT security, which is essential for data protection roles.
• BCS Practitioner Certificate in Data Protection – Provides GDPR expertise with a UK-specific focus.
• ISO 27701 Lead Implementer or Auditor – Demonstrates knowledge in privacy management systems.

How to Gain Experience as a DPO

1. Work in a Related Role

Experience in compliance, legal advisory, IT security, risk management, or information governance provides a strong foundation for transitioning into a DPO role.

2. Take on Data Protection Responsibilities

If you’re already employed, volunteering to oversee GDPR compliance, internal audits, or privacy impact assessments can help build relevant experience.

3. Stay Updated on Privacy Laws & Trends

Joining professional associations such as the International Association of Privacy Professionals (IAPP) and attending industry conferences can help you stay ahead in the field.

4. Obtain Certifications & Training

Completing professional courses and obtaining industry certifications strengthens your qualifications and improves career prospects.

Career Opportunities & Salary Expectations

Industries Hiring DPOs

• Financial services
• Healthcare & pharmaceuticals
• Public sector & government agencies
• Technology & IT security firms
• Retail & e-commerce
• Legal & consultancy firms

Conclusion

Becoming a Data Protection Officer requires a combination of legal knowledge, compliance expertise, risk management skills, and strong communication abilities. While formal qualifications help, experience in data protection and continuous professional development are key to excelling in this role.

If you’re looking to enhance your data protection knowledge or need expert guidance in your DPO role, Data Protection People can help. Contact us today to explore our training and consultancy services.

How to Find a Reliable Business Partner to Handle Personal Data

How to Find a Reliable Business Partner to Handle Your Personal Data – A Comprehensive Guide for UK Businesses

Businesses handle vast amounts of sensitive data. Whether it’s customer information, employee records, or financial details, ensuring your personal data is in safe hands is crucial. Choosing a reliable business partner to process, store, or manage your data requires careful consideration.

Building trust with a business partner handling your data goes beyond checking certifications and legal compliance; it’s about establishing clear communication, shared values, and long-term reliability. This guide explores the key steps in selecting a trustworthy data-handling partner, ensuring compliance with UK laws, safeguarding your business against personal data breaches and regulatory penalties, and fostering a secure, trustworthy partnership.

Establishing a Foundation of Trust and Transparency 

Trust is the foundation of any successful business relationship, particularly when it comes to handling sensitive data. Before signing any agreements, engage in open and honest conversations about data security, compliance, and business values. It is important to consider the following:

• Does this partner align with our organisation’s ethical standards and compliance culture?
• Are they transparent about their data handling processes and willing to share relevant documentation?
• Do they have a history of honouring commitments and maintaining long-term partnerships?

A business partner should not only comply with regulations but also demonstrate an understanding of your specific industry’s data protection challenges.

Understanding UK Data Protection Laws and Compliance Requirements

It’s essential to understand UK Data Protection laws. The UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR) govern how businesses should handle personal data.

On top of this, there are numerous frameworks that organisations can adhere to in order to further strengthen their governance of personal data. Examples include but are not limited to:

• Lawfulness, fairness, and transparency – Data processing must be clear, justified, and based on a valid legal basis.
• Purpose limitation – Data should only be collected for specific, explicit, and legitimate purposes.
• Data minimisation – Only necessary data should be processed to fulfil the stated purpose.
• Accuracy – Data must be kept accurate and up to date.
• Storage limitation – Personal data should not be kept longer than necessary.
• Integrity and confidentiality – Appropriate security measures must be in place to protect against unauthorised access, loss, or damage.

A reliable data-handling partner must demonstrate full compliance with these principles and be able to provide documentation and evidence of their data protection policies.

Additionally, UK businesses that work with partners outside the UK or EEA must ensure adequate data protection mechanisms, such as Standard Contractual Clauses (SCCs) or UK International Data Transfer Agreements (IDTAs).

Evaluating a Potential Partner’s Data Security Measures

A good business partner should have robust security measures in place to protect your data. Key areas to assess include:

• Encryption: Are they encrypting data at rest and in transit using strong algorithms?
• Access controls: Do they implement role-based access control (RBAC), multi-factor authentication (MFA), and least privilege access policies?
• Incident response: Do they have a well-documented incident response plan (IRP), including detection, containment, eradication, recovery, and post-incident review?
• Data storage: Where is the data stored? UK businesses should prioritise partners who keep data within the UK or EEA to comply with adequacy agreements and ensure legal protections.
• Penetration testing and vulnerability assessments: How often does the company conduct penetration tests and security audits to identify and address vulnerabilities?

You should request security certifications and independent audit reports, such as SOC 2 Type II reports, to validate their security posture.

Checking Industry Certifications and Compliance Standards

Reputable data-handling partners will have certifications that prove their commitment to data security and compliance. Look for partners who hold:

• ISO 27001 – International standard for information security management.
• Cyber Essentials or Cyber Essentials Plus – UK government-backed certification for cybersecurity.
• PCI DSS (if handling payment data) – Ensures secure credit card transactions.
• SOC 2 Type II – Demonstrates rigorous security and data protection practices.
• NHS DSP Toolkit (if working with the NHS) – Ensures compliance with health data protection requirements.

These certifications provide assurance that the partner follows industry best practices and has undergone independent security assessments.

Reviewing Contracts and Data Processing Agreements (DPAs)

When partnering with another business to process data on your behalf, a Data Processing Agreement (DPA) is required under UK GDPR. This contract should outline:

• The scope of data processing – What data is collected, for what purpose, and under what lawful basis.
• Processing Instructions – Written instructions from the controller that informs the processor of how to process personal data.
• Security measures – The technical and organisational security measures used to protect data.
• Confidentiality Clause – The processor should be subject to confidentiality.
• Rights Requests – The processor shall assist the controller in handling rights requests.
• Personal Data Breaches – The processor should inform the controller immediately of a personal data breach and assist in meeting the requirements around breach notification.
• Data Deletion/ Return – How long data will be retained and the process for deletion/ return of personal data
• Audit rights – The ability to review compliance and security measures through audits.

Please note, this list is not exhaustive.

A DPA ensures both parties understand their obligations, minimises legal risks, and protects against liability in the event of a personal data breach.

Assessing Reputation, Reliability, and Track Record

Before entering into a partnership, research the company’s ability to implement appropriate technical and organisational measures through various means:

• Desktop Review: Try and gauge the security measures the organisation has implemented in order to determine if it is appropriate for you.
• Due Diligence Questionnaire: Request that they complete a thorough questionnaire to determine the level of security they have implemented.
• Customer reviews and case studies: Have they worked with businesses in your industry?
• Regulatory history: Have they faced any data protection fines or breaches?
• References: Request testimonials or speak with existing clients.
• Online security forums and news sources: Are there reports of security issues associated with the company?

A reliable data-handling partner should have a strong track record of compliance, transparent data protection policies, and a proactive approach to security.

Ensuring Ongoing Compliance, Monitoring, and Incident Response

Finding a reliable partner isn’t just a one-time process. Continuous oversight is required to maintain security and compliance. Businesses should:

• Conduct annual security audits of their data-handling partners.
• Review incident reports and breach notifications to ensure proper risk mitigation.
• Regularly update DPAs and security policies to reflect evolving processing.
• Ensure partners undergo cybersecurity training and compliance updates.
• Monitor regulatory changes and assess how they impact data processing agreements.

Establishing regular security and compliance check-ins with your partner helps prevent issues and ensures data remains protected.

Conclusion

Choosing a reliable business partner to handle your personal data is a critical decision that requires thorough vetting. By focusing on trust, transparency, UK data protection laws, security measures, compliance certifications, and contractual agreements, you can build a strong, secure partnership.

At Data Protection People, we specialise in simplifying complex data protection issues. If you need guidance on selecting a data-handling partner or ensuring compliance with UK GDPR, get in touch with our expert consultants today.

Is Your Child’s Data Safe?

Is Your Child’s Data Safe?

Understanding Privacy Risks on Social Media & Gaming Platforms 

Children today are immersed in the digital world, spending hours on social media and gaming platforms. While these spaces offer entertainment and connection, they also expose children to significant risks. Personal data is often collected, stored, and shared—sometimes without adequate safeguards. As data protection practitioners, businesses, and parents, we must ensure children’s data is protected and handled responsibly. 

What is really happening?  

Many platforms rely on data collection for their business models, and children’s information is no exception. Social media apps track browsing habits, locations, and even biometric data. Gaming platforms encourage in-game purchases and often require extensive personal details for account creation. Targeted advertising can expose children to age-inappropriate content, while weak privacy settings make them vulnerable to online exploitation. 

One major concern is how easily children’s data can be accessed or misused. Even when platforms claim to offer security, breaches and leaks happen. Data is often shared with third-party advertisers, meaning a child’s online behaviour could be tracked across multiple websites. This raises questions about consent and whether children (or their parents) truly understand what they’re agreeing to when they sign up. 

Examples of real-world incidents highlight vulnerabilities children face online:  

In April 2023, TikTok was fined £12.7 million by the UK’s Information Commissioner’s Office (ICO) for misusing children’s data, including failing to obtain parental consent for users under 13 and not implementing adequate age verification measures.1 

Also, as of March 2025, the ICO launched investigations into TikTok, Reddit, and Imgur to assess their compliance with children’s data protection regulations. These investigations aim to ensure that these platforms have robust safety measures to prevent exposing young users to inappropriate or harmful content.2 

The gaming industry has also faced criticism for inadequate data protection practices. Regulators have fined video game companies for unlawful practices involving young people’s personal data, emphasising the need for stricter compliance with privacy and data protection laws.3 

Finally, the UK government is considering a social media ban for children under 16. Chief Medical Officer Chris Whitty has been tasked to assess the potential risks and harms associated with children using social media, which could lead to increasing the digital “age of consent” from 13 to 16.4 

These examples underscore the pressing need for enhanced data protection measures tailored to children’s online activities. 

UK GDPR & Children’s Data Protection 

The UK General Data Protection Regulation (UK GDPR) explicitly recognises that children require greater protection when it comes to their personal data. This is because they may be less aware of the risks, consequences, and safeguards available to them. Recital 38 of the UK GDPR emphasises that children’s personal data merits specific protection, particularly in the context of online services such as social networking, gaming platforms, and digital marketing. 

To address these concerns, UK GDPR imposes stricter obligations on organisations processing children’s data. Article 8 sets the legal age of digital consent at 13 in the UK, meaning that any online service provider offering services directly to children under this age must obtain verifiable parental consent before processing their data. Furthermore, organisations must ensure that privacy notices are written in clear, age-appropriate language, so children and their guardians fully understand how their information is collected, used, and shared. 

The principle of data minimisation plays a crucial role in safeguarding young users, requiring that only the necessary amount of personal data is collected and retained for as long as needed. Additionally, the right to erasure, also known as the “right to be forgotten” (Article 17), allows children or their guardians to request the deletion of their data if it is no longer necessary or has been unlawfully processed. 

A significant requirement under UK GDPR is that platforms must implement high privacy settings by default, particularly for children’s accounts. This aligns with the Age-Appropriate Design Code (Children’s Code), issued by the Information Commissioner’s Office (ICO), which mandates that services likely to be accessed by children must provide a high level of data protection by design and default. Despite these legal requirements, enforcement remains a challenge, with many online platforms failing to fully implement child-friendly privacy measures, leaving young users vulnerable to data misuse and online exploitation. 

 The Online Safety Act 2023 

The Online Safety Act 2023 introduces a comprehensive legal framework designed to regulate online platforms and ensure the safety of children in the digital environment. Recognising the increasing risks posed by harmful content, data misuse, and exploitative online practices, the Act places a legal duty of care on service providers to identify and mitigate potential dangers to children using their platforms. This legislation is particularly relevant for social media networks, gaming platforms, and other digital services accessible to minors. 

A key requirement under the Act is that companies must conduct mandatory risk assessments to evaluate how their platforms may expose children to illegal or harmful material, including content that promotes self-harm, exploitation, or misinformation. The legislation mandates that platforms implement proportionate measures to prevent such risks, ensuring compliance through robust safety mechanisms and content moderation systems. 

Age verification and assurance mechanisms form another cornerstone of the Online Safety Act. Service providers are now legally obligated to implement technology that effectively determines whether a user is underage, thereby preventing children from accessing inappropriate or harmful content. This aligns with the Age-Appropriate Design Code (Children’s Code), which complements both UK GDPR and the Online Safety Act by setting high standards for protecting children’s data and ensuring digital services act in their best interests.5 6 

Despite these legal safeguards, enforcement and implementation remain a challenge. Many online platforms still operate within regulatory grey areas, making compliance a complex but essential responsibility for organisations that process children’s data. 

 Conclusion 

The protection of children’s data and online safety is a shared responsibility between organisations, regulators and parents. UK GDPR provides a strong legal foundation by requiring high privacy settings, minimal data collection, and clear parental consent mechanisms, while the Online Safety Act enforces stricter obligations on platforms to protect children from online harms. 

For businesses, compliance is no longer an option but a legal necessity. Organisations processing children’s data must integrate privacy-by-design principles, conduct risk assessments, and implement robust age verification systems to meet their legal obligations.  

Parents, too, play an essential role by actively engaging with their children’s online activities, leveraging their UK GDPR rights, and advocating for greater transparency from digital service providers. While legislation provides a crucial framework, the practical implementation of these laws will determine whether they effectively safeguard children in an increasingly digital world. 

By adopting a proactive and legally sound approach, organisations can not only comply with evolving regulatory requirements but also build trust with users and create a safer, more responsible digital ecosystem for future generations. 

Join the conversation

This article was written by Data Protection Expert, Catarina Santos who will be joining our audience live on the Data Protection Made Easy podcast on the 14th of March 2024 between 12:30PM and 13:30PM. It’s completely free to join and anyone is welcome to get involved, if you would like to sign up for this upcoming discussion simply visit our events page and register for this discussion for free.

Written by Catarina Santos

Designing A Child-Friendly Digital Environment- Episode 209

Episode 209: Is Your Child’s Data Safe? Understanding Privacy Risks on Social Media & Gaming Platforms

Welcome to Episode 209 of the Data Protection Made Easy Podcast, where our expert hosts Catarina Santos, Philip Brining, and Joe Kirk discuss the crucial topic of designing a safer digital world for children. With increasing regulatory focus on protecting young users online, this episode explores the principles of ethical design, compliance with UK GDPR and the Online Safety Act, and best practices for organisations developing child-friendly platforms. This week’s GDPR Radio session was packed with insights, lively discussion, and active participation from our engaged community of listeners.

What Was Covered in This Episode?

In this episode, our hosts explored the critical topic of children’s data privacy in the digital world. Special guest Catarina Santos led the discussion, shedding light on the risks and regulatory landscape surrounding young users’ personal information. Key discussion points included:

• How social media and gaming platforms collect and use children’s data
• Key legal protections under UK GDPR & The Online Safety Act
• Real-world cases of children’s data misuse and regulatory action
• Best practices for organisations processing children’s data

With growing scrutiny on how online platforms handle young users’ information, this episode is essential listening for data protection professionals, businesses, educators, and parents looking to stay informed and ensure compliance.

How to Join Future Live Sessions

The Data Protection Made Easy Podcast is not just a source of expert insights—it’s an interactive, community-driven discussion. Every Friday at 12:30 PM (UK time), we host a free live session on Microsoft Teams, where attendees can:

✔ Engage with data protection experts in real-time
✔ Share experiences and learn from peers across industries
✔ Access valuable tools, templates, and guidance shared during the session

Want to get involved? Sign up for our upcoming episodes and receive weekly invites! Click here to register.

Why Join Our Community?

With over 1,400 subscribers and thousands of weekly listeners, the Data Protection Made Easy Podcast is the go-to platform for professionals who want to:

• Stay ahead of industry changes and regulatory updates
• Learn from real-world case studies and expert-led discussions
• Connect with a like-minded community passionate about GDPR, cyber risk, and data privacy

Best of all, our sessions are completely free, with no sales pitches—just high-value content, expert insights, and practical advice that you can take back to your organisation.

Listen Back Anytime

Couldn’t join live? No problem! Episode 209 of Designing A Child-Friendly Digital Environment is now available to stream on Spotify, Amazon Music, and all major podcast platforms.

🎧 Listen to this episode now: https://open.spotify.com/episode/31ccrFP582nQ8PCWQGqhGL?si=04f2caeffa374828

Coming Up Next

Next week, we return with a GDPR Radio episode Make sure to subscribe and stay updated with all our latest episodes!

Check out our full podcast library for more episodes. Explore past episodes here.

GDPR Radio – Episode 208

GDPR Radio – Episode 208: The Latest in Data Protection News

Welcome to Episode 208 of the Data Protection Made Easy Podcast, where our expert hosts Catarina Santos, Caine Glancy, and Joe Kirk dive into the latest news, trends, and regulatory updates shaping the world of data protection. This week’s GDPR Radio session was packed with insights, lively discussion, and active participation from our engaged community of listeners.

What Was Covered in This Episode?

In this edition of GDPR Radio, our hosts explored the biggest stories in data protection, cybersecurity, and regulatory compliance, providing expert analysis on:

• The latest enforcement actions from the ICO and other regulators
• Key legislative updates and what they mean for businesses
• High-profile data breaches and lessons to learn from them
• Emerging trends in data privacy, AI governance, and cybersecurity

With live audience participation, our community contributed thoughts, experiences, and pressing questions, making this session a must-listen for data protection professionals, legal teams, and compliance officers looking to stay ahead of industry developments.

How to Join Future Live Sessions

The Data Protection Made Easy Podcast is not just a source of expert insights—it’s an interactive community-driven discussion. Every Friday at 12:30 PM (UK time), we host a free live session on Microsoft Teams, where attendees can:
✔ Engage with data protection experts in real-time
✔ Share experiences and learn from peers across industries
✔ Access valuable tools, templates, and guidance shared during the session

Want to get involved? Sign up for our upcoming episodes and receive weekly invites! Click here to register.

Why Join Our Community?

With over 1,400 subscribers and thousands of weekly listeners, the Data Protection Made Easy Podcast is the go-to platform for professionals who want to:

• Stay ahead of industry changes and regulatory updates
•  Learn from real-world case studies and expert-led discussions
•  Connect with a like-minded community passionate about GDPR, cyber risk, and data privacy

Best of all, our sessions are completely free, with no sales pitches—just high-value content, expert insights, and practical advice that you can take back to your organisation.

Listen Back Anytime

Couldn’t join live? No problem! Episode 208 of GDPR Radio is now available to stream on Spotify, Amazon Music, and all major podcast platforms.

Listen to this episode now using the player below:

Next week, we return with a special topical discussion on “Ethical Design for a Child-Friendly Digital Environment.” Make sure to subscribe and stay updated with all our latest episodes!

Check out our full podcast library for more episodes.

Big Brother – The Ethics of Employee Monitoring

Big Brother – The Ethics of Employee Monitoring

Employee monitoring is becoming more widespread as organisations look to improve productivity, ensure security, and maintain compliance. But where do we draw the line between necessary oversight and employee privacy? In this week’s Data Protection Made Easy Podcast episode, Joe Kirk and Caine Glancy delve into the legal, ethical, and practical aspects of workplace surveillance and how businesses can navigate these challenges under UK GDPR.

What Was Discussed in This Episode?

1. The Growing Role of Employee Monitoring

With the rise of hybrid and remote working, many organisations have introduced monitoring tools to track employee performance, security, and system usage. But are these tools being used appropriately? Our hosts explore the different types of monitoring, including:

• Time tracking software – used to log working hours and productivity.
• Screen recording and keystroke tracking – implemented to monitor employee activity on company systems.
• CCTV and biometric access – ensuring security in physical workplaces.
• AI-powered surveillance tools – detecting suspicious behaviour and improving cybersecurity.

2. The Legal Landscape: What Does UK GDPR Say?

Organisations must carefully consider lawful bases when processing employee data. Monitoring activities must comply with UK GDPR principles, particularly:

• Lawfulness, fairness, and transparency – Employees must be informed about how they are being monitored and why.
• Purpose limitation – Monitoring should only be conducted for specific, justified purposes.
• Data minimisation – Only necessary data should be collected, and excessive surveillance should be avoided.

The discussion also covers employee rights, including the ability to challenge intrusive surveillance and request access to monitored data.

3. Ethical Considerations: Balancing Trust and Compliance

While some level of monitoring may be necessary, excessive surveillance can erode trust, reduce morale, and even create legal risks. Joe and Caine examine:

• The psychological impact of constant surveillance in the workplace.
• Whether AI-driven monitoring is inherently biased or unfair.
• How organisations can create transparent policies that respect employee rights while protecting business interests.

4. Practical Steps for Businesses

How can organisations strike the right balance? Our hosts offer best practices for businesses, including:

• Conducting Data Protection Impact Assessments (DPIAs) before introducing monitoring tools.
• Ensuring clear policies and open communication with employees.
• Regularly reviewing monitoring practices to ensure compliance and fairness.

Earn IAPP CPE Credits on the Podcast

If you’re an IAPP-certified professional, you can claim 1 Continuing Privacy Education (CPE) credit for every episode of Data Protection Made Easy you listen to. Simply track your attendance and submit the episode details via the IAPP portal.

Our podcast is designed to provide real-world insights and professional development, helping data protection practitioners stay up to date with industry trends.

Join Our Community – Listen Live or On-Demand

The Data Protection Made Easy Podcast is completely free and designed to make data protection topics accessible, engaging, and easy to understand. With over 1,400 subscribers, our sessions provide a unique opportunity to connect with experts, discuss real-life challenges, and access valuable resources.

How to Join Future Live Sessions

We host weekly sessions every Friday from 12:30 PM – 1:30 PM via Microsoft Teams. You can:
Sign up for a single session via our Events Page
Subscribe for weekly invites and never miss an episode

Why Join Live?

• Participate in the live Q&A and chat with data protection professionals.
• Get access to useful tools and templates shared during the session.
• Stay ahead of industry news and legislative updates.

If you can’t join us live, you can listen back to all episodes on Spotify, Amazon Music, and other streaming platforms.

Listen to all past episodes here: Spotify Podcast Page

Upcoming Episodes

Friday, 7th March – GDPR Radio
Our fortnightly news round-up returns! We’ll cover the latest UK GDPR enforcement actions, ICO guidance, and industry developments.

Friday, 14th March – Designing for a Child-Friendly Digital Environment
How should organisations approach data protection for minors? Join us for a deep dive into ethical design, new regulations, and best practices for protecting children online.

Want to be part of the discussion? Sign up now and join the UK’s leading data protection podcast.

Listen Back & Stay Connected

If you missed this episode, you can catch up anytime! Our full library of 200+ episodes is available to stream on demand.

Listen Now
Subscribe for future sessions

Whether you’re a DPO, privacy professional, or just passionate about data protection, we’d love to have you in our community. Join us every Friday for the latest insights from Data Protection People.

Cyber Love or Cyber Risk

Cyber Love or Cyber Risk? A Data Protection Valentine’s Special

Exploring the Intersection of Love, Trust, and Data Protection

Love is in the air—but so are data risks! In this special Valentine’s Day edition of the Data Protection Made Easy Podcast, hosts Joe Kirk and Catarina Santos explore the hidden risks behind online dating, password sharing, and third-party trust in the digital world.

Whether you’re swiping right on a dating app or sharing your Netflix password with a loved one, personal data is constantly being exchanged. But how much do we really know about where that data goes and how secure it is?

What We Covered in This Episode

1. Dating Apps & Data Breaches – Who’s Really Holding Onto Your Personal Information?

Online dating has revolutionised the way people connect, but it has also created new privacy challenges. In this episode, we examine:

• Major data breaches in the dating industry – What can we learn from past incidents?
• How dating platforms collect and share user data – Are you really in control of your personal information?
• Best practices for protecting your identity when using online dating services.

2. Sharing Passwords – A Love Language or a Cybersecurity Nightmare?

From streaming accounts to banking apps, many couples share passwords without considering the risks. We discuss:

• The dangers of reusing passwords across multiple platforms.
• Whether it’s ever safe to share credentials and how to do it securely.
• How businesses can educate employees about password hygiene in the workplace.

3. Finding a Trusted Partner – In Love and in Business

Just as trust is essential in relationships, it’s also crucial when selecting third-party vendors who process personal data. In this section, we explore:

• Due diligence for third-party suppliers – How to vet companies that handle your customers’ data.
• The risks of sharing sensitive business data with external providers.
• Why legal agreements and data protection contracts matter in building strong business relationships.

Why You Should Listen to This Episode

✔ Real-World Insights: Learn from real data breaches and mistakes made by companies handling personal information.
✔ Practical Advice: Understand what you can do to keep both personal and business data safe.
✔ Interactive & Engaging: Our hosts break down complex issues into easy-to-understand, relatable discussions.

Join Us for Future Episodes!

This episode is part of our ongoing commitment to making data protection easy to understand and accessible. If you enjoyed the discussion, why not join us live next time?

🔹 We host live discussions every Friday at 12:30 PM (UK Time).
🔹 Sign up via our Events Page to get weekly invites.
🔹 Can’t make it live? Catch up anytime on Spotify, Amazon Music, or your favourite streaming platform.

Data protection isn’t just for businesses—it’s for everyone. Tune in to learn how to protect yourself and your organisation in a world where love and data are both at risk.