What Does a Data Protection Officer (DPO) Do?

The UK GDPR is a complex piece of legislation. You can try to understand the legalese and juggle your requirements along with your day-to-day role, or you can appoint a DPO. 

A data protection officer is an independent expert responsible for keeping your business compliant with the law. Compliance underpins everything they do. That’s why companies choose to outsource their DPO to avoid a conflict of interest.

In this article, we will uncover the DPO requirements as set out in:

• Part 3, Chapter 4 of the Data Protection Act (2018)
• Articles 37-39 of the GDPR 

1. What Are the Tasks of a DPO? 

A data protection officer must perform the following tasks:

• Provide Guidance to Management & Employees
• Improve & Monitor GDPR Compliance
• Advice on Data Protection Impact Assessments
• Cooperate with the Commissioner
• Become the Commissioner’s Main Point of Contact
• Provide Guidance to Management & Employees

A DPO informs and advises the data controller (the business), its employees and any data processors that handle personal data on its behalf. 

As a GDPR expert, the DPO will keep these parties aware of their obligations under the UK GDPR, along with other data protection laws relevant to the controller’s operations. For example, if you transfer data from one country to another, your DPO will hold you accountable to both the UK GDPR and the country’s legislation. 

The Data (Use and Access) Act (DUAA) 2025 is simplifying international data transfer – find out more in our guide. 

A DPO is a purely advisory role, so they can’t make decisions for you. As a controller, you can even choose to reject their advice, but it would be wise to implement it or face the repercussions later on. 

2. Monitor GDPR Compliance

Along with advising, a DPO also monitors compliance with the UK GDPR and other data protection laws. This includes:

• Ensuring the relevant data protection policies are implemented and raising awareness of them 
• Assigning responsibilities under those policies 
• Bringing attention to data protection concerns
• Conducting or overseeing data protection training
• Conducting internal GDPR audits 
• Managing data protection obligations 

By completing these tasks, a DPO ensures your business maintains – or improves – its compliance with the UK GDPR. 

3. Advise on Data Protection Impact Assessments (DPIA)

Businesses that require a DPO are typically those with high-risk and/or large-scale processing activities. At times, these businesses will need to complete a risk assessment, otherwise known as a DPIA, when starting a new processing activity.

A data protection impact assessment is required by law only if:

• You process special category and criminal conviction data on a large scale.
• You systematically monitor public areas on a large scale.
• You plan to use automated decision-making to conduct systematic and extensive evaluations of an individual. For example, you may use software to automatically filter job applications based on a specific criteria. 

The ICO also include several other high-risk activities that may require a DPIA, which are not included above.  

The DPO is expected to advise and monitor these assessments, but not complete them on your behalf. Remember, DPOs are advisors, not ‘doers’. That is, unless they are an existing employee who may be spinning multiple plates to move compliance work over the line. 

4. Cooperate & Liaise with the Commissioner

The DPO must be a point of contact for the Information Commissioner (or ‘ICO’) on all data protection issues. This includes reporting on data breaches, subject access requests (SARs), and any other concerns related to non-compliance. 

A DPO operates independently, so while performing a task like this could jeopardise your business, you cannot dismiss or penalise them for doing so. It’s part of their job. This proactivity will help you avoid fines later down the line. 

5. Serve as the Point of Contact for Data Subjects

A DPO must also be the designated contact for individuals whose data is being processed. These individuals are known as data subjects and could be your employees or customers. 

When an individual submits a SAR, a data protection officer will handle the communication between the business and the person. The DPO will also guide the controller on collating and reviewing the requested information, ensuring the final response is delivered in a timely manner. 

Can a Data Protection Officer Carry Out Other Tasks?

Yes, if you have an internally appointed DPO, they can carry out other duties. These duties or tasks, however, must not result in a conflict of interest. 

If a DPO has two roles, the organisation must ensure that there are rules implemented to avoid or minimise conflict of interest. You must assess what each role entails and be prepared to provide evidence of why you have done so. 

What Are an Employer’s Duties When Appointing a DPO?

As an employer, you must create an environment that allows your DPO to:

• Report to the highest management level of the controller
• Participate in all matters related to personal data protection in a timely manner.
• Be provided with the necessary resources to perform their tasks and maintain their expertise in data protection law and practice.
• Be able to act independently, without receiving any instructions regarding their data protection tasks.
• Avoid conflicts of interest by not performing any other tasks that would create one.
• Not to be dismissed or penalised for performing their official duties

Is Your Business Fully GDPR Compliant? Speak to Our Outsourced DPOs Today

Our outsourced data protection officers bring extensive knowledge in all areas of the UK GDPR. You can choose to outsource all your DPO obligations, or they can work alongside your team to fill in the gaps. 

We offer a range of services to meet business requirements, so please get in touch to see how we can help. 

Ransomware Strikes London Nurseries

Ransomware Strikes London Nurseries – A Wake-Up Call for Child Data Security

What Happened?

In early October 2025, the Met Police announced the arrest of two 17-year-olds in Bishop’s Stortford on suspicion of computer misuse and blackmail, after a ransomware attack on Kido International, a London nursery group. The attackers, calling themselves “Radiant”,  stole personal data on roughly 8,000 children (names, photographs, addresses and parent contacts) from the nurseries’ cloud system.

They then threatened to publish more records unless Kido paid about £600,000 in Bitcoin. A small sample of 10 children’s profiles was posted on a dark-web site to pressure the company, and the group even began phoning parents directly. (After public outcry the hackers later blurred and claimed to delete the images.) Kido says the breach came via its nursery software provider Famly, although Famly insists its own infrastructure was not compromised. Regardless, the data loss forced Kido to notify authorities (via Action Fraud) and affected families.

Metropolitan Police Head of Economic and Cybercrime Will Lyne urged calm but vigilance, noting that specialist investigators have been working “at pace” on the case. He acknowledged that such reports “can cause considerable concern” for families, but reassured the public that the matter is being “taken extremely seriously”. These arrests, though welcome, are only a “significant step” in the ongoing investigation to bring the perpetrators to justice. The police continue to gather intelligence and warn that the inquiry is far from over.

Why Children’s Data Is So Valuable

Children’s personal data is a prised commodity for fraudsters. In the U.S., for example, child identity fraud has long been a hidden epidemic, costing victims nearly $1 billion per year. Because children have clean credit histories (and typically don’t monitor their credit until adulthood), their stolen data can be used to open accounts or commit financial fraud undetected. As one report notes, an infant’s information essentially provides a “clean credit history” for criminals, since child identity theft often goes unnoticed for years. Criminals prise children’s records for the same reason: they are fresh, untarnished by previous misuse, and can fuel years of fraudulent activity. In short, any breach of nursery or school data exposes families to the risk of long-term identity theft and financial loss.

Education and childcare organisations have become major ransomware targets. Early years settings handle highly sensitive personal information and even payments, making them “appealing target[s] for cybercriminals due to the sensitive information they hold,” according to the UK’s National Cyber Security Centre (NCSC). The risk is acute: schools and nurseries often hold medical records, safeguarding notes, and other sensitive data on each child, plus contact details for parents. Like healthcare, the education sector has very low tolerance for downtime; attackers know institutions may pay to restore operations quickly. Indeed, the ICO has reported that student attackers themselves are behind many school data breaches. 57% of insider breaches in UK schools (2022–24) were caused by pupils exploiting weak passwords or misconfigured systems. Whether the threat comes from external gangs or curious teens, regulators say the findings are “worrying” and urge education settings to step up cybersecurity immediately.

Recommendations for Nurseries and Education Providers

To protect children’s data and comply with UK GDPR and the Data Protection Act, nurseries should implement strong security and incident-preparation measures. Key steps include:

Risk Assessment and DPIAs

Treat any system holding children’s records as high risk. Conduct a Data Protection Impact Assessment that explicitly considers children’s rights, as required under the ICO’s Age-Appropriate Design Code. Classify large databases and any children’s personal data as requiring enhanced security.

Technical Controls

Follow NCSC ransomware mitigations and the ICO’s guidance on data security. This means patching devices promptly, using firewalls and anti-malware tools, and enforcing strong access controls (unique accounts, least privilege, multi-factor authentication) on all systems containing pupil or staff data. Where possible, encrypt sensitive files and emails, so that stolen data remains unreadable.

Backup and Recovery

Maintain up-to-date, offline or air-gapped backups of all critical systems and data. Test your disaster recovery plan regularly. If systems are encrypted by ransomware, you must have a way to restore operations from backups without paying the ransom.

Staff Training and Policies

Provide staff with regular cybersecurity awareness training (phishing simulations, password hygiene, device security). Train reception and finance teams especially, since attackers often use phone calls or fake invoices to breach schools. Remind all employees that data protection is not “just an IT problem”,  even leaving a tablet unlocked or sending information to personal email can cause reportable breaches. Refresh UK GDPR and security training at least annually, as recommended by the ICO. You can learn more about our Data Protection Training programmes here.

Third-Party Oversight

Vet any outsourced providers (like cloud software or payroll firms). For example, Kido’s incident involved a nursery-management app. Make sure contracts require prompt breach notification by vendors, and verify their compliance with GDPR. If a supplier reports a security issue, treat it as a potential breach of your own data.

Incident Response Plan

Prepare and practice an incident response plan (use the NCSC’s “Exercise in a Box” tool). Define roles and notification procedures in advance. Know the legal requirements: under UK GDPR, report any personal data breach that poses a risk to individuals to the ICO within 72 hours, and inform affected families without undue delay. The ICO’s ransomware guidance emphasises having an IR plan with clear thresholds for ICO and data-subject notification. Remember that loss of availability (ransomware lockout) is itself a notifiable personal data breach.

Cyber Essentials and Audits

Consider certification under Cyber Essentials (basic cybersecurity standard for UK organisations) and perform regular security audits or penetration tests. Keep logs of access and reviews of user accounts, and rectify any dormant or excessive privileges. Learn more about our Data Protection Support services to help with audit readiness.

Guidance for Parents

Parents and carers play a key role in mitigating risk. The Kido attack shows that no data is 100% safe once breached, but families can take precautions:

Verify Communications

Ignore unsolicited calls, texts or emails demanding payment or personal information. In this case, parents were directly threatened by the attackers, if your child’s nursery contacts you, expect it to be through official channels (direct lines or named staff). If in doubt, hang up and call the nursery’s main office or law enforcement.

Protect Personal Data

Limit how much your child’s identifying information you share online. Avoid posting school ID numbers, addresses, or birthdays alongside photos on social media. Even innocent sharing can give fraudsters clues. Teach older children not to divulge personal details to strangers or on public forums.

Monitor for Identity Theft

Consider checking or freezing your child’s credit files. In the UK, parents can request a report for their child (or freeze it) with major credit agencies once the child is old enough to have a credit file. If you suspect your child’s identity has been misused, report it to Action Fraud and the relevant financial institutions immediately. The long-term impact of child ID theft can linger (as in a noted case where a teen only discovered years later that her infant data was used to open accounts).

Follow Official Guidance

Stay informed via reputable sources. The NCSC and ICO both stress the importance of baseline security for families, such as using strong unique passwords and up-to-date software on home devices. The NCSC has published specific advice for early years settings and for individuals worried about breaches. Resources like GetSafeOnline.org and the ICO’s breach recovery guides can help you and your child respond to any suspicious activity.

Conclusion

This incident is a stark reminder that even trusted institutions can be breached, and that children’s data is uniquely valuable to cybercriminals. While law enforcement works to hold the culprits to account, nurseries and parents must both shore up defences and remain vigilant. Following official guidance, from the ICO and NCSC is key. By combining strong technical controls, clear policies and open communication with parents, early years providers can better protect the children in their care. Likewise, parents should use the tools and advice available to safeguard their family’s digital identity.

Sources

National Cyber Security Centre
ICO: Insider Threats in Schools
BBC News
National Crime Agency

ISO 27001 at 20

ISO 27001 at 20: Reflecting on Two Decades of Information Security Excellence

This year marks the 20th anniversary of ISO 27001 , the world’s leading information security management standard. Over two decades, ISO 27001 has become a global benchmark for protecting data, reducing cyber risk, and embedding security culture. As we approach the transition deadline for the 2022 update, now is the perfect time for organisations to take stock of their compliance journey.

What’s Changed: From BS 7799 to ISO 27001:2022

Before ISO 27001 became a global standard, its origins lay in the UK’s own BS 7799, first published in the 1990s. This framework evolved into ISO 27001 in 2005 and quickly gained international recognition for setting out what an effective Information Security Management System (ISMS) should look like.

The most recent version, ISO 27001:2022, modernises the standard for today’s digital landscape. While the management clauses remain largely familiar, the control set has been restructured to reflect new risks, technologies, and ways of working.

Main updates in ISO 27001:2022

• The number of controls has reduced from 114 to 93.
• Controls are grouped into four new categories: organisational, people, physical, and technological.
• New controls have been introduced to address modern risks such as cloud services, threat intelligence, and remote working.
• Each control now includes attributes that describe its purpose, making the standard more flexible and user-friendly.

These changes bring ISO 27001 in line with other management system standards through the Annex SL structure, which simplifies integration with frameworks like ISO 9001 (Quality Management) and ISO 22301 (Business Continuity).

Why It Matters for UK Organisations

ISO 27001 remains the gold standard for demonstrating information security maturity, and the 2022 update represents a significant evolution. For UK businesses, this update isn’t optional, it’s a mandatory transition with a clear deadline.

• Transition deadline: All ISO 27001:2013 certifications will expire on 1 November 2025. After this date, organisations must be certified to ISO 27001:2022.
• Improved alignment: The new structure makes it easier to integrate with other ISO standards, streamlining management processes.
• Modern security relevance: Updated controls address emerging threats such as cloud computing, supply chain security, and hybrid working environments.
• Enhanced business credibility: Certification to the latest version signals strong governance and builds trust with clients, partners, and regulators.

What You Should Be Doing Now

With less than a year until the transition deadline, organisations certified under ISO 27001:2013 should be well underway with their upgrade plans. Here’s how to get started:

• Confirm your certification status: Check which version of ISO 27001 your organisation is currently certified against and when your next audit is due.
• Conduct a gap analysis: Compare your existing ISMS against the 2022 control set. Identify any new, merged, or removed controls that affect your environment.
• Update policies and documentation: Ensure your ISMS documentation reflects new control terminology, roles, and risk management processes.
• Train your team: Make sure everyone involved in your ISMS,  from IT to HR, understands the new structure and control requirements.
• Engage your certification body: Confirm they are accredited for ISO 27001:2022 and schedule your transition audit well before the November 2025 deadline.
• Seek expert support: If resources are stretched, external consultants can provide transition planning, control mapping, or pre-audit support to make the process smoother.

Our View / Final Thoughts

Twenty years on, ISO 27001 continues to be the cornerstone of information security best practice. Its evolution shows how adaptable the framework is, maintaining timeless governance principles while responding to modern threats such as AI, remote work, and data sovereignty challenges.

At Data Protection People, we see ISO 27001:2022 not just as a compliance exercise, but as a strategic opportunity. Transitioning effectively strengthens resilience, improves stakeholder trust, and demonstrates that your organisation takes information security seriously.

If your certification is still under the 2013 version, now is the time to act. Our experts can support your transition with ISO audits, staff training, and ongoing compliance support.

FAQs

When do we need to transition to ISO 27001:2022?

All certifications under ISO 27001:2013 will expire on 1 November 2025. Transition audits should be completed before that date to avoid a lapse in certification.

What are the biggest changes in ISO 27001:2022?

The most significant updates are the streamlined control set (from 114 to 93), new control categories, and the addition of modern topics such as cloud security and threat intelligence.

Do all organisations need to adopt the new controls?

Every organisation must review all 93 controls, but not every control will apply. Applicability depends on your ISMS scope and risk assessment.

What happens if we don’t transition in time?

Your ISO 27001:2013 certification will become invalid after November 2025, and you may need to restart the full audit process, which is more costly and time-consuming than a transition audit.

Can DPP help with our ISO 27001 transition?

Yes. Our consultants can guide you through the transition process, from gap analysis and policy updates to training and audit preparation. Get in touch to learn more.

References and Useful Sources

• Evalian: ISO 27001 – 20 Years of Information Security Excellence (2025)
• ISO: Official ISO/IEC 27001 Standard
• BSI: ISO 27001 Certification Overview
• DPP: GDPR Audits | Training | Outsourced DPO | Support Services

Keeping Your Data Safe: A Practical Guide for UK Businesses

Data breaches and GDPR compliance can feel overwhelming for UK businesses. The cost of getting it wrong is significant, i.e. fines, reputation damage and the potential for massive business disruption. 

Protecting your company’s data is both a legal and operational necessity, but it doesn’t have to be complicated. In this guide, we will look at how regular audits, strong internal controls and even a dedicated role within your organisation can make data protection straightforward.

Understand Your Data Landscape

The first step to protecting your company’s data is simply understanding what you’re working with. The questions you need to answer are:

• What kind of personal data does your company hold?
• Where is it stored? 
• Who has access?

If you can’t answer these questions confidently, undertaking a data mapping project will help you identify and understand the data that you collect, hold and store. 

Carry Out Regular GDPR Audits

A GDPR audit is a review of your organisation’s data handling practices to assess whether they are compliant with the UK General Data Protection Regulations. It’s essential to ensure that your business meets its legal obligations, mitigates any risks of data breaches and implements necessary improvements.

Appoint a Data Protection Officer (DPO)

If your business carries out large-scale processing activities or is a public authority or body, then you need to hire a Data Protection Officer or outsource one. 

A DPO monitors GDPR compliance, leads audits and acts as liaison with ICO. They also provide guidance to management and employees who handle data.

If you’re a small or medium-sized business, then outsourcing a DPO might be more cost-effective, more impartial and expert-led than hiring one in-house. 

Strengthen Access Controls and Staff Training

One of the key measures you can take to keep your company’s data safe is implementing user access control. This means granting access to systems and data only to those who require it for their role. It also includes things like two-factor authentication and password control.

Regular training on data handling for all staff is also important, even if it’s just the basics, such as reporting incidents, phishing awareness and device locking. 

Have a Breach Response Plan

Do you know what to do if you’ve suffered a data breach? If you don’t, you could inadvertently be making the situation worse. Quick detection and response can not only potentially reduce the scale of the breach, but it can also reduce ICO penalties and reputational damage. 

Your DPO will help you manage any data breaches by assessing their severity, coordinating the response and notifying relevant authorities. 

Stay Up-to-Date with Regulation and Technology

GDPR and data protection law are always changing, especially after Brexit, so it’s important to keep up to date with the latest legislative changes. 

Technology can help you stay on the cutting edge of data protection, particularly in areas such as encryption, anonymisation and secure backups.

Your ongoing GDPR audits, along with your DPO’s responsibilities to monitor changes, should keep you informed.

Keep Your Data Safe with Data Protection People

Data protection is an ongoing business activity. With regular audits, internal controls and a knowledgeable DPO, you can keep your customers and your reputation safe. 

We offer a range of services to help you keep your company’s data protected from cyber criminals and accidental data breaches, from an outsourced DPO to GDPR audits. Get in touch with us today.

Cookies in 2025 – Trick or Treat, Part Two

UK Cookies in 2025

Data Protection Made Easy Podcast: Cookies in 2025, What Changes and What To Do Now

Hosts, Catarina Santos with guests Oluwagbenga Onojobi (Gbenga) and Holly Miller. A brief cameo from Phil Brining.

Episode overview

In this 30 minute session we explain what cookies are, how the main types work, and what the 2025 UK reforms mean in practice. We look at PECR and UK GDPR, rising enforcement in Europe, consent or pay models, fingerprinting, Google Topics API, and the differences between the UK and EU approaches. The goal is simple, give you clear next steps that reduce risk without killing conversions.

Listen now

Also available on all major platforms, Spotify, Apple Podcasts, Audible, and popular Android apps. Many DPOs tell us they listen back on walks, in the gym, or while cooking, so feel free to enjoy this one at your leisure.

What we cover

• Cookies 101, first party, third party, strictly necessary, functionality, performance, and tracking.
• Hot topics, Google Topics API, cookie less advertising, fingerprinting, consent or pay models.
• Rules that matter, PECR and UK GDPR basics, lawful consent, transparency, and user choice.
• 2025 UK changes, low risk cookie exemptions, higher fine levels, and the ICO consultation.
• UK vs EU, where approaches differ, how to handle cross border users, and common pitfalls.

Practical takeaways

• Give Reject all equal prominence, avoid pre ticked boxes, explain purposes in plain English.
• Keep a cookie register, map scripts to purposes, owners, and retention.
• Update your cookie policy and link it clearly in the footer, keep a separate document from the privacy notice.
• Record consent events, banner version, time, and preferences, and honour withdrawal with no detriment.
• If you operate in the EU, follow the stricter position where needed, and use geo logic carefully.

Stay connected

You can always get in touch via our website or on LinkedIn. If you enjoy the podcast, share it with a colleague who looks after cookies, consent, or analytics.

Data Protection Made Easy is one of the UK’s largest data protection communities, over 1,500 subscribers, with more than 200 episodes available on major audio platforms.

10 Years of Data Protection People

Celebrating 10 Years of Data Protection People & 5 Years of the Data Protection Made Easy Podcast

Last week we marked not one, but two major milestones, 10 years of Data Protection People and the 5th birthday of the Data Protection Made Easy Podcast. To celebrate, we hosted a special live session with Philip Brining, Caine Glancy, Catarina Santos, and returning host Joe Kirk. Together, we looked back at the Top 10 Most Streamed Episodes from the past five years, revisiting the conversations that have shaped our community.

Key Themes from the Session

• Subject Access Requests (SARs) – still one of the most complex and frequently discussed areas of data protection.
• Data Protection Impact Assessments (DPIAs) – exploring challenges around risk, practicality, and when a DPIA is truly needed.
• Legislative Changes – including Brexit, the Data Protection and Digital Information Bill, and the new DUA Act.

The team also reflected on why topics like ROPA and audits don’t always feature as highly among listeners, and why broad themes resonate more strongly than sector-specific discussions.

Insights from Our Community

Our special guest Joe Kirk shared valuable insights from moving into an in-house DPO role, including the importance of tackling cookie compliance and ensuring correct ICO registration. The panel also discussed the ICO’s new guidance on complaints handling and recognised legitimate interests, highlighting the practical steps organisations should take ahead of expected implementation in June 2026.

The Return of Weekly Podcasts

To celebrate our 10-year anniversary and the continued growth of our community, we are excited to announce that the Data Protection Made Easy Podcast is returning to a weekly schedule. Every Friday at lunchtime, we’ll be live with fresh discussions, community insights, and practical guidance for data protection professionals.

You can sign up on our Events Page to join future live sessions, or contact us here to subscribe and become part of the UK’s biggest data protection community.

Listen Back to the Anniversary Episode

If you missed it live, you can catch up now on Spotify using the player below:

Here’s to 10 years of making data protection easier, and 5 years of building a community where professionals can learn, share, and grow together. Thank you to everyone who has been part of the journey so far.

Caught in the Act: The UK’s New Age Verification Law

Online Safety Act, age checks, and real world risks, highlights from Episode 218

Recorded on Friday 29 August 2025, this live episode of Data Protection Made Easy brings together Catarina Santos, Caine Glancy and Philip Brining to explain what the latest Online Safety Act changes mean in practice. The team walk through how age verification works, why VPN downloads have surged in the UK, and the real impact on privacy, user experience and compliance.

Episode: 218, Data Protection Made Easy
Recorded: late August, Leeds and online
Hosts: Philip Brining, Catarina Santos, Caine Glancy

We are Data Protection People, a consultancy and a community. More than 1,500 practitioners join our live sessions for practical help and straight talking advice. We keep things human, current, and useful.

What we covered

• Online Safety Act, where it fits with the Children’s Code, why it goes further on content and safety.
• Age assurance, facial estimation, ID checks, open banking, and the privacy trade offs behind each approach.
• Supply chain risk, real incidents in education and vetting, why processor controls and backups still fail.
• Education, why literacy and resilience matter as much as technical gates.
• Community update, weekly sessions return in September, likely in focused 30 minute formats.

Highlights and opinions

Scope and categories. Ofcom guidance gives the most usable overview. Scale drives duties, category one providers face the heaviest lift. Smaller services still need proportionate controls.

“The Act is about content, the Children’s Code is about design, together they set expectations for what people actually see and share.” — Philip

Age checks in practice. Facial estimation and ID checks can help, they are not perfect. People will try VPNs and workarounds, so policy and education must sit alongside technology.

“There is no magic potion for age checks, the solution cannot be technology alone.” — Catarina

“If suppliers rush controls without thinking about retention and purpose limitation, we move risk rather than reduce it.” — Caine

Supply chain failures. Contracts need clear migration and deletion steps, restore tests must be real, controller oversight must be active, not paper based.

“Where is the weak link, backups, migration steps, subprocessors, or the missing instructions in the DPA.” — Philip

Freedom of expression and harm. Public concern is real. The intent is to reduce harm to children, not silence debate. Practical application will need careful balancing.

Practical takeaways for organisations

• Write a content risk assessment if your service can be accessed by children, update it on a schedule, record decisions.
• Map processors and subprocessors, include precise steps for transfers and deletion, test restores, not only backups.
• Choose proportionate age assurance, record lawful basis, retention, and vendor due diligence, avoid copying IDs unless necessary.
• Blend controls with education, publish clear user guidance, support parents and teachers, avoid dark patterns.

About the community

Data Protection Made Easy is the live podcast and discussion space run by Data Protection People. More than 1,500 members join to share cases, templates, and practical steps. We will return to weekly sessions in September, short and focused, with time for questions.

Contribute to a future episode

We are always looking for contributors and topics, case studies, SAR puzzles, transfer questions, or views on the Online Safety Act. Get support or advice, or pitch a slot for an upcoming episode.

Explore more in our Resource Centre, including recent episodes and guides.