Business Development Manager – Cyber Security Services

Join Our Growing Team at Data Protection People

Data Protection People is expanding at a pace we have never seen before. Our team is the largest it has ever been and with our biggest year ahead, we are now looking for an ambitious Business Development Manager to help drive the continued growth of our Cyber Security Services division. If you are passionate about Cyber Security, enjoy building relationships, and thrive in a target driven environment, we would love to hear from you.

About the Role

We are recruiting a Business Development Manager focused on Cyber Security Services. This role is central to our growth strategy and involves generating new business across key service areas including PCI DSS, ISO 27001, Cyber Essentials, SOC 2, penetration testing and wider security consultancy. You will play a key part in helping organisations strengthen their security posture and navigate complex compliance requirements.

Key Responsibilities

Lead Generation
Identify and pursue new business opportunities using cold outreach, networking, events and market research. You will be proactive in building your own pipeline and opening doors with organisations that need support with cybersecurity.

Sales Presentations and Proposals
Prepare and deliver tailored proposals that clearly communicate the value of our cybersecurity solutions, and how they align with client objectives.

Negotiation and Closing
Negotiate confidently and secure new business agreements that help you meet or exceed your sales targets.

Market Insight
Stay informed on industry trends, compliance changes and competitor offerings to help identify new opportunities and position our services effectively.

Collaboration
Work closely with our Cyber Security and Consultancy teams to ensure proposals are accurate, solutions meet client needs, and handovers are smooth.

Reporting and CRM Management
Maintain accurate records of all sales activities, meetings and opportunities using Salesforce CRM.

Strategy and Campaign Development
Support the wider sales and marketing function by contributing ideas, supporting campaigns and helping shape how we reach new clients.

What We Are Looking For

We are seeking someone who is driven, confident and ready to take ownership of their pipeline.

Experience
A proven track record in business development or sales is essential, ideally within cybersecurity or technology.

Skills

• Strong communication and interpersonal skills
• Excellent negotiation and closing ability
• Confident presenting to stakeholders at all levels
• Ability to work independently and manage time effectively
• Comfortable with Salesforce and Microsoft Office
• Understanding of cybersecurity standards such as PCI DSS, ISO 27001, Cyber Essentials and SOC 2

Attributes

• Self motivated with a proactive, opportunity-seeking mindset
• Able to explain complex cybersecurity services clearly
• Resilient, adaptable and comfortable in a fast paced environment
• Enthusiastic, outgoing and confident

Benefits of Working With Us

Joining Data Protection People means becoming part of a friendly, fast growing and highly respected organisation.

Our benefits include:

• Competitive salary with strong commission structure
• Up to 30 days holiday, with an extra day added each year
• Pension scheme
• HR Bright and wellbeing support
• Excellent opportunities for professional development and career progression
• Supportive, collaborative work culture with a strong focus on employee wellbeing

How to Apply

If you are excited by this opportunity and want to join us on our next stage of growth, we would love to hear from you. Please submit your CV along with a cover letter explaining why you are the right fit for this role.

Once your CV has been reviewed, we will send an application form and arrange an introductory meeting.

Apply via Email

Equal Opportunity Statement

Data Protection People is proud to be an equal opportunity employer. We welcome applicants from all backgrounds and are committed to creating an inclusive workplace where everyone can thrive.

Navigating the Digital Omnibus: A UK GDPR Briefing for Busy Data Teams

Navigating the Digital Omnibus: A UK GDPR Briefing for Busy Data Teams

On 19 November 2025, the European Commission published its Digital Omnibus package. This set of proposals would update several major EU digital laws, including the GDPR, ePrivacy framework, AI Act, Data Act and Data Governance Act. The goal is to simplify compliance and support innovation while maintaining the fundamental rights and protections established in EU law.

For UK organisations with customers in the EU or who transfer EU personal data, these proposals are strategically important. Although the Omnibus is an EU initiative, it will shape expectations in the wider regulatory environment. It may also influence the UK’s own reforms, including the Data Use and Access Act 2025.

Key Elements of the Digital Omnibus

The Digital Omnibus contains two draft regulations. One amends the AI Act and the other makes cross cutting updates across digital and data laws. The proposals focus on three core areas: data protection, cybersecurity and breach reporting, and artificial intelligence.

AI Act Adjustments

The Omnibus introduces several changes intended to reduce the early compliance burden on organisations developing or deploying high risk AI systems.

• A one year extension to some high risk AI compliance deadlines.
• Expansion of SME friendly regimes to larger mid sized organisations.
• Removal of some obligations, such as AI literacy requirements, for certain providers.

For example, deadlines linked to training and validation obligations would shift to late 2027 rather than 2026. This gives businesses more time to meet new technical standards and reduces early compliance pressure for AI developers working within EU markets.

A Narrower Definition of Personal Data

One of the most significant proposals is a revised definition of personal data. Under the current GDPR, any information that could directly or indirectly identify an individual is treated as personal. This includes names, emails, IP addresses, device IDs and pseudonymous data.

The Omnibus moves to a controller centred test. Data will only be personal if the organisation processing it has the means that are reasonably likely to be used to identify a person.

In practice this means:

• Highly pseudonymised data or indirect identifiers may fall outside scope if the controller cannot realistically link them to a person.
• Direct identifiers or data that the organisation could reasonably use to single someone out will remain personal.
• Judging identifiability becomes relative to each controller’s realistic capabilities.

This approach aligns with recent case law, including SRB v Edenred. It may reduce compliance obligations for analytics and telemetry datasets, but introduces subjectivity. Organisations will need strong documentation to justify how they assess identifiability.

Special Category Data: Direct Versus Inferred

The Omnibus narrows what is considered special category data under Article 9. Only data that directly reveals sensitive characteristics, such as health, religion or political opinions, would fall under the enhanced protections.

Inferences or predictions about sensitive traits, such as deducing health conditions through profiling, would not automatically count as special category data.

The proposals also allow limited exceptions for processing special category data to train or operate AI systems and for biometric data processed on user devices under strict conditions.

Right of Access (DSAR) Reform

The Omnibus provides controllers with stronger grounds to refuse or charge for requests that are abusive or manifestly excessive. This aims to reduce the burden of DSARs used strategically in litigation or to disrupt operations.

Although “abusive” is not tightly defined, the approach mirrors changes already seen in the UK under the Data Use and Access Act. UK organisations will still need clear internal criteria to avoid rejecting legitimate requests.

Breach Reporting Thresholds and Timescales

Under the existing GDPR, controllers must report any breach that risks individuals’ rights within 72 hours. The Omnibus proposes raising this threshold so that only high risk breaches must be reported, and extends the reporting window to 96 hours.

The proposals also introduce an EU wide incident reporting portal operated by ENISA. This would consolidate reporting under GDPR, NIS2, DORA and other frameworks.

UK breach reporting rules remain unchanged. Notifications must still be made without undue delay and within 72 hours unless UK legislation is updated in future.

DPIAs, Automated Decisions and Cookies

The Omnibus includes further measures intended to simplify and standardise compliance:

• Harmonised DPIA and breach notification templates to be published by the EDPB.
• Relaxation of restrictions on automated decision making when contractually necessary.
• Broader exemptions under ePrivacy rules for analytics and security cookies.
• Requirement for browsers and operating systems to respect user privacy preference signals once standards are established.

These measures would reduce the volume of consent banners and bring greater technical consistency to DPIAs and cookie compliance. This direction is similar to recent UK guidance on consent and preference management.

Opportunities and Risks

The Omnibus aims to create clearer legal grounds for AI development and reduce administrative burden for organisations. Many businesses welcome the potential for fewer overlapping obligations and more predictable compliance requirements.

There are also trade offs:

• Narrowing the definition of personal data could create inconsistent protections across sectors.
• Higher thresholds for breach reporting may reduce visibility of lower impact incidents.
• DSAR reforms risk uncertainty without robust internal guidance.

For UK organisations, divergence between EU and UK regimes is likely to increase. This will require more precise policy alignment, updated data sharing contracts and consistent governance.

What UK GDPR Teams Should Do Now

• Review data protection policies and contracts to reflect upcoming EU changes.
• Update data maps and inventories to assess whether datasets may fall outside scope under the new definition.
• Refine DSAR triage processes to identify abusive or excessive requests.
• Monitor breach handling procedures to ensure EU and UK requirements remain aligned.
• Keep track of regulatory developments from both the EU and UK.

Looking Ahead

The Digital Omnibus is still under negotiation by the European Parliament and Council. If adopted, it will represent a substantial shift in the EU digital regulatory landscape and highlight growing divergence from UK law following the DUAA.

Whether or not the UK adopts similar measures, any organisation operating across both jurisdictions will need to adjust its practices. Preparing early will reduce risk, support innovation and maintain compliance.

The Omnibus signals a wider regulatory trend. Policymakers are recalibrating privacy and digital governance for an AI driven economy. While some protections may narrow, many proposals aim to reduce friction and bring clarity for businesses. UK organisations should begin planning now to remain compliant and competitive.

Sources

• European Commission: Digital Omnibus Press Release
• Digital Omnibus AI Regulation Proposal
• Digital Package Overview
• Case C 413 23 P: SRB v Edenred
• Skadden: First Impressions on Digital Omnibus
• Freshfields: Key Changes under the Digital Omnibus

What To Do If A Subject Access Request Uncovers a Data Breach

You’re handling a SAR and investigating the information requested by the data subject when you come across something more serious: a data breach.

In this article, we’ll discuss how SARs and data breaches interlink, which scenarios they might overlap, and what to do if this happens. 

How SARs and Data Breaches Overlap

A Subject Access Request is a right under GDPR that allows individuals to request their personal data from organisations. A data breach, on the other hand, is an incident that compromises the confidentiality, integrity or availability of personal data. 

SARs can reveal data breaches in two main ways:

• The SARs response reveals unauthorised disclosure or access. 
• The organisation fails to handle a SAR properly.

Common Scenarios Where SARs & Data Breaches Overlap

1. 1. Inadequate redaction of third-party data. This is a common and high-risk type of breach in which the organisation fails to properly redact or remove personal information from its records. This leads to the individual requesting their data receiving sensitive information about others, causing a breach.
   2. Failure to secure personal files. In the process of gathering data for a SAR, a company might discover that data from years earlier had been lost, but had never been reported. The SAR has revealed a data breach, forcing the company to confront the possibility that personal data may have been compromised. 
   3. Unauthorised access to emails. While investigating data for a SAR, a company might discover that an employee had previously fallen for a phishing attack, which compromised their email. The attacker could have stolen money, data or more.

Steps to Take If a Breach Is Discovered

If you’re investigating information and discover a breach, then there are a few steps you should immediately take. 

1. Pause and assess: Don’t ignore the issue. Document everything.
2. Contain the issue: Can the breach be stopped or mitigated?
3. Conduct a quick impact assessment: Who is affected and how?
4. Report internally to your DPO or data protection lead.

Ideally, keep SAR handling and breach investigations separate but coordinated. For more in-depth information, our guide “What Should You Do After a Data Breach? A Guide for Businesses” will touch on the steps you need to take in the event of a data breach. 

Legal and Regulatory Considerations

Reporting to the ICO

You should report a data breach to the ICO within 72 hours of becoming aware of it. Not all breaches are reportable – if you’re not sure, the ICO has a self-assessment tool to help you determine whether your organisation needs to report the breach. 

Informing the Data Subject

Similarly, if the data breach is likely to result in a high risk of adversely affecting their rights and freedoms, you should also inform the data subject and the ICO. 

Should You Pause the SAR Response?

Generally, you don’t need to pause the SAR response, but if the case is complex, you may be eligible for an extension.

Best Practices to Avoid Data Breaches & Handle SARs

A combination of strong technical security measures, staff training, clear policies and proper planning will put you in the best position for avoiding data breaches and handling SARs. This includes:

• Data mapping and minimisation: Know what data you hold and why.
• SAR simulation exercises: Test how your team would handle one.
• Improve data hygiene: Routine audits and retention reviews.
• Training: Ensure staff know how to spot and escalate issues.

Get SAR Support With Data Protection People

SARs can give you insights into your data ecosystem that you might never have discovered otherwise, and that includes data breaches. 

If SARs feel overwhelming – we can help. Whether you’re looking for someone to redact sensitive information or handle the SAR from start to finish, we offer the whole suite of SAR handling services. Talk to our data protection experts today.

Can You Charge for a Subject Access Request (SAR)?

SARs take up time and resources – but can you charge the individual requesting your effort? 

In this article, we’ll answer that question. We’ll discuss the exceptions where you can charge for a SAR and the rules and regulations governing those circumstances.

What the Law Says

GDPR law says that you must generally be provided free of charge. However, there are some exceptions where you can charge a “reasonable fee”. 

“Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either: (a) charge a reasonable fee taking into account the administrative costs of providing the information; or (b) refuse to act on the request.” – Article 12(5) UK GDPR. 

When Can You Charge for a SAR?

The two main circumstances where you can charge for a SAR are when the SAR is manifestly “unfounded” or “excessive”. 

“Unfounded” means that the individual clearly has no real intention of exercising their right, i.e. a request that’s made purely to cause disruption or harassment. This could be a former, disgruntled employee who makes a SAR every week to make as much work as possible for the company. 

An “excessive” SAR is one that is repetitive or requests a disproportionate volume of data with little value or justification. For example, you’re the owner of a small business, and a former worker requests all the information that you hold on them. An initial search results in 3,000 emails, which you may  consider burdensome on your resources to handle the request. 

What Does “Reasonable Fee” Mean?

The law says that you can charge a “reasonable fee” for these circumstances, if you choose to respond to the request (as opposed to refusing it outright). But what constitutes “reasonable”?

The fee should cover the administrative costs of dealing with the request, i.e.:

• • Staff time:
    • Assessing whether or not you’re processing the data
    • Locating, retrieving and extracting the data
    • Communicating the response to the individual, even if you’re not providing the data
  • Printing and postage
    • Or other associated costs of transferring the data

• Cost of media (USB stick, CD, etc.)

You should charge fees in a proportionate and consistent way. It’s best practice to include a copy of the criteria you’re using to create the fee in your SAR policy, so you can justify the cost.

How to Handle SAR Fees

Best practice when handling subject access requests that might qualify for charging a fee:

• • Assess whether the request meets the criteria for a fee.
  • Inform the requester as soon as possible:
    • Explain why the request is excessive or unfounded.
    • Provide a fee estimate.
  • Document your decisions as you go along so you can provide reasoning to the ICO if necessary.

• Pause the clock: the 1-month SAR response time doesn’t start until the fee is paid.

What Happens If You Get It Wrong?

You must be sure that charging for a SAR is justifiable – if you get it wrong, you could face punishment from the ICO or end up in court. An individual can complain to the ICO if they feel that you’re wrong to charge a fee, so it pays to be cautious.

One key example of a company getting it wrong is the case of Dawson-Damer v Taylor Wessing LLP, where the company withheld information and implied a fee should be charged. The court ruled that Taylor Wessing had not proven that the request was disproportionate, confirming that it is up to the data controller to demonstrate the request’s difficulty, not the other way around.

Need Help Reviewing a SAR?

Our experts can help with the full SAR lifecycle, from consulting on your processes to reviewing and redacting data to responding to the requests themselves. Get in touch today.

GDPR Radio – Digital Omnibus, Personal Data and SAR Reform

Digital Omnibus, Personal Data Changes and What They Mean for You

Episode 227 of the Data Protection Made Easy Podcast hosted by experts at Data Protection People. This episode was hosted live via Microsoft Teams in front of a live audience of listeners.

What We Covered in This Session

A Catch Up from Caine and Catarina

The episode opens with a look at what the team have been working on. Catarina reflects on a very busy week supporting a major client project alongside her team. Caine shares updates on ongoing STAIRs sessions for social housing providers and hints at an in person STAIRs event coming soon.

Both hosts also discuss their guest appearance on another organisation’s podcast where they explored how users understand privacy information, how organisations communicate their obligations and why cross functional training is so important.

The Digital Omnibus Package Explained

The main focus of the episode is the European Commission’s Digital Omnibus package, announced on 19 November. The discussion highlights several of the most significant proposals, including:

1. A New Approach to Personal Data

The proposal introduces a major shift. Information would be classed as personal data only if the controller has means reasonably likely to identify the individual.
The team explore:

• how this could narrow the scope of personal data
• what this means for indirect identifiers and pseudonymised data
• how case law from Europe is already pushing towards this direction
• how this might affect UK organisations if mirrored in future reforms

2. Changes to Data Breach Reporting

Catarina outlines proposals that:

• raise the threshold so only high risk breaches need regulator notification
• extend the deadline from 72 to 96 hours

Caine questions whether reducing low risk reporting could hide patterns of poor practice and the group debate what this means for real world compliance.

3. Reforms to Cookie Rules

The Digital Omnibus seeks to simplify cookie requirements by reducing reliance on consent for low risk purposes such as security and aggregated analytics. The team draw comparisons with the UK DUA Act and consider how consent fatigue has shaped this direction.

Insights from Guest Contributor David Appleyard

David shares two important observations:

1. SAR Purpose Tests

Under the new proposals, organisations may reject or charge for a SAR if the purpose is not to access personal data, for example in an employment dispute. This could be a significant change for many organisations that currently process large volumes of tactical or grievance based SARs.

2. High Risk AI Processing

David explains that the EU is pushing back deadlines for identifying high risk AI processing due to a lack of clear guidance, with expectations now set for no later than December 2027.

CNIL Research on Selling Personal Data

Caine introduces a study from the CNIL which found that 65 percent of surveyed French citizens would sell their personal data for between 1 and 100 euros. The hosts explore:

• why people undervalue their own data
• how advertising, profiling and AI training increase the true value
• the growing need for public awareness and transparent communication

Looking Ahead

The session closes with a reminder that the next podcast will explore data retention, followed by an update that the team are working on the new in house DPP studio.

About the Data Protection Made Easy Community

Our podcast community is one of the most active privacy networks in the UK with more than 150 regular live attendees and over 1,600 subscribers across all audio platforms. Joining the community gives you access to:

• free weekly live sessions with the chance to ask questions
• practical guidance from experienced consultants
• early access to slides and resources
• networking with other privacy and security professionals
• invites to in person events, workshops and sector focused discussions
• exclusive content only available to our community members

Attending live offers clear benefits. You can join the conversation, shape the discussion, raise real world challenges and take part in polls, chat and Q and A. Many listeners tell us they get far more value from attending live than listening back later.

We also have a strong line up of sessions taking us through to the end of the year, covering topics such as data retention, AI risk, international transfers, STAIRs, marketing compliance and more.

If you are not yet part of the Data Protection Made Easy community, you can join for free and get involved straight away.

Subject Access Requests in Practice, Community Q and A

Subject Access Requests in Practice, Community Q and A

After our first SARs session, we picked up the phone and asked our listeners what they struggle with most in real life. They shared questions, tricky scenarios and points of disagreement. In this follow up episode of the Data Protection Made Easy podcast, Caine Glancy and Oluwagbenga Onojobi work through those issues live with members of our community.

What we discussed

In this session we explore:

• Where to draw the line on property information as personal data in social housing
• How far to go when providing repair history and tenancy records
• SARs linked to disrepair claims, when to push back and when to provide more to be helpful
• Redacting staff names in emails and HR files, and what counts as excessive redaction
• How different organisations approach employment SARs and grievances
• Using the third party exemption to protect staff and witnesses
• Applying a reasonable and proportionate search so you focus your effort where it matters most
• The importance of documenting decisions and communicating clearly with data subjects

Listeners share how they handle these issues in housing and HR, which gives a rounded view of what is happening on the ground, not just what the legislation says.

Who this session is for

• Data Protection Officers and privacy leads
• SAR handlers and information governance teams
• Housing providers dealing with disrepair and complaint driven SARs
• HR professionals managing employment SARs and grievances

If you are trying to balance transparency with protecting third party rights, you will find this discussion especially useful.

Listen back and join the community

You can listen back to this episode now on Spotify and all major podcast platforms.

If you are not yet part of the Data Protection Made Easy community, complete our contact form and ask to join. Membership is free. You will receive a weekly invite to our live Friday sessions, access to visual materials, and ongoing support from over 1,500 like minded data protection practitioners.

Coming up next, GDPR Radio

This week our live Friday session is a GDPR Radio episode. Caine, Catarina and the team will be back to look at the latest news, enforcement action and real world challenges from across our community. If you would like to receive an invite, fill in our contact form and the team will add you to the mailing list.

Cookies in 2025 – Trick or Treat, Part Two

UK Cookies in 2025

Data Protection Made Easy Podcast: Cookies in 2025, What Changes and What To Do Now

Hosts, Catarina Santos with guests Oluwagbenga Onojobi (Gbenga) and Holly Miller. A brief cameo from Phil Brining.

Episode overview

In this 30 minute session we explain what cookies are, how the main types work, and what the 2025 UK reforms mean in practice. We look at PECR and UK GDPR, rising enforcement in Europe, consent or pay models, fingerprinting, Google Topics API, and the differences between the UK and EU approaches. The goal is simple, give you clear next steps that reduce risk without killing conversions.

Listen now

Also available on all major platforms, Spotify, Apple Podcasts, Audible, and popular Android apps. Many DPOs tell us they listen back on walks, in the gym, or while cooking, so feel free to enjoy this one at your leisure.

What we cover

• Cookies 101, first party, third party, strictly necessary, functionality, performance, and tracking.
• Hot topics, Google Topics API, cookie less advertising, fingerprinting, consent or pay models.
• Rules that matter, PECR and UK GDPR basics, lawful consent, transparency, and user choice.
• 2025 UK changes, low risk cookie exemptions, higher fine levels, and the ICO consultation.
• UK vs EU, where approaches differ, how to handle cross border users, and common pitfalls.

Practical takeaways

• Give Reject all equal prominence, avoid pre ticked boxes, explain purposes in plain English.
• Keep a cookie register, map scripts to purposes, owners, and retention.
• Update your cookie policy and link it clearly in the footer, keep a separate document from the privacy notice.
• Record consent events, banner version, time, and preferences, and honour withdrawal with no detriment.
• If you operate in the EU, follow the stricter position where needed, and use geo logic carefully.

Stay connected

You can always get in touch via our website or on LinkedIn. If you enjoy the podcast, share it with a colleague who looks after cookies, consent, or analytics.

Data Protection Made Easy is one of the UK’s largest data protection communities, over 1,500 subscribers, with more than 200 episodes available on major audio platforms.