Discover the comprehensive range of data protection services at Data Protection People. Tailored to meet the unique needs of your organisation, our expert team has successfully handled every challenge imaginable. Whether you’re navigating compliance complexities or enhancing data security, trust DPP to be your partner in safeguarding information.
Data Protection People have a wide range of training services catering for every need. Whether its general training for operational or admin staff or specific training for specialist roles, we have something for you. watch the short video below to meet the team and find out more about our training services.
Contact Us
DataWise is the original privacy tech platform designed to simplify GDPR compliance management. Since its inception in 2011, DataWise has continuously evolved, solidifying its reputation as the pioneering "privacy tech" solution.
Contact Us
Unlock Compliance Excellence with Our GDPR Consultancy Services. Navigating the intricate realm of data protection laws and standards demands expert guidance.
Contact Us
A data protection officer doesn't have to be a full time employee and in many respects it's better to have a company like DPP take on the role. Watch the video below to find out more about our outsourced DPO and privacy officer services or reach out and get in touch with us.
Contact UsAt Data Protection People, our cyber security services are designed to fortify your digital defences. With a proven track record spanning diverse sectors in the UK, our seasoned team brings a wealth of experience in handling a wide array of cybersecurity challenges. Reach out to us and explore how DPP can enhance your organisation’s cyber resilience.
A PCI assessment is an audit for validating compliance with the Payment Card Industry Data Security Standard (PCI DSS), a set of security standards for merchants who accept, process, store or transmit credit card information.
Contact Us
A PCI assessment is an audit for validating compliance with the Payment Card Industry Data Security Standard (PCI DSS), a set of security standards for merchants who accept, process, store or transmit credit card information.
Contact Us
Our experts can support you with Dark Web Monitoring - Data Protection People offer a free dark web scan for your organisation.
Contact Us
Our tailored program, guided by industry-certified experts, supports your ISO 27001 compliance journey. Whether you need advice on certification scope, assistance with remediation work, or comprehensive ISO 27001 consultancy, we’re here to guide you every step of the way.
Contact Us
At Data Protection People, we recognise the dynamic challenges and unique responsibilities of the Data Protection Officer (DPO) role. Beyond offering standard support, we provide a comprehensive suite of services crafted to empower DPOs at every step.
Collaborative Community: Navigating the intricate landscape of data protection can be isolating. That’s why we’ve fostered a collaborative community of privacy professionals. As a DPO with us, you’re never alone. Our network serves as a forum for insightful discussions, sharing solutions, and building a sense of camaraderie.
Expert Guidance and Advice: The journey of a DPO is often filled with complex decisions. Our seasoned team of experts is your reliable resource, offering timely advice and strategic guidance. We’re not just a service provider; we’re your dedicated partners in overcoming challenges and making informed decisions.
Advanced Training for Continuous Growth: Stay ahead in your role with our advanced training programs. Tailored for DPOs, our courses delve into intricate aspects of data protection, providing you with a competitive edge. It’s not just about meeting the present challenges but ensuring your continuous growth and excellence in your role.
Audits, Assessments, and Document Reviews: Our services extend beyond conventional boundaries. From comprehensive audits and assessments to meticulous document reviews, we ensure that your data protection strategies are not only compliant but also optimised for efficiency.
Simplifying Complexity for Future Ease: Beyond addressing current challenges, our mission is to simplify the complexities inherent in data protection. By partnering with Data Protection People, you’re not just solving problems – you’re ensuring a smoother, more efficient role in the future. We streamline processes, making your responsibilities more manageable and your decisions more impactful.
At Data Protection People, our expertise spans across diverse sectors, ensuring that businesses of all sizes and orientations receive tailored Data Protection and Cyber Security solutions. From the dynamic commercial sector and agile SMEs to the impactful third sector and expansive multi-nationals, we extend our services to fortify the digital defences of every business entity.
Elevate your data protection and cybersecurity standards in the bustling landscape of the Commercial Sector. We offer tailored solutions designed to safeguard your sensitive information, ensuring compliance and resilience against evolving threats. Partner with us to fortify your digital assets and foster a secure environment for sustained growth.
Small and Medium Enterprises (SMEs) form the backbone of innovation. Our data protection and cybersecurity services are crafted to match the agility of SMEs. Navigate the digital landscape securely, optimize your operations, and scale confidently with our tailored solutions that prioritize your unique business needs.
For organisations in the Third Sector driven by purpose, our data protection and cybersecurity expertise align with your mission. Safeguard sensitive data, build stakeholder trust, and amplify your positive impact. Let our solutions be the backbone of your technology infrastructure, ensuring that your focus remains on making a difference.
For the global footprint of Multi Nationals, our data protection and cybersecurity services provide a comprehensive shield. Navigate the complexities of international regulations with confidence. From compliance strategies to threat intelligence, we've got your data security needs covered, empowering your multinational endeavors with resilience.
In the Public Sector, trust and accountability are paramount. Our data protection and cybersecurity consultancy ensures that your operations align seamlessly with regulatory requirements. From confidential citizen data to streamlined governance, our solutions empower public entities to serve with integrity and technological excellence.
Data Protection People have the UK’s #1 Data Protection Podcast with over 150 episodes available across all audio streaming platforms, we also post regular content designed to simplify complex areas of data protection and cyber security, check out some of the podcasts and articles below and make data protection easy today.
Mergers and acquisitions are complex transactions. They require time, resource, commercial planning and strategic alignment. But one area that is often underestimated is data protection.
Personal data can be one of the most valuable assets transferred during a merger or acquisition. Customer databases, employee records, supplier information, marketing lists, contracts, complaints, case files and historic archives may all form part of the transaction.
If this data has not been collected, used, stored or shared lawfully, it can quickly become a major risk. Organisations may acquire personal data that they cannot lawfully use. They may inherit compliance gaps, weak security controls, poor retention practices or unresolved data subject rights issues.
In some cases, this can affect the value of the deal itself.
A well-known example is the ICO’s enforcement action against Marriott. The ICO fined Marriott £18.4 million in relation to a major data breach that originated from Starwood Hotels and affected around 339 million guest records. Although the cyberattack began before Marriott acquired Starwood, the ICO focused on Marriott’s failures following the acquisition, including weaknesses in monitoring, logging and encryption.
This case highlights an important point. Data protection should not be treated as a post-completion issue. It should be built into the full M&A lifecycle, from due diligence through to integration.
Organisations can manage these risks by addressing data protection early, clearly and practically. This means reviewing how personal data is collected, used, shared, stored and protected before, during and after the transaction.
The key areas to consider include:
Organisations must carefully consider their transparency obligations during mergers and acquisitions.
Where personal data is shared or obtained indirectly during the transaction process, Article 14 UK GDPR may apply. Article 14 requires organisations to provide individuals with privacy information where their personal data has not been collected directly from them.
This may arise where an acquiring organisation receives customer, employee, supplier or marketing data from the target organisation before or after completion.
Individuals may need to be informed about:
The parties should clearly allocate responsibility for issuing privacy information within the transaction documents. Communications should be timely, clear and accessible.
Data protection should be built into the due diligence process for any prospective acquisition target.
This due diligence must be detailed enough to help the acquiring organisation assess the legal, operational and commercial impact of any data protection risks.
For example, where significant compliance gaps are identified, the acquiring organisation may need to involve privacy professionals before completion. This may include reviewing privacy notices, lawful bases, data sharing arrangements, retention schedules, data subject rights processes and security controls.
In some circumstances, personal data may have been collected unlawfully. If so, the acquiring organisation may not be able to use that data in the way originally anticipated during negotiations.
This can affect:
Sellers should be ready to demonstrate compliance through appropriate documentation, policies and evidence of robust technical and organisational measures.
Buyers should request evidence that these controls have been implemented, maintained and followed by employees responsible for processing personal data.
An appropriate data sharing agreement should be established where personal data is exchanged between the parties.
The agreement should clearly define the roles and responsibilities of each party. It should also specify the purposes for which personal data may be shared and processed.
A strong data sharing agreement should address:
The parties should ensure that personal data is not retained for longer than necessary. Unnecessary or redundant data should be securely deleted or anonymised.
The agreement should also set out clear procedures for handling data subject rights requests, such as access, erasure and objection. This is especially important where systems and responsibilities are being integrated after completion.
A well-structured data sharing agreement supports compliance and helps reduce legal, operational and reputational risks.
Organisations must consider when data subjects need to be informed about changes to the processing of their personal data.
In most cases, the organisation that originally collected the personal data should provide the initial notification, particularly where it still has the direct relationship with the individuals concerned.
Following completion, the acquiring organisation may also need to issue updated privacy information where there are changes to:
The parties should clearly agree who is responsible for these communications. This should be documented as part of the transaction process.
Mergers and acquisitions often involve the transfer and integration of large volumes of employee information.
This may include:
Some of this information may include special category data or criminal offence data. This requires careful handling under UK GDPR and the Data Protection Act 2018.
Organisations should assess:
Employee monitoring activities should also be reviewed during post-acquisition integration. This may include email monitoring, CCTV, call recording, productivity tracking or system access monitoring.
These activities should be transparent, proportionate and properly documented.
Marketing data can be a valuable asset in a transaction, but it can also create significant compliance risk.
After a merger or acquisition, the acquiring organisation should assess whether the lawful basis previously relied upon for direct marketing remains valid.
This is especially important where consent was obtained by the acquired organisation before the change in ownership.
The acquiring organisation should ask:
Individuals should be informed of any changes affecting the processing of their personal data. Privacy notices should be updated to identify the acquiring organisation and explain any new marketing purposes.
The acquiring organisation must also comply with electronic marketing rules, including those under PECR. This includes respecting existing opt-outs and marketing preferences.
Inherited marketing databases should be reviewed carefully to ensure the data is accurate, relevant and lawfully usable.
Organisations should not assume that the lawful basis relied upon by the acquired organisation will automatically continue to apply after the transaction.
This is particularly important where the acquiring organisation intends to use the data for new or expanded purposes.
For example, if customer data was originally collected to provide a specific service, it may not automatically be appropriate to use that data for a new marketing campaign, profiling exercise or analytics project.
Organisations should review whether the existing lawful basis remains valid in the post-acquisition environment.
This may involve reassessing:
Where legitimate interests are relied upon, organisations should consider whether a new Legitimate Interests Assessment is needed.
Mergers and acquisitions frequently involve organisations that operate across multiple jurisdictions. As a result, personal data may be transferred internationally during the due diligence process, system integration or ongoing business operations.
Before transferring personal data outside the UK, organisations should establish whether an international transfer is taking place and ensure that appropriate safeguards are in place.
This may include transfers to:
Where personal data is transferred internationally, organisations should assess whether the destination benefits from UK adequacy regulations or whether an appropriate transfer mechanism, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, is required.
Organisations should also consider whether a Transfer Risk Assessment is necessary and ensure that any international transfers are reflected within their privacy information and Records of Processing Activities.
International data transfers should form part of the wider due diligence exercise, particularly where the target organisation relies heavily on overseas suppliers or cloud-based infrastructure.
Many organisations rely on external suppliers to process personal data on their behalf. During a merger or acquisition, these supplier relationships should be reviewed carefully to ensure they continue to meet UK GDPR requirements.
The acquiring organisation should identify all processors and sub-processors involved in handling personal data and review the contractual arrangements already in place.
Organisations should consider:
Where new suppliers are appointed during integration, organisations should ensure that appropriate contractual safeguards are implemented before personal data is shared.
Supplier risk management should remain an ongoing process after completion, particularly where critical systems or large volumes of personal data are involved.
Following a merger or acquisition, organisations should review their Records of Processing Activities (ROPAs) to ensure they accurately reflect how personal data is processed across the newly combined organisation.
Business processes often change significantly during integration. Departments may merge, new systems may be introduced and personal data may begin flowing between teams that previously operated independently.
Records of Processing Activities should therefore be updated to reflect:
Maintaining accurate Records of Processing Activities helps organisations demonstrate accountability and provides an important foundation for wider compliance activities.
The integration of systems, technologies and business processes may introduce new risks to the rights and freedoms of individuals. Where this is the case, organisations should consider whether a Data Protection Impact Assessment (DPIA) is required.
A DPIA helps organisations identify privacy risks before new processing begins and allows appropriate controls to be implemented at an early stage.
A DPIA may be appropriate where the merger or acquisition involves:
Completing a DPIA during integration supports privacy by design and helps organisations demonstrate compliance with UK GDPR.
Cyber security should be considered alongside legal and financial due diligence during every merger or acquisition. Weak cyber security controls within the target organisation can quickly become the acquiring organisation’s responsibility following completion.
Organisations should therefore assess the maturity of the target’s security framework before the transaction completes.
This review may include:
Any weaknesses identified during due diligence should be documented, risk assessed and, where appropriate, addressed as part of the post-completion integration programme.
Many organisations now use artificial intelligence tools to support customer service, recruitment, marketing, analytics and internal business operations. During a merger or acquisition, these technologies should be reviewed alongside more traditional data protection considerations.
The acquiring organisation should understand:
Organisations should also review whether personal data inherited through the transaction can lawfully be used to train, improve or develop AI systems. Using personal data for purposes that individuals would not reasonably expect could create compliance risks under UK GDPR.
As organisations increasingly adopt AI technologies, reviewing these systems during mergers and acquisitions is becoming an essential part of effective data protection due diligence.
After a merger or acquisition, organisations should review the personal data they have inherited.
The aim is to ensure that the data is still needed, still accurate and not being kept for longer than necessary.
In many cases, organisations inherit large volumes of old, duplicate or unnecessary information. This can create legal, operational and security risks.
This may include:
If this information is retained without proper review, organisations may increase the risk of:
As part of the integration process, organisations should assess:
Particular attention should be given to inherited marketing databases and employee records.
Marketing data should be reviewed to ensure it was collected lawfully, remains accurate and can still be used in line with UK GDPR and PECR requirements. Existing opt-outs and suppression lists should continue to be respected.
Employee records should not automatically be retained indefinitely simply because they have transferred to a new organisation. Retention periods should continue to reflect legal, regulatory and business requirements.
Appropriate data clean-up exercises should be carried out during integration. This may include:
Decisions about retention and deletion should be properly documented as part of the organisation’s wider accountability obligations.
The integration phase can create heightened security risk.
Systems may be migrated, consolidated, reconfigured or retired. Access permissions may change. Data may move between platforms, suppliers, teams and locations.
During this period, organisations should ensure appropriate technical and organisational measures are in place.
This may include:
Personal data should only be accessible on a need-to-know basis.
Organisations should also ensure that integration activity does not weaken existing security controls or create unnecessary exposure.
Every merger or acquisition is different, but there are a number of core data protection checks that should be completed before, during and after the transaction. The checklist below provides a practical starting point for organisations looking to reduce compliance risk and support a smooth integration.
| Area | Key Question | Complete? |
|---|---|---|
| Due Diligence | Has a full data protection due diligence review been completed? | ☐ |
| Privacy Notices | Have transparency obligations under Article 14 UK GDPR been assessed? | ☐ |
| Lawful Basis | Has every processing activity been reviewed to confirm the lawful basis remains valid? | ☐ |
| Marketing | Can inherited marketing databases continue to be used lawfully under UK GDPR and PECR? | ☐ |
| Employee Data | Has special category and criminal offence data been identified and protected appropriately? | ☐ |
| Supplier Contracts | Have processor agreements and third-party supplier contracts been reviewed? | ☐ |
| International Transfers | Have all international data transfers been identified and appropriate safeguards implemented? | ☐ |
| Security | Have technical and organisational security measures been independently assessed? | ☐ |
| Cyber Security | Have previous cyber incidents, vulnerabilities and security certifications been reviewed? | ☐ |
| Retention | Has inherited personal data been reviewed against retention schedules and data minimisation requirements? | ☐ |
| Records of Processing | Have Records of Processing Activities (ROPAs) been updated following integration? | ☐ |
| DPIAs | Has a Data Protection Impact Assessment been completed where required? | ☐ |
| Data Subject Rights | Are processes in place to manage Subject Access Requests and other individual rights after the transaction? | ☐ |
| AI and New Technology | Have AI tools and automated processing activities been reviewed for compliance? | ☐ |
| Governance | Have accountability documents, policies and staff responsibilities been updated following completion? | ☐ |
Completing these checks before and during integration can help organisations identify compliance gaps early, reduce legal and operational risk, and demonstrate accountability under UK GDPR.
Data protection should be treated as a fundamental part of the mergers and acquisitions lifecycle.
It should not be left until after completion.
From due diligence through to integration, organisations must ensure that personal data is lawfully obtained, properly governed, transparently processed and securely managed in line with UK GDPR and PECR obligations.
By embedding data protection into due diligence, contractual arrangements, transparency obligations, lawful basis reviews, marketing activity, retention decisions and system integration, organisations can reduce risk and support a smoother post-acquisition transition.
Data Protection People can support organisations throughout this process. We can help identify and reduce compliance risks, support due diligence activity, review marketing and transparency obligations, and help implement practical data protection measures throughout the transaction lifecycle.
Planning a merger or acquisition?
Data Protection People can support your organisation with data protection due diligence, supplier reviews, transparency obligations, contract reviews, DPIAs, and post-acquisition integration to help reduce compliance risk throughout the transaction.
Yes. UK GDPR applies whenever personal data is collected, reviewed, shared, transferred or integrated as part of a merger or acquisition. This includes customer data, employee records, supplier information, marketing databases and historic records.
Organisations should review all personal data that may transfer as part of the transaction. This may include customer records, employee files, payroll data, supplier information, contracts, complaints, marketing lists, archived data, backups and information held in legacy systems.
Marketing databases can transfer as part of an acquisition, but the acquiring organisation must assess whether the data can still be used lawfully. This includes reviewing consent, legitimate interests, privacy notices, opt-outs and compliance with PECR.
Article 14 UK GDPR applies where an organisation receives personal data indirectly, rather than collecting it directly from the individual. In an M&A context, this may require the acquiring organisation to provide privacy information to customers, employees, suppliers or other individuals whose data has been obtained through the transaction.
Data protection due diligence helps organisations identify legal, operational and security risks before completing a transaction. It can reveal whether personal data has been collected lawfully, whether it can be used as intended and whether any compliance gaps could affect the value or viability of the deal.
Where personal data is shared between parties during a transaction, a data sharing agreement should be used to define roles, responsibilities, permitted purposes, security measures, retention rules and processes for handling individual rights requests.
Employee data should be handled carefully because it may include special category data, criminal offence data, sickness records, occupational health information, disciplinary records and payroll information. Access should be limited, lawful bases should be reviewed and retention periods should remain appropriate.
Data Protection People can support organisations with data protection due diligence, privacy notices, supplier reviews, lawful basis assessments, marketing data reviews, DPIAs, ROPAs, data sharing agreements and post-acquisition integration planning.
Artificial intelligence and machine learning are increasingly influencing how security operates on both sides of the fence. Organisations are using them to spot unusual activity more quickly and with more precision. Attackers are using them to run phishing campaigns, impersonate people convincingly, and scale fraud operations that would have required whole teams just a few years ago.
The uncomfortable truth is that both sides are using the same technology and are getting better at it. Attackers do not follow scripts. They adapt in real time, blend into normal-looking traffic, and automate the trial and error that used to slow them down.
AI has lowered the barrier to sophisticated attacks considerably. Credential harvesting, social engineering, synthetic identity fraud, and card testing are not new threats, but AI makes them faster, more targeted, and harder to distinguish from legitimate activity.
A phishing email that once took hours to craft can now be personalised and sent at scale. In some emerging cases, attackers are experimenting with automation that adjusts payloads or lures based on defensive responses.
In the AI Risk and Resilience Special Report published across 2025–2026, Mandiant observed that threat actors are moving beyond experimental use of generative AI and increasingly operationalising AI across the attack lifecycle.
The report highlights a shift toward more automated and adaptive techniques, where AI is used to support reconnaissance, phishing, and malware development at scale, reducing how much human effort is needed to run and evolve campaigns.
The same shift is happening on the defensive side, often quietly. Many of the fraud platforms, identity tools, and monitoring systems organisations already rely on have machine learning built in, sometimes without it being particularly visible or labelled as such.
These systems work by processing large volumes of transaction data, authentication logs, and behavioural signals to spot patterns that do not fit. Rather than flagging individual events in isolation, they correlate activity across users, devices, and systems.
This is how organisations can catch things like account takeover attempts or card testing activity that might look unremarkable on their own. In complex payment environments with heavy API traffic and distributed infrastructure, that kind of correlation is genuinely difficult to do without automation.
PCI DSS v4.x represents a meaningful shift in how organisations are expected to approach security compliance. Rather than functioning as a purely prescriptive checklist, the standard now places greater emphasis on achieving defined security outcomes.
This change introduces two methods for meeting requirements: the traditional Defined Approach, which follows the familiar step-by-step control structure, and a more flexible Customized Approach, which allows organisations to design controls that fit their specific environment, provided they can demonstrate, through testing and risk analysis, that the requirement objective is met.
That second option is where the real mindset changes sit. PCI DSS v4.x is less concerned with the technology used to implement a control and more concerned with whether the implemented control is effective in meeting the security objectives.
This creates space for organisations to move away from rigid, one-size-fits-all implementations and adopt more modern, risk-driven security designs. As long as the intent of a requirement is met, organisations have more flexibility to tailor their control architecture to their operational reality.
While the standard does not explicitly require AI or machine learning, it does expect organisations to have proper logging, monitoring, and processes in place to detect and respond to suspicious or unusual activity.
In practice, many teams achieve this using existing security tooling such as SIEM platforms, behavioural monitoring approaches, and automated log analysis. Some organisations also use capabilities like User and Entity Behaviour Analytics to improve visibility and scale detection across large, complex environments.
However, passing a compliance audit and actually being secure remain two different things. Organisations can satisfy every requirement and still carry blind spots in detection and response that only surface when something goes wrong.
Business email compromise illustrates this well. Controls exist for it, including awareness training, email filtering, and access restrictions. Attackers know those controls exist and design around them.
According to the Microsoft Threat Intelligence findings in the Microsoft Digital Defense Report 2024, threat actors involved in business email compromise continuously adapt their techniques, messaging, and supporting infrastructure in response to detection and defensive controls.
The campaigns persist not because controls are missing, but because attackers adapt to them more quickly than many defences do.
This is precisely what PCI DSS v4.x is responding to. The emphasis has shifted from whether controls are present at a point in time to whether they continue to work effectively under real-world conditions.
That distinction pushes organisations toward continuous validation rather than snapshot assessments, and it raises a governance question that cannot be sidestepped.
As behavioural analytics and AI-assisted tools take on more of the detection and response work, organisations must still be able to demonstrate how alerts are generated, how the system is tuned over time, how false positives and negatives are managed, and how the whole thing maps back to a specific requirement intent.
The flexibility that PCI DSS v4.x offers comes with heavier responsibility to document, justify, and evidence that whatever solution is in place, whether traditional or AI-enhanced, is genuinely doing its job. Saying “we use AI” is not an answer an auditor will accept.
We are at the beginning of the next phase of AI in security operations, and it is agentic. Rather than systems that simply detect and alert, agentic AI is designed to investigate, correlating signals across endpoints, identity, network, and application layers, then assembling a coherent view of activity for analyst review.
Across enterprise security platforms, AI-driven workflows are increasingly being embedded into investigation and incident triage workflows, with some extending into guided remediation. The direction is clear and the pace of adoption is accelerating.
The meaningful change is not detection itself but speed. Investigation cycles that previously took hours are being compressed significantly, reducing the window between when an attack begins and when someone understands what is happening.
In payment environments, where delayed detection can mean mass cardholder data exposure, that matters enormously. Security controls are increasingly built into operational workflows, where automation does not just flag issues but helps investigate them.
This shifts the analyst’s role away from constant alert monitoring and toward validating findings and making decisions.
AI systems are only as good as the threat models and data behind them. As both attackers and defenders lean harder into AI, security outcomes depend less on what tools an organisation has purchased and more on how quickly it can adapt, validate, and respond.
That is a harder problem than it sounds, and it does not get solved at audit time.
It raises some honest questions for security and compliance leadership. Do you have real-time visibility across your payment environment, or are there gaps that only surface after something has already gone wrong?
Has anyone formally assessed whether your AI-driven tools are performing as expected, or are you trusting the vendor’s word? Can abnormal behaviour be detected and acted on at the speed it occurs?
And are your PCI controls functioning as continuous, validated mechanisms, or as checkboxes that get ticked once a year and largely left alone in between?
Most organisations get this wrong in the same way: they treat AI as a product to buy rather than a control to govern.
A fraud platform with machine learning under the hood is still, fundamentally, a control, and every control needs to be tested, documented, and proven to work. Vendor marketing does not change that.
A model might perform well, but without proper validation and oversight, it is not necessarily any safer than the rules-based system it replaced.
The real challenge is no longer whether organisations have security controls in place, but whether those controls can be trusted to behave consistently as environments and attack patterns evolve.
Cyber criminals are increasingly using AI to automate phishing campaigns, create convincing impersonations, develop synthetic identities, and scale attacks such as credential harvesting and card testing. AI allows these attacks to become faster, more personalised, and more difficult to detect.
Yes. AI can help organisations detect suspicious behaviour more quickly by analysing large volumes of transaction data, authentication logs, and behavioural patterns. This enables security teams to identify potential threats that may otherwise go unnoticed.
No. PCI DSS v4.x does not require organisations to implement AI or machine learning. Instead, it requires organisations to demonstrate that their security controls effectively detect, monitor, and respond to threats, regardless of the technology being used.
AI driven security controls use artificial intelligence or machine learning to support activities such as fraud detection, behavioural analytics, threat monitoring, and incident investigation. Like any security control, they should be regularly tested, validated, and documented.
AI tools should not simply be trusted because they use advanced technology. Organisations need to understand how they make decisions, monitor their effectiveness, manage false positives and negatives, and ensure they continue to meet security and compliance requirements over time.
Data Protection People works with organisations at exactly this intersection, validating that adopted controls, whether AI-enabled or traditional, align with PCI DSS requirements and broader security standards such as ISO 27001, and can be evidenced to an auditor without ambiguity.
Compliance postures do not always keep pace with the technology changes happening inside them. If AI and automation have reshaped how your controls operate but your last formal assessment predates those changes, this is a risk.
Finding it through independent assurance is considerably better than finding it through a regulatory review or a breach.
Get in touch now for assistance.
A business is legally required to appoint a Data Protection Officer (DPO) when its activities meet specific UK GDPR criteria. This includes large-scale monitoring, processing special category data or operating as a public body.
Certain types of organisations, and organisations carrying out specific activities, are required to appoint a DPO under GDPR.
Organisations that require a DPO, whether a controller or a processor, typically include:
For instance, healthcare providers, insurance companies and large HR platforms will usually need to appoint a data protection officer.
If you’re not legally required to appoint a DPO, but choose to appoint one voluntarily, the position still has the same responsibilities and tasks as a mandatory appointment.
A DPO becomes legally required when your organisation’s data activities create higher compliance responsibilities – not necessarily company size.
GDPR doesn’t define the numbers around ‘large-scale processing’, but it considers:
We would recommend consulting with a data protection expert if you’re unsure.
| Activity | DPO required? | Example |
| Small business storing customer emails | Usually no | Local gift shop |
| Large-scale health data processing | Yes | Private clinic |
| Employee CCTV monitoring across sites | Potentially | National employer |
The right DPO service provider combines GDPR expertise, independence and practical business support.
What to look for:
Using an outsourced DPO service gives you access to broader expertise, guaranteed independence and better scalability. It is also usually more cost-effective to outsource to an external DPO than it is to hire one in-house.
However, an in-house DPO may be more readily available and have a deeper understanding of your company’s internal processes from the get-go.
At Data Protection People, we offer a range of DPO services designed to suit your needs. Our expert Data Protection Officers will provide you with everything you need to get GDPR compliant. Get in touch today.
The World Cup started on 11 June, and for the next five weeks it will be almost impossible to avoid. What may be easier to miss, among the football, is the amount of watching going on: not just of players on the pitch, but of fans walking through the gates and, closer to home, staff turning up tired after a late kick-off.
Two things are happening this summer that every organisation should pay attention to. One is in the stadiums. The other is in the office.
Mark has a ticket to a group game. He gets to the gate and there is nothing to scan: no paper ticket, no phone, no barcode. He simply looks at a camera, it recognises his face, and he is through. Brilliant, thinks Mark. The future.
Face-based entry is already in use across major US sports venues, and biometric screening is widely expected to be one of the defining features of the 2026 World Cup, with the United States, Canada and Mexico hosting millions of fans across 16 cities. Typically, it works much as it does for Mark: fans register through an app, a selfie is converted into a digital token linked to their ticket, and they walk straight through. To a fan, it feels like a glimpse of how every stadium may work one day. To anyone responsible for data protection, it raises a serious question, because facial recognition is not ordinary data processing.
When a system uses someone’s face to identify them, it is processing biometric data. Under UK GDPR, biometric data used for identification is special category data. You cannot process it simply because it is convenient, or because people seem happy enough to accept its use.
Doing it lawfully takes two things: a lawful basis under Article 6 UK GDPR, and a separate condition under Article 9. Consent may look like the obvious route, but it has to be freely given and comply with the rest of the rules for consent under the UK GDPR. It will also have to be “explicitly” provided in order to collect special category data. That is hard to argue when the alternative is being turned away from a match someone has already paid for.
That last point is where organisations often come unstuck. Earlier this year, the Spanish data protection authority fined Barcelona €500,000, not simply for using biometric data, but for failing to carry out a proper Data Protection Impact Assessment before collecting facial and voice data from members during a digital sign-up process involving around 143,000 people. The club had produced a risk assessment; the regulator decided it was not, in substance, a proper DPIA at all. Members had complained that the biometric option felt compulsory and that the ordinary alternative was unclear.
UK clubs are watching the World Cup closely, and some will be tempted to bring this technology home. Before they do, they need to understand that what looks like an upgrade to the fan experience is, in data protection terms, one of the highest-risk things they can do.
Rachel runs HR, and she has started to notice a pattern. Two people are off sick on the same morning, the day after a late England game. A couple of others log in late and look as though they would rather be anywhere else. A run of “working from home” requests all seem to land on match days. She is tempted to keep a closer eye on a few people for the next month or so.
She is not alone. Because the tournament is being played across North America, many matches fall in the UK evening or late at night, with kick-offs at 7pm, 10pm and well past midnight. The predictable result is a workforce running on less sleep, and managers tempted to check who is logging in late, review activity logs, and cross-check absences against the fixture list.
Monitoring staff is not unlawful. But it is regulated, and the same principles that govern facial recognition apply here too. There has to be a lawful basis. In the workplace, consent rarely works because the imbalance between employer and employee means it cannot usually be freely given. Most employers rely instead on legitimate interests, which means carrying out a Legitimate Interests Assessment rather than simply deciding that the monitoring feels reasonable.
It also has to be proportionate. Wanting to catch a few people who stayed up too late is not, by itself, a good enough reason to monitor an entire workforce. An employer has to ask whether there is a less intrusive way to achieve the same thing, and whether what is being collected is limited to what is genuinely needed.
It also has to be transparent. Monitoring people without telling them is only lawful in genuinely exceptional cases, such as investigating suspected criminal activity. A football match does not come close. If Rachel’s organisation is going to monitor staff, it has to tell them what is being monitored, why, on what basis, and for how long. That should be set out clearly in a policy and privacy notice. Where the monitoring is systematic, it also needs a Data Protection Impact Assessment: the very same tool a football club needs before installing facial recognition.
Mark and Rachel could not be in more different situations. One is a fan being watched at a match; the other is a manager thinking about doing the watching. But the underlying questions are the same. What is your lawful basis? Do you really need to do this? Is it proportionate? Have you told people? Have you carried out an Impact Assessment?
The World Cup will be over by late July. The technology it showcases will not be. Facial recognition at the turnstile and monitoring software on the work laptop are both becoming more normal, and more tempting, every year. Too often, organisations reach for the technology first and consider the law later.
Watching people is not automatically unlawful. It is not automatically acceptable either. The technology does not remove the need to ask the difficult questions; it makes asking them more important than ever.
If you are considering biometric or facial recognition technology, treat it as high-risk from the outset. Carry out the Impact Assessment first, identify both your Article 6 lawful basis and your Article 9 condition, and think carefully about whether consent can truly be freely given. If you monitor staff, or are tempted to do so over the coming weeks, make sure you have a documented lawful basis, that the monitoring is proportionate, that staff are properly informed, and that an Impact Assessment sits behind anything systematic.
Enjoy the football. Just make sure your organisation is not the one caught offside.
If your organisation is considering biometric technology, facial recognition, or employee monitoring, now is the time to get the data protection position right. Our team can help you understand the risks, complete robust DPIAs, identify the correct lawful basis, and put clear policies and safeguards in place before issues arise. Through our Data Protection Audits, Outsourced DPO services, and ongoing Data Protection Support, we work with football clubs and organisations across every sector to keep projects compliant and proportionate and make data protection easy for you and your teams.
For many organisations, creating a Record of Processing Activities (RoPA) feels like one of the most daunting parts of data protection compliance.
Often viewed as nothing more than a lengthy spreadsheet completed to satisfy Article 30 UK GDPR requirements, RoPAs frequently become outdated, overly complicated and rarely used once they have been created.
In a recent episode of the Data Protection Made Easy podcast, Catarina Pereira dos Santos and Himanshi Gulati discussed why organisations should rethink their approach. Rather than treating a RoPA as a compliance exercise, they explained how it can become one of the most valuable governance tools within an organisation.
From improving understanding of business processes to supporting Subject Access Requests, DPIAs and supplier reviews, a well-maintained RoPA can provide far more value than many organisations realise.
One of the first topics discussed was the poor reputation that RoPAs have developed.
Catarina explained that many organisations immediately see a RoPA as a burden rather than a useful business tool.
“I work as a data protection consultant and every single time I mention RoPA to clients, they have such a bad reputation. They see it as a monster and just want to stay away from it.”
Himanshi suggested that the issue is not the RoPA itself, but the process organisations often follow to create one.
“I don’t really think that people dislike the RoPA itself. They dislike the process.”
She explained that many organisations immediately picture endless spreadsheets, large numbers of processing activities and uncertainty over who is responsible for maintaining the document.
Rather than approaching a RoPA as a legal requirement alone, the discussion encouraged organisations to think about what the document is actually designed to achieve.
According to Himanshi, the most effective RoPAs are built around understanding how personal data moves throughout the organisation.
“I think it’s very easy if you don’t see it as a legal requirement… you really have to understand your business and how the data is flowing.”
Understanding processing activities, data flows and ownership provides organisations with much greater visibility over their compliance position and often highlights risks that may otherwise go unnoticed.
Throughout the discussion, both hosts stressed that a RoPA should not simply exist because Article 30 requires it.
Instead, it should become part of day-to-day governance.
Himanshi explained that organisations often leave the RoPA until last, focusing on policies and procedures first.
However, she argued that the RoPA should often become the starting point because it provides the context needed for many other compliance activities.
“It’s not just filling up spreadsheets… it really gives you context.”
One of the biggest challenges discussed was ownership.
Many organisations assume that because a RoPA relates to data protection, maintaining it should be entirely the responsibility of the DPO or privacy team.
The hosts challenged this assumption.
Catarina explained that whilst the privacy team may oversee the document, individual departments are far better placed to understand how personal data is actually processed within their own areas.
Process owners should therefore play an active role in maintaining their sections of the RoPA, ensuring it reflects how the organisation really operates.
Without that ownership, documents quickly become inaccurate and lose much of their value.
The conversation highlighted how collaborative workshops frequently uncover processing activities that departments had not initially considered.
Himanshi shared an example of working with a marketing team that initially believed they did not process much personal data beyond sending emails.
However, further discussion revealed they were collecting competition entries, storing winner information, sharing data internally and publishing photographs on social media.
These discoveries demonstrated why conversations with departments are often far more valuable than asking them to complete a spreadsheet in isolation.
Another important theme throughout the discussion was that there is no single correct format for a RoPA.
Whilst regulators provide guidance on the information that should be included, organisations have flexibility over how they record and manage that information.
Rather than copying another organisation’s template, businesses should build a RoPA that reflects their own processing activities and remains practical to update over time.
As Himanshi explained, every organisation processes personal data differently, meaning every RoPA should be tailored to suit the business.
Towards the end of the discussion, the hosts explored what actually makes a good RoPA.
Rather than measuring success by the number of processing activities recorded, they suggested organisations should ask a much simpler question.
Does the RoPA help people understand how the organisation processes personal data?
Can it support everyday compliance activities such as responding to Subject Access Requests, carrying out DPIAs, reviewing suppliers and identifying risks?
If the answer is yes, the RoPA is doing exactly what it was designed to do.
As Himanshi summarised:
“If you are able to understand your processing activities, understand your risks and carry out your day-to-day activities, that’s what a good RoPA will be.”
Creating a Record of Processing Activities should never be viewed as simply completing another compliance document.
When maintained properly, a RoPA becomes a living record of how an organisation handles personal data. It supports better governance, improves accountability and helps organisations identify risks before they become problems.
Rather than seeing it as another spreadsheet, organisations should view their RoPA as a strategic tool that supports almost every aspect of their wider data protection programme.
A RoPA is a document that records how an organisation collects, uses, stores and shares personal data. Article 30 UK GDPR requires many organisations to maintain one.
Many organisations see them as large spreadsheet exercises rather than practical business tools. A lack of ownership and unclear processes often make them difficult to maintain.
Whilst the DPO or privacy team may oversee the document, individual departments should take ownership of their own processing activities to ensure the information remains accurate.
No. Every organisation processes personal data differently. A RoPA should reflect how your own organisation operates rather than copying another business’s template.
A well-maintained RoPA can support Subject Access Requests, DPIAs, supplier reviews, risk assessments and ongoing governance by providing a clear picture of how personal data is processed across the organisation.
Building and maintaining a Record of Processing Activities can be challenging, especially when organisations are managing multiple departments, changing processes and increasing compliance requirements.
Our Data Protection Support Service and Outsourced DPO Service help organisations create practical, accurate RoPAs that support day-to-day compliance, not just regulatory requirements.
Whether you’re creating your first RoPA or reviewing an existing one, our consultants can help you build a record that works for your organisation, not against it.
The data protection landscape rarely stands still, but recent developments suggest organisations may be facing new challenges from multiple directions.
In a recent episode of GDPR Radio, Caine Glancy and Catarina Pereira dos Santos explored several of the biggest stories currently impacting the profession, including the growing number of AI-generated Subject Access Requests (SARs), criticism of the ICO’s complaints handling processes, the resignation of Information Commissioner John Edwards, and the UK’s proposed social media restrictions for under-16s.
Whilst these issues may appear unrelated, they all raise important questions about accountability, regulation and how organisations can prepare for an increasingly complex compliance environment.
One of the first topics discussed was the significant increase in Subject Access Requests being experienced by some organisations, particularly within the housing sector.
Catarina explained that several clients have reported substantial increases in SAR volumes compared to the same period last year, with some organisations managing dozens of requests simultaneously.
Whilst organisations often look for common causes such as complaints or service issues, the discussion highlighted another potential factor, the growing use of artificial intelligence.
The conversation explored how AI tools such as ChatGPT are making it easier than ever for individuals to draft and submit Subject Access Requests.
Catarina described conducting her own test using ChatGPT and discovering that many of the requests being received by one client closely mirrored the wording generated by the AI platform.
“Twenty-eight of them are literally coming from ChatGPT because it was a copy and paste of the one that I have seen in front of me.”
The discussion highlighted both the opportunities and challenges this creates. On one hand, AI can help individuals better understand and exercise their rights. On the other, organisations may find themselves dealing with increasing volumes of requests that are generated quickly and submitted with little effort.
The discussion also highlighted a less obvious issue.
According to Caine, organisations are increasingly finding themselves engaged in lengthy back-and-forth exchanges where AI-generated responses repeatedly challenge the organisation’s position.
Rather than helping resolve requests, AI can sometimes create what Caine described as a “hamster wheel” of ongoing correspondence. Organisations respond, AI generates a counterargument, and the cycle continues.
This creates an important challenge for organisations. Knowing when a SAR has been answered appropriately and when communication can reasonably come to an end is becoming increasingly important.
The conversation then turned to the Information Commissioner’s Office and recent criticism of its complaints framework.
The hosts discussed concerns raised by campaign groups regarding the ICO’s approach to lower-risk complaints and whether sufficient action is being taken when individuals exercise their data protection rights.
The discussion explored the difficult balance regulators face between prioritising resources and maintaining public confidence.
Catarina questioned whether data subject rights risk becoming theoretical if complaints are routinely stored for information purposes without further action.
“The regulators should be there to protect the rights and freedoms… but then they complain and they are used for informational purposes rather than actually helping the data subjects.”
The resignation of Information Commissioner John Edwards was another major topic.
Whilst the hosts acknowledged that the full circumstances remain a matter of public record, the discussion focused on what the change could mean for the future direction of the ICO.
Catarina suggested that the timing may provide an opportunity for the regulator to review its processes and priorities.
The broader question raised throughout the discussion was whether the ICO’s current approach remains fit for purpose in an environment where data protection concerns continue to grow in both volume and complexity.
The final major topic centred around the UK’s proposed social media restrictions for under-16s.
The proposal has been positioned as a measure to improve online safety and reduce the risks children face online. Catarina acknowledged the positive intentions behind the proposal, particularly given the ongoing concerns around children’s privacy, harmful content and the misuse of personal data.
However, the discussion also raised several practical concerns.
A recurring theme throughout the discussion was accountability.
Rather than focusing solely on restricting access for younger users, both hosts questioned whether greater responsibility should be placed on the platforms themselves.
As Catarina explained, the conversation appears to focus heavily on controlling users whilst paying less attention to the role social media companies play in creating and maintaining online environments.
The discussion also raised questions around age verification, enforcement and whether restrictions alone can address the root causes of online harm.
The conversation concluded by recognising that online safety is rarely a straightforward issue.
Whilst protecting children remains an important objective, both hosts questioned whether blanket restrictions alone can solve the wider challenges associated with social media, harmful content and digital wellbeing.
As Caine noted, the underlying issue may not simply be access to social media, but the platforms themselves and the environments they create.
The episode highlighted several developments that organisations should continue monitoring closely.
The rise of AI-generated SARs is already creating operational challenges for some organisations. Questions around ICO enforcement and complaints handling continue to attract attention. Meanwhile, proposals around online safety and social media restrictions are likely to generate ongoing debate.
Whilst the outcomes remain uncertain, one thing is clear. Data protection professionals will need to remain adaptable as technology, regulation and public expectations continue to evolve.
Yes. A Subject Access Request can still be valid even if it has been created using an AI tool. Organisations should assess the request in the same way they would any other SAR.
Increased awareness of data protection rights, the use of AI tools and wider public discussion around privacy may all be contributing to higher SAR volumes.
Organisations should follow their internal SAR procedure, document their decisions and ensure they have responded appropriately. Once a request has been handled properly, it is important to know when further correspondence is no longer necessary.
The ICO uses a risk-based approach when reviewing complaints. This means some complaints may be prioritised depending on factors such as risk, harm and wider public interest.
Although the proposal aims to protect children online, concerns remain around age verification, enforcement, privacy and whether enough responsibility is being placed on social media platforms themselves.
Organisations can prepare by having clear SAR procedures, training staff, maintaining good records and seeking specialist data protection support where needed.
Managing Subject Access Requests, responding to regulatory challenges and keeping up with changing data protection expectations can be difficult, particularly when organisations are facing increasing workloads and limited internal resource.
Our Data Protection Support Service, Outsourced DPO Service and Training and Awareness Services help organisations navigate complex compliance challenges with confidence.
Whether you need support managing SARs, reviewing governance processes or improving staff awareness, our team can help you make data protection easier to understand and easier to manage.
When a personal data breach occurs, the first few hours are often the most important.
The decisions made immediately after an incident can significantly influence the outcome, affecting regulatory obligations, reputational damage, customer trust and the overall response effort.
In a recent episode of the Data Protection Made Easy podcast, Caine Glancy and Catarina Pereira dos Santos discussed the practical actions organisations should take during the first 72 hours following a personal data breach.
The discussion explored breach containment, risk assessments, notifications, lessons learned and the common mistakes organisations make when responding to incidents.
Whilst every breach is different, the session reinforced a simple message. Organisations that respond quickly, assess risk properly and learn from incidents are often far better positioned to reduce harm and prevent future issues.
One of the most important points raised during the discussion was the need to contain an incident as quickly as possible.
Before organisations start thinking about reporting obligations, notifications or regulatory engagement, they need to understand what has happened and stop any ongoing unauthorised access, disclosure or loss of personal data.
As Catarina explained: “We need to contain it immediately.”
Containment actions will vary depending on the nature of the breach. This may involve recalling emails, disabling accounts, restricting access to systems, recovering documents or preventing further disclosure.
The key objective is to stop the incident from escalating whilst gathering enough information to understand what has happened.
Once the immediate situation has been contained, organisations need to establish the facts.
The discussion highlighted how many organisations rush straight to questions about whether a breach should be reported to the ICO without first understanding what has actually happened.
Before any meaningful risk assessment can take place, organisations need to identify what information was involved, who was affected, how the breach occurred, whether the information has been accessed and what mitigating actions have already been taken.
This information forms the foundation of any subsequent decision-making process.
Without context, it is almost impossible to determine whether a breach presents a risk to individuals or whether reporting obligations apply.
The session also addressed a common misconception. Not every personal data breach needs to be reported to the ICO.
Many organisations automatically assume that any breach involving personal data must be reported, whilst others incorrectly assume that low-risk incidents are not breaches at all.
In reality, every incident should be assessed on its own merits.
A misdirected email, accidental disclosure or inappropriate access may still constitute a personal data breach even if the risk to individuals is ultimately low.
The discussion reinforced the importance of assessing the specific circumstances rather than relying on assumptions.
As Caine explained, context is critical when evaluating risk and determining the appropriate response.
A recurring theme throughout the discussion was the importance of context.
Organisations often want a straightforward answer to whether a breach is reportable or whether affected individuals should be notified. However, data protection rarely works in absolutes.
Caine highlighted how difficult it can be to assess risk without understanding the full circumstances surrounding an incident.
A simple statement such as “an email was sent to the wrong person” does not provide enough information to determine the level of risk involved. Organisations need to understand the contents of the email, the sensitivity of the information, who received it and whether any mitigating actions have already been taken.
As Caine explained: “The key is always in the likely.”
Risk assessments should focus on what is realistically likely to happen as a result of the breach, rather than becoming overly focused on highly unlikely scenarios.
This is why context remains one of the most important elements of effective breach management.
One of the most common questions raised following a breach is whether the incident needs to be reported to the Information Commissioner’s Office.
The discussion highlighted that organisations should avoid treating ICO reporting as an automatic response.
Instead, reporting decisions should be based on the outcome of a documented risk assessment and the likelihood of risk to individuals.
Where a breach is likely to result in a risk to the rights and freedoms of individuals, organisations are generally required to notify the ICO within 72 hours of becoming aware of the incident.
However, the hosts also acknowledged that many organisations struggle with this decision-making process, particularly when dealing with complex incidents or limited information.
For smaller organisations without dedicated privacy teams, understanding reporting thresholds can be one of the most challenging aspects of breach management.
The session also explored another area that frequently causes uncertainty, notifying affected individuals.
Many organisations assume that if a breach has occurred, the individuals involved must automatically be informed. However, this is not always the case.
Whilst transparency remains a fundamental principle of data protection, notifications should have a clear purpose.
As Catarina explained, the purpose of notifying individuals is not simply to tell them that a breach has happened. It is to allow them to take action where there is an active risk to them.
If a breach creates a high risk to an individual’s rights and freedoms, notifying them may allow them to protect themselves from fraud, identity theft, financial loss or other harms.
Where there is no ongoing risk, organisations may decide that notification is unnecessary.
The discussion highlighted the importance of carefully balancing transparency, risk and potential distress when making these decisions.
Whilst organisations are often concerned about under-reporting breaches, the discussion highlighted that over-notification can also create problems.
Informing individuals about every low-risk incident may cause unnecessary concern, particularly where no meaningful action is required on their part.
Some individuals may understandably assume the worst when they hear the phrase “data breach”, regardless of the actual level of risk involved.
In certain circumstances, notifying individuals about low-risk incidents may create confusion, anxiety and additional complaints without providing any practical benefit.
This is why notification decisions should always be proportionate and based on a thorough assessment of the circumstances.
As the discussion demonstrated, there is rarely a one-size-fits-all approach.
Caine reinforced this point by explaining: “Nothing in data protection is a one size fits all kind of thing.”
One of the strongest messages from the session was that organisations should view breaches as learning opportunities.
Even low-risk incidents can reveal weaknesses in processes, training, systems or controls.
Rather than simply recording an incident and moving on, organisations should take the time to identify trends and recurring issues.
As Caine explained: “The main thing really is treating it as lessons learned always.”
If multiple incidents occur for similar reasons, such as misdirected emails, access errors or process failures, this may indicate a wider issue that requires attention.
Reviewing breach data collectively often provides valuable insight into where improvements can be made.
The discussion highlighted how organisations can use incidents to strengthen controls, improve staff awareness and reduce the likelihood of future breaches.
Closely linked to the lessons learned approach was the idea of extracting value from incidents wherever possible.
Breaches are rarely desirable, but they can provide useful information about organisational weaknesses and areas for improvement.
As Caine commented: “You’ve got to try and claim some benefit back from it where you can.”
This might involve updating procedures, improving training, introducing additional technical controls or reviewing existing risk assessments.
By treating breaches as opportunities for continuous improvement, organisations can often strengthen their overall data protection framework.
Once the immediate response has been completed, the discussion highlighted the importance of reviewing the incident in full.
This should include documenting what happened, assessing the effectiveness of the response, identifying any improvements and updating relevant policies or procedures where necessary.
Organisations should also consider whether additional staff training, awareness campaigns or technical measures may help prevent similar incidents in the future.
The first 72 hours are important, but the actions taken afterwards are often what determine whether an organisation genuinely learns from an incident.
The session reinforced a practical and proportionate approach to managing personal data breaches.
Contain the incident, establish the facts, assess the risk, determine whether reporting obligations apply and identify opportunities for improvement.
Whilst every breach is different, organisations that follow these principles are often better positioned to respond effectively, reduce harm and strengthen compliance over time.
Most importantly, the discussion highlighted that effective breach management is not just about regulatory compliance. It is about protecting individuals, maintaining trust and continuously improving organisational practices.
Managing a personal data breach can be challenging, particularly when organisations are under pressure to assess risk, make reporting decisions and communicate effectively with regulators and affected individuals.
Our Data Protection Support Service, Outsourced DPO Service and Training and Awareness Services help organisations build effective breach management processes, improve governance and strengthen compliance.
Whether you’re responding to an incident, reviewing your breach procedures or looking to improve organisational awareness, our team can help you manage data protection with confidence.
The first priority should be containing the incident to prevent any further unauthorised access, disclosure, loss or destruction of personal data. Once contained, organisations should establish the facts and begin assessing risk.
No. Organisations should assess whether the breach is likely to result in a risk to the rights and freedoms of individuals. Not all breaches meet the threshold for ICO notification.
Where a breach is reportable, organisations are generally required to notify the ICO within 72 hours of becoming aware of the incident.
No. Individuals generally need to be informed where the breach is likely to result in a high risk to their rights and freedoms. Notification decisions should be based on a documented risk assessment.
A risk assessment helps organisations understand the potential impact on affected individuals and determine whether reporting or notification obligations apply.
Even low-risk incidents can reveal weaknesses in processes, systems, training or controls. Reviewing breaches helps organisations identify trends, strengthen governance and reduce future risk.
Political parties process vast amounts of personal data, from electoral registers and supporter databases to campaign communications, fundraising activities and voter engagement initiatives. Yet despite the scale of this processing, many people have little visibility into the data protection challenges operating behind the scenes.
In a special episode of the Data Protection Made Easy podcast, Caine Glancy was joined by James Robson, former Data Protection Officer for The Labour Party, to discuss what data protection looks like inside one of the UK’s most scrutinised organisations.
The discussion explored regulatory investigations, Subject Access Requests, electoral data, political campaigning, public trust, governance and the future of data protection in democratic processes.
Drawing on his unique experience, James shared practical insight into the realities of managing compliance in a highly political, highly visible and constantly evolving environment.
If your organisation is navigating complex data protection challenges, our Data Protection Support Service, Outsourced DPO Service and Training and Awareness Services help organisations strengthen governance, improve compliance and build trust.
One of the most striking moments from the discussion came when James described his first experience of joining The Labour Party.
Rather than inheriting a mature compliance programme, he found a significant backlog of privacy requests, open regulatory investigations and unresolved compliance issues.
Reflecting on the experience, James explained: “I walked into a burning building not realising it was a burning building.”
He described discovering unanswered Subject Access Requests, deletion requests and ongoing ICO engagement linked to historic compliance challenges.
At the time, there were numerous open complaints, significant operational issues and substantial work required to restore confidence in the organisation’s compliance framework.
The discussion highlighted how quickly data protection risks can escalate when governance arrangements are not maintained and why organisations should avoid viewing compliance as something that can simply be paused or deprioritised.
The conversation reinforced a reality many data protection professionals will recognise. When governance processes are not maintained, problems rarely remain isolated.
Unanswered requests become complaints. Complaints become regulatory attention. Regulatory attention creates pressure, scrutiny and operational disruption.
Good governance is often most visible when things go wrong. Effective processes, documented decision-making, clear accountability and regular oversight can help organisations identify issues early and reduce the likelihood of problems escalating.
For many organisations, this serves as a reminder that compliance is not simply about policies and procedures. It requires ongoing attention, ownership and investment.
Another key theme was the role of transparency when dealing with regulators.
Rather than treating the ICO as an adversary, James explained how he worked to build a more collaborative relationship focused on openness and improvement.
He commented: “We needed to change the feeling that the ICO had about Labour.”
Part of that strategy involved increasing transparency and involving the regulator more closely in ongoing remediation efforts.
As James explained: “We need to bring the ICO as close to us as possible and be transparent about all working processes.”
Whilst many organisations naturally feel nervous about engaging with regulators, the discussion highlighted how openness can often help demonstrate accountability and commitment to improvement.
Transparency does not remove regulatory obligations, but it can help build trust and create a more constructive working relationship when challenges arise.
A recurring theme throughout the episode was the importance of relationships.
James explained how understanding data processing activities required close collaboration with teams across the organisation.
Rather than approaching compliance from a purely legal perspective, he focused on understanding business objectives and identifying practical solutions that balanced organisational goals with privacy requirements.
This is a challenge many Data Protection Officers face. Effective compliance rarely comes from saying no. It comes from understanding what an organisation is trying to achieve and helping it achieve those objectives in a compliant way.
Successful privacy programmes are often built on trust, communication and collaboration rather than policy documents alone.
Political parties exist to campaign, engage with voters and ultimately win elections. Data protection obligations do not remove those objectives, but they do influence how they can be achieved.
The discussion explored the challenge of balancing privacy risks with organisational priorities.
As Caine highlighted during the episode, effective Data Protection Officers need to understand both the risks to individuals and the wider risks facing the organisation.
This balancing act applies far beyond politics. Whether working in housing, healthcare, education, local government or the private sector, privacy professionals are often required to navigate competing priorities whilst ensuring compliance remains effective and proportionate.
The episode also provided valuable insight into one of the most misunderstood areas of political data protection, campaign communications and voter information.
James explained that political parties operate within a unique legal framework that combines electoral legislation, UK GDPR, PECR and wider democratic engagement provisions.
This creates challenges that many organisations never encounter.
The discussion explored how political parties can lawfully access electoral register information, the distinction between democratic engagement and political marketing, and the complexities surrounding voter communications.
It also highlighted why public understanding of these processes is often limited, leading to frequent questions and complaints about how political parties obtain and use personal information.
Political opinions are classified as special category data under UK GDPR, making compliance particularly important when handling voter information and political preferences.
Election periods create unique pressures for privacy professionals.
James described how political events can trigger substantial increases in Subject Access Requests, complaints and regulatory attention.
One example discussed during the episode involved a coordinated campaign encouraging individuals to submit Subject Access Requests to political parties during a general election period.
The volume of requests created significant operational pressure at a time when political parties were already operating under intense scrutiny.
These spikes can place substantial strain on compliance teams whilst simultaneously increasing public and regulatory attention on data protection practices.
The discussion highlighted the importance of having robust procedures, clear governance and sufficient resources in place before periods of heightened activity begin.
For organisations in any sector, this serves as a useful reminder that compliance planning should account for periods of increased demand and unexpected operational pressures.
Another important takeaway from the discussion was the value of professional networks.
James explained how he worked with Data Protection Officers from other political parties to discuss common challenges and share experiences.
Despite political differences, many of the data protection issues faced by parties were remarkably similar.
The group provided an opportunity to exchange ideas, discuss regulatory developments and learn from one another’s experiences.
This reinforces a broader point that applies across every sector. Data protection can often feel isolating, particularly for individuals working in-house.
Building relationships with peers, sharing experiences and learning from others can be invaluable when dealing with complex challenges.
The Data Protection Made Easy community was created with this exact purpose in mind, bringing professionals together to discuss challenges, share knowledge and support one another.
The discussion also explored the relationship between public trust and data protection.
Political parties process significant volumes of personal information and must balance democratic engagement with individual privacy rights.
Public understanding of how electoral data is used is often limited, creating concerns around political profiling, campaign communications and voter engagement.
James highlighted the importance of transparency and helping individuals understand how and why their information is being processed.
This challenge is not unique to politics. Organisations across every sector face increasing expectations around transparency, accountability and responsible data use.
Building trust requires more than simply meeting legal requirements. It requires organisations to demonstrate that they are handling information responsibly and in ways that align with people’s expectations.
Towards the end of the discussion, the conversation shifted towards the future of data protection.
Artificial intelligence, advanced analytics, digital identity solutions and large-scale data sharing initiatives are creating new opportunities and new risks.
James argued that data protection professionals will play a critical role in helping organisations navigate these developments responsibly.
Reflecting on the future of the profession, he stated: “The importance of what we do will grow to a level of significance I don’t think we even understand properly yet.”
As organisations increasingly rely on data-driven technologies, privacy professionals will be required to balance innovation with governance, accountability and individual rights.
The conversation highlighted how the role of the Data Protection Officer continues to evolve beyond compliance alone, becoming increasingly connected to strategy, trust and organisational decision-making.
Another theme explored during the discussion was the future of individual control over personal information.
As digital services become more connected, expectations around transparency and user control are likely to increase.
James explained: “People will have more power over their data and have more agency over it.”
This vision reflects a broader shift towards empowering individuals to understand, manage and control how their personal information is used.
Whether through enhanced transparency, digital identity initiatives or improved governance frameworks, organisations are likely to face increasing expectations around giving people greater visibility and control over their information.
Whilst few organisations operate under the same level of scrutiny as a national political party, many of the lessons discussed throughout this episode apply across every sector.
Strong governance, effective stakeholder relationships, transparent regulatory engagement, practical compliance processes and a clear understanding of risk remain fundamental regardless of industry.
The discussion provided a fascinating insight into one of the most unique data protection environments in the UK whilst reinforcing principles that every organisation can learn from.
Whether managing Subject Access Requests, engaging with regulators, implementing new technologies or building trust with stakeholders, the core principles of good data protection remain the same.
For organisations looking to strengthen governance and improve compliance, our Data Protection Support Service, Outsourced DPO Service and Training and Awareness Services can help build a stronger and more resilient approach to data protection.
Yes. Political parties can access electoral register information under specific legal provisions designed to support democratic engagement and electoral processes.
Yes. Political opinions are classified as special category data under UK GDPR and require additional protections when processed.
The requirements depend on the type of communication, the recipient and the legal basis being relied upon. Political communications can involve a complex interaction between UK GDPR, PECR and electoral legislation.
Political parties process personal data to support campaigning activities, democratic engagement, membership management, constituency casework and voter communications.
The ICO regulates compliance with UK data protection legislation and can investigate complaints, issue enforcement action and provide guidance to political organisations.
Elections often involve large-scale processing of personal information, increased public scrutiny and heightened regulatory attention. Strong governance helps ensure information is handled lawfully, fairly and transparently.
We host events on a weekly basis for the community of data protection practitioners and have built up a network of over 1200 subscribers, who tune in each week to listen to discussions about the hot topics from the fast-paced and evolving world of data protection and cyber security. Check out our upcoming events and become part of our growing community.
View AllOur mission is to make data protection and cyber security easy: easy to understand and easy to do. We do that through the mantra of benchmark, improve, maintain.
