Discover the comprehensive range of data protection services at Data Protection People. Tailored to meet the unique needs of your organisation, our expert team has successfully handled every challenge imaginable. Whether you’re navigating compliance complexities or enhancing data security, trust DPP to be your partner in safeguarding information.
Explore our Subject Access Request (SAR) Handling Service and understand how Data Protection People can support your organisation
Contact Us
Data Protection People's world-class GDPR Support Desk. If you're navigating the complex landscape of data protection, PCI DSS, and cybersecurity, our support desk is your reliable compass.
Contact Us
A data protection officer doesn't have to be a full time employee and in many respects it's better to have a company like DPP take on the role. Watch the video below to find out more about our outsourced DPO and privacy officer services or reach out and get in touch with us.
Contact Us
A range of high level reviews, detailed audits and mid-range assessments to test compliance with data protection laws and standards
Contact UsAt Data Protection People, our cyber security services are designed to fortify your digital defences. With a proven track record spanning diverse sectors in the UK, our seasoned team brings a wealth of experience in handling a wide array of cybersecurity challenges. Reach out to us and explore how DPP can enhance your organisation’s cyber resilience.
A PCI assessment is an audit for validating compliance with the Payment Card Industry Data Security Standard (PCI DSS), a set of security standards for merchants who accept, process, store or transmit credit card information.
Contact Us
A PCI assessment is an audit for validating compliance with the Payment Card Industry Data Security Standard (PCI DSS), a set of security standards for merchants who accept, process, store or transmit credit card information.
Contact Us
Our experts can support you with Dark Web Monitoring - Data Protection People offer a free dark web scan for your organisation.
Contact Us
A PCI assessment is an audit for validating compliance with the Payment Card Industry Data Security Standard (PCI DSS), a set of security standards for merchants who accept, process, store or transmit credit card information.
Contact Us
At Data Protection People, we recognise the dynamic challenges and unique responsibilities of the Data Protection Officer (DPO) role. Beyond offering standard support, we provide a comprehensive suite of services crafted to empower DPOs at every step.
Collaborative Community: Navigating the intricate landscape of data protection can be isolating. That’s why we’ve fostered a collaborative community of privacy professionals. As a DPO with us, you’re never alone. Our network serves as a forum for insightful discussions, sharing solutions, and building a sense of camaraderie.
Expert Guidance and Advice: The journey of a DPO is often filled with complex decisions. Our seasoned team of experts is your reliable resource, offering timely advice and strategic guidance. We’re not just a service provider; we’re your dedicated partners in overcoming challenges and making informed decisions.
Advanced Training for Continuous Growth: Stay ahead in your role with our advanced training programs. Tailored for DPOs, our courses delve into intricate aspects of data protection, providing you with a competitive edge. It’s not just about meeting the present challenges but ensuring your continuous growth and excellence in your role.
Audits, Assessments, and Document Reviews: Our services extend beyond conventional boundaries. From comprehensive audits and assessments to meticulous document reviews, we ensure that your data protection strategies are not only compliant but also optimised for efficiency.
Simplifying Complexity for Future Ease: Beyond addressing current challenges, our mission is to simplify the complexities inherent in data protection. By partnering with Data Protection People, you’re not just solving problems – you’re ensuring a smoother, more efficient role in the future. We streamline processes, making your responsibilities more manageable and your decisions more impactful.
At Data Protection People, our expertise spans across diverse sectors, ensuring that businesses of all sizes and orientations receive tailored Data Protection and Cyber Security solutions. From the dynamic commercial sector and agile SMEs to the impactful third sector and expansive multi-nationals, we extend our services to fortify the digital defences of every business entity.
Elevate your data protection and cybersecurity standards in the bustling landscape of the Commercial Sector. We offer tailored solutions designed to safeguard your sensitive information, ensuring compliance and resilience against evolving threats. Partner with us to fortify your digital assets and foster a secure environment for sustained growth.
Small and Medium Enterprises (SMEs) form the backbone of innovation. Our data protection and cybersecurity services are crafted to match the agility of SMEs. Navigate the digital landscape securely, optimize your operations, and scale confidently with our tailored solutions that prioritize your unique business needs.
For organisations in the Third Sector driven by purpose, our data protection and cybersecurity expertise align with your mission. Safeguard sensitive data, build stakeholder trust, and amplify your positive impact. Let our solutions be the backbone of your technology infrastructure, ensuring that your focus remains on making a difference.
For the global footprint of Multi Nationals, our data protection and cybersecurity services provide a comprehensive shield. Navigate the complexities of international regulations with confidence. From compliance strategies to threat intelligence, we've got your data security needs covered, empowering your multinational endeavors with resilience.
In the Public Sector, trust and accountability are paramount. Our data protection and cybersecurity consultancy ensures that your operations align seamlessly with regulatory requirements. From confidential citizen data to streamlined governance, our solutions empower public entities to serve with integrity and technological excellence.
Data Protection People have the UK’s #1 Data Protection Podcast with over 250 episodes available across all audio streaming platforms, we also post regular content designed to simplify complex areas of data protection and cyber security, check out some of the podcasts and articles below and make data protection easy today.
Under Article 30 of the UK GDPR, organisations acting as data controllers or processors generally need to maintain records of their processing activities (RoPA). It applies to organisations of different sizes, but if you have fewer than 250 employees, then you may be exempt.
Both data controllers and data processors have RoPA obligations under Article 30; however, the records they maintain differ.
Data controllers are organisations that decide why and how personal data is processed, e.g. a retailer or employer. Their records document their processing purposes, categories of data subjects and personal data, recipients, retention periods and security measures.
Data processors are organisations that process data on behalf of a controller, e.g. payroll software or an email marketing agency. Their records cover the categories of processing carried out for each controller, as well as other Article 30 requirements.
Organisational size or industry does not dictate whether you need to maintain a RoPA; instead, your data processing activity does.
Yes. Small businesses often need to maintain a Record of Processing Activities, as size alone does not automatically grant an exemption. Some may be exempt in limited circumstances, but having fewer than 250 employees doesn’t necessarily remove the requirement for a RoPA.
If your processing activities fall under any of these conditions, you are required to maintain a RoPA:
Maintaining a RoPA can be good practice, even if your organisation qualifies for an exemption. There are several benefits, including:
It can also make it easier to respond to data subject access requests and demonstrate compliance when required.
If you’re unsure about your obligations to maintain a RoPA, then get in touch. At Data Protection People, we offer ongoing data protection guidance, specialist outsourced support and training on maintaining records so we can tailor support where you need it most.
Charities and schools need a RoPA if they meet the requirements. This could be processing data such as employee records, donor information, pupil data and safeguarding information.
Micro-organisations are not automatically exempt because of their size. The exemption for organisations with fewer than 250 employees depends on whether processing is occasional, poses a risk to individuals or involves special category or criminal offence data.
Yes, an organisation can act as a controller for some processing activities and a processor for others. For example, a business may control how it uses its employees’ information while processing customer data on behalf of another business.
RoPA stands for Record of Processing Activities. It is a document that a business or organisation maintains to record how it collects, uses, stores and shares personal data. It is a legal requirement under UK GDPR.
To start creating an effective RoPA, you must assess your resources. Are you able to use a tool or will you be using a spreadsheet? Who will manage the RoPA and how?
Your RoPA should be fit for your business, easy to maintain and understand. Ideally, it shouldn’t be granular, but not too in-depth; otherwise, you may end up with thousands of entries that are impossible to maintain correctly or efficiently.
You should also have stakeholder buy-in from your organisation’s leadership to establish a top-down security culture.
The core elements required in a RoPA depend on whether your organisation is a data controller or a data processor.
| Element | Description |
| Contact details | The name and contact details of your organisation, your joint controller, representative and Data Protection Officer. |
| Purposes of processing | A clear description of the reason why you are collecting and processing the personal data. |
| Categories of data subjects | The groups of people whose data you collect, e.g. employees, customers and suppliers. |
| Categories of personal data | The types of data being processed, e.g. names, financial data and health records. |
| Categories of recipients | Anyone who receives or will receive the data, including third-party processors, partners or other authorities |
| International data transfers | Details of any data transferred outside the EU/EEA, including the name of the country or international organisation, and the documentation of security safeguards. |
| Retention periods | The time limits for erasing the different categories of data. |
| Technical and organisational security measures | A general description of the security safeguards in place to protect the data. |
Data processors are required to maintain records on behalf of all data processed for the controller, including:
| Element | Description |
| Contact details | The name and contact information of the processor, each controller you work for and your DPO, if applicable. |
| Categories of processing | The types of processing operations carried out on behalf of each controller. |
| International data transfers | Details of data transfers outside the EU/EEA. |
| Technical and organisational security measures | A general description of your security safeguards. |
There is no specific format mandated for RoPAs. However, Article 30 of the GDPR states that a RoPA must be in writing. This can be in paper or electronic form, though most organisations will benefit from an electronic RoPA as it is easier to maintain.
If you’re using a spreadsheet, use tabs, standardised dropdowns and granular rows to keep things clear, consistent and clean.
RoPAs should be reviewed at least annually, as well as whenever there is a change in how your organisation processes data. The information should be kept up to date, ready to present to regulatory authorities at any given moment.
At Data Protection People, we can support you in a number of ways. Whether you’re looking for RoPA training for your in-house team, general GDPR support or you’re in need of a DPO, we’re here to make RoPAs simple and easy. Get in touch with the team today.
China’s Supreme People’s Court (SPC) issued guidance on handling disputes involving artificial intelligence on 7 September 2026. The guidance provides a framework for applying existing laws to AI-related disputes, particularly where AI systems have caused harm. It addresses personality rights, the processing of personal data, intellectual property, consumer protection and AI-generated content.
In my view, the most significant aspect of this guidance is not the specific liability rules themselves, but the use of judicial guidance to address AI-related disputes while China has not yet enacted a dedicated AI law.
AI technology is developing at a pace that often exceeds the speed of legislative processes. A comprehensive AI law may require frequent amendments as new technologies, risks and use cases emerge. Guidance that helps courts apply existing legal principles can provide greater flexibility while still promoting consistency in decision-making.
This does not mean judicial guidance replaces future AI legislation. Rather, it provides courts with a framework for applying the laws already in place.
The SPC’s approach appears to recognise that AI governance remains an evolving area. Rather than attempting to create rules for every possible future scenario, the guidance focuses on how existing legal concepts, such as fault and foreseeability, should be applied in an AI context. This allows courts to adapt their analysis as technology develops without requiring lawmakers to constantly revise legislation.
Another notable feature is the guidance’s clarification that fault-based liability applies to AI-related harms where existing law does not expressly provide for no-fault liability or presumed-fault liability. It is therefore a general approach, rather than a rule that applies to every AI-related claim.
When assessing fault, courts should consider factors including the specific application of the AI system, its degree of autonomy, technological and informational transparency, potential risks and their scope, preventative measures, and the relevant parties’ ability to foresee and control harm.
In my view, this reflects a balanced approach. It seeks to hold organisations accountable where appropriate while avoiding excessive liability that could discourage innovation.
However, the practical application of fault-based liability may present challenges. One of these is the increasing complexity of modern AI systems. Some AI technologies, particularly those designed to adapt through ongoing interactions and feedback, may evolve in ways that are not entirely predictable.
While developers are expected to identify foreseeable risks and implement appropriate safeguards, there may be circumstances where harmful outcomes arise despite reasonable testing and governance measures.
The guidance itself identifies technological transparency, the ability to foresee harm and the capacity to control risks as relevant factors when assessing fault. However, where an AI system produces an unexpected outcome based on patterns learned from large volumes of data, establishing whether a developer, provider or user acted negligently may become significantly more difficult.
In such cases, courts may need to assess not only what harm occurred, but also whether the organisation took reasonable steps to identify and manage risks beforehand.
The distinction between an unforeseeable AI outcome and a failure to implement appropriate controls may become one of the most important issues in future AI litigation.
The guidance also highlights the importance of evidence. For example, in certain copyright disputes, developers defending an infringement claim may be required to provide information about training data sources, training records and how the model operates.
More broadly, organisations should consider maintaining appropriate records relating to training data, model development, testing processes, risk assessments and complaint handling. These records may become important evidence of the measures taken to prevent harm and comply with applicable legal obligations.
This is a practical governance consideration, rather than a blanket record-keeping requirement imposed by the guidance for every AI system.
Overall, China’s approach offers an interesting example of using judicial guidance alongside existing legislation to address AI-related disputes. It provides a framework that can develop through judicial practice while promoting greater consistency for courts and organisations.
That being said, future cases may test the limits of fault-based liability where AI systems behave in ways that are difficult to predict or explain.
As AI technology becomes increasingly sophisticated, courts may need to further develop principles around foreseeability, accountability and the standard of care expected from developers and deployers of AI systems.
Source: Supreme People’s Court guidance on AI-related disputes, published 7 September 2026 (Chinese-language original).
AI redaction tools can save time on subject access requests (SARs). They scan large sets of documents, find personal information and suggest what to hide before a response goes out. What they cannot do is take responsibility for the result. They can miss information about other people or hide information the requester is entitled to. A trained person still needs to check the output before anything is sent.
An AI redaction tool is software that finds personal information in documents and removes it or flags it for review. Tools commonly look for patterns such as names, email addresses, phone numbers and account numbers. Some also try to read context, for example spotting that “my manager” refers to a specific person. Capabilities vary, so test the actual product against representative documents.
In a SAR, redaction can protect information that should not be disclosed while allowing the requester to receive their own personal data. Third-party information is not automatically withheld: consider whether that person consents or disclosure without consent is reasonable. Other exemptions may also apply, and each decision needs a reason.
The slowest part of a large SAR is often the volume. An employee request can pull in thousands of emails, chat messages and attachments. Reading every page by hand can take weeks.
AI tools can help with repetitive work:
Used this way, the tool does the first pass and a person makes the decisions.
Automated systems work from patterns. Real documents do not always follow them. Common gaps include:
These limitations do not mean AI tools cannot be used safely. They mean their output needs checking.
Under-redaction means information that should have been withheld goes out by mistake. That can be a personal data breach and may put someone at risk, for example in an employment dispute or safeguarding case.
Over-redaction means hiding information the requester is entitled to. Blacking out whole pages “to be safe” can leave the response incomplete and lead to complaints.
The ICO explains the balancing exercise in its guidance on information about other people in a SAR. A tool can flag information, but a person has to assess whether disclosure is appropriate.
The controller answering the SAR stays responsible for the response, whatever tool it uses.
Open an exported copy as the recipient would. Try searching for redacted names and copying text near redactions. Inspect comments, tracked changes, hidden spreadsheet content and document properties. Confirm the correct recipient and attachments have been selected. These checks complement the substantive review; a clean-looking PDF is not proof that every disclosure decision is right.
Yes. AI tools can support SAR redaction, but the organisation remains responsible. A trained person should review suggestions and the final documents before they are sent.
No. The time limit is the same whatever tools you use. It is usually one month, with an extension only where the legal conditions are met. See our step-by-step SAR response guide.
Sending personal data to the wrong person can be a personal data breach. Assess and document the incident promptly. A controller must notify the regulator without undue delay and, where feasible, within 72 hours of awareness unless the breach is unlikely to risk people’s rights and freedoms. A processor must notify its controller without undue delay. A high risk may also require notification to affected people.
No. Over-redaction can withhold information the requester is entitled to. Make and document a reasoned decision rather than applying a blanket rule.
Listen to S2 Ep35 of Data Protection Made Easy for the discussion behind this article. If a large or difficult SAR is landing on your desk, our SAR support team can help with review and redaction. You can also read our guide to SAR redaction services.
Content reviewed: 2 October 2026.
Can AI help you write a Data Protection Impact Assessment? And how do you assess the privacy risks of the AI system itself?
In S2 Ep38 of Data Protection Made Easy, Caine Glancy and Catarina Santos (Cate) explore both sides of the conversation: carrying out DPIAs for AI projects and using AI to help prepare an assessment.
Join Cate and Caine for a practical discussion about making informed decisions, checking assumptions and keeping people involved in the assessment process.
Watch the Full Episode on YouTube
Listen to the Full Episode on Spotify
Our free Friday sessions bring people together to discuss data protection topics, share practical advice and ask questions.
Our DPIA service helps you identify and assess privacy risks in new projects, systems or processes. We work with your team to document the assessment and recommend practical measures to reduce risks and support informed decisions.
Contact Data Protection People
Financial services businesses face overlapping responsibilities. How do they bring financial regulation and data protection together in practice?
In the first episode of Sector Spotlight, DPP’s Mark Farrell joins Phillip Garlick, CEO of Product Partnerships Limited (PPL), to discuss the relationship between FCA requirements and UK GDPR.
Created as part of the partnership between Data Protection People and PPL, this episode brings together perspectives on data protection, retail finance and the practical realities of running a regulated business.
Our promotional clips explore financial promotions, whether good compliance can support business growth, the cost of compliance in the financial sector, and AI’s promise and peril in data protection.
Watch or listen to the full episode to hear the wider conversation with Mark and Phillip.
Phillip is the CEO of Product Partnerships Limited, which delivers retail financial solutions and compliance support to consumer-facing businesses. PPL helps these firms offer finance to their customers and manage the regulatory responsibilities that come with it.
He has over 30 years’ experience in regulated, consumer-facing sectors, with a strong focus on governance, risk management and sustainable growth.
Phillip is a practising Chartered Director and Fellow of the Institute of Directors. He holds an Advanced Certificate in Governance & Risk from the International Compliance Association and an MBA from Leeds University.
Sector Spotlight is a separate series within Data Protection Made Easy, exploring data protection through conversations focused on particular sectors. This is episode 1 of the series, rather than an episode in our regular Season 2 numbering.
Watch the Full Episode on YouTube
Listen to the Full Episode on Spotify
If your organisation needs help navigating its data protection responsibilities, speak to our team about the support available.
Contact Data Protection People
Cate and Caine are back together on GDPR Radio, and Cate marks the occasion with a little singing before the conversation gets underway.
In S2 Ep36 of Data Protection Made Easy, Caine Glancy and Catarina Santos catch up on data protection news and share practical perspectives on what it means for organisations.
Expect a friendly discussion, familiar faces and plenty of conversation about the world of data protection.
Watch the Full Episode on YouTube
Listen to the Full Episode on Spotify
Our free Friday sessions bring people together to discuss data protection topics, share practical advice and ask questions.
If your organisation needs help with a data protection question or challenge, speak to our team about the support available.
Contact Data Protection People
AI redaction tools promise to make handling subject access requests easier. But what might they miss?
In S2 Ep35 of Data Protection Made Easy, Amber Sivill and Katerina Douni discuss AI redaction tools and the challenges organisations face when using them to support SAR responses.
Join them for a practical conversation about technology, redaction and the importance of checking information before it is shared.
Watch the Full Episode on YouTube
Listen to the Full Episode on Spotify
Our free Friday sessions bring people together to discuss data protection topics, share practical advice and ask questions.
If your organisation needs help managing subject access requests or reviewing its redaction process, speak to our team about the support available.
Contact Data Protection People
We host events on a weekly basis for the community of data protection practitioners and have built up a network of over 1,700 subscribers. Members receive weekly invites, exclusive offers, early access to selected content, our monthly newsletter, and first access to in-person events. Check out our upcoming events and become part of our growing community.
View AllOur mission is to make data protection and cyber security easy: easy to understand and easy to do. We do that through the mantra of benchmark, improve, maintain.
