Discover the comprehensive range of data protection services at Data Protection People. Tailored to meet the unique needs of your organisation, our expert team has successfully handled every challenge imaginable. Whether you’re navigating compliance complexities or enhancing data security, trust DPP to be your partner in safeguarding information.
Explore our Subject Access Request (SAR) Handling Service and understand how Data Protection People can support your organisation
Contact Us
Data Protection People's world-class GDPR Support Desk. If you're navigating the complex landscape of data protection, PCI DSS, and cybersecurity, our support desk is your reliable compass.
Contact Us
A data protection officer doesn't have to be a full time employee and in many respects it's better to have a company like DPP take on the role. Watch the video below to find out more about our outsourced DPO and privacy officer services or reach out and get in touch with us.
Contact Us
A range of high level reviews, detailed audits and mid-range assessments to test compliance with data protection laws and standards
Contact UsAt Data Protection People, our cyber security services are designed to fortify your digital defences. With a proven track record spanning diverse sectors in the UK, our seasoned team brings a wealth of experience in handling a wide array of cybersecurity challenges. Reach out to us and explore how DPP can enhance your organisation’s cyber resilience.
A PCI assessment is an audit for validating compliance with the Payment Card Industry Data Security Standard (PCI DSS), a set of security standards for merchants who accept, process, store or transmit credit card information.
Contact Us
A PCI assessment is an audit for validating compliance with the Payment Card Industry Data Security Standard (PCI DSS), a set of security standards for merchants who accept, process, store or transmit credit card information.
Contact Us
Our experts can support you with Dark Web Monitoring - Data Protection People offer a free dark web scan for your organisation.
Contact Us
A PCI assessment is an audit for validating compliance with the Payment Card Industry Data Security Standard (PCI DSS), a set of security standards for merchants who accept, process, store or transmit credit card information.
Contact Us
At Data Protection People, we recognise the dynamic challenges and unique responsibilities of the Data Protection Officer (DPO) role. Beyond offering standard support, we provide a comprehensive suite of services crafted to empower DPOs at every step.
Collaborative Community: Navigating the intricate landscape of data protection can be isolating. That’s why we’ve fostered a collaborative community of privacy professionals. As a DPO with us, you’re never alone. Our network serves as a forum for insightful discussions, sharing solutions, and building a sense of camaraderie.
Expert Guidance and Advice: The journey of a DPO is often filled with complex decisions. Our seasoned team of experts is your reliable resource, offering timely advice and strategic guidance. We’re not just a service provider; we’re your dedicated partners in overcoming challenges and making informed decisions.
Advanced Training for Continuous Growth: Stay ahead in your role with our advanced training programs. Tailored for DPOs, our courses delve into intricate aspects of data protection, providing you with a competitive edge. It’s not just about meeting the present challenges but ensuring your continuous growth and excellence in your role.
Audits, Assessments, and Document Reviews: Our services extend beyond conventional boundaries. From comprehensive audits and assessments to meticulous document reviews, we ensure that your data protection strategies are not only compliant but also optimised for efficiency.
Simplifying Complexity for Future Ease: Beyond addressing current challenges, our mission is to simplify the complexities inherent in data protection. By partnering with Data Protection People, you’re not just solving problems – you’re ensuring a smoother, more efficient role in the future. We streamline processes, making your responsibilities more manageable and your decisions more impactful.
At Data Protection People, our expertise spans across diverse sectors, ensuring that businesses of all sizes and orientations receive tailored Data Protection and Cyber Security solutions. From the dynamic commercial sector and agile SMEs to the impactful third sector and expansive multi-nationals, we extend our services to fortify the digital defences of every business entity.
Elevate your data protection and cybersecurity standards in the bustling landscape of the Commercial Sector. We offer tailored solutions designed to safeguard your sensitive information, ensuring compliance and resilience against evolving threats. Partner with us to fortify your digital assets and foster a secure environment for sustained growth.
Small and Medium Enterprises (SMEs) form the backbone of innovation. Our data protection and cybersecurity services are crafted to match the agility of SMEs. Navigate the digital landscape securely, optimize your operations, and scale confidently with our tailored solutions that prioritize your unique business needs.
For organisations in the Third Sector driven by purpose, our data protection and cybersecurity expertise align with your mission. Safeguard sensitive data, build stakeholder trust, and amplify your positive impact. Let our solutions be the backbone of your technology infrastructure, ensuring that your focus remains on making a difference.
For the global footprint of Multi Nationals, our data protection and cybersecurity services provide a comprehensive shield. Navigate the complexities of international regulations with confidence. From compliance strategies to threat intelligence, we've got your data security needs covered, empowering your multinational endeavors with resilience.
In the Public Sector, trust and accountability are paramount. Our data protection and cybersecurity consultancy ensures that your operations align seamlessly with regulatory requirements. From confidential citizen data to streamlined governance, our solutions empower public entities to serve with integrity and technological excellence.
Data Protection People have the UK’s #1 Data Protection Podcast with over 250 episodes available across all audio streaming platforms, we also post regular content designed to simplify complex areas of data protection and cyber security, check out some of the podcasts and articles below and make data protection easy today.
The ICO has approved a UK GDPR code of conduct for information sharing between public services in Wales. The Wales Accord on the Sharing of Personal Information (WASPI) code was approved on 24 September 2026 and announced on 28 September 2026.
WASPI is an existing framework that helps organisations in Wales share personal information safely. More than 1,000 organisations are already signed up to it, according to the ICO.
Its new code of conduct has now been approved under Article 40 of the UK GDPR. A code of conduct is a set of sector rules, approved by the regulator, that shows how data protection law applies in practice. Members who follow an approved code have a recognised way to show accountability. The ICO’s Chris Hogan described it as “a clear and recognised way to demonstrate accountability”.
The key facts, from the ICO’s register of codes:
The code covers sharing personal information to deliver health, education, social care, safeguarding and other public services to people in Wales.
Code members must:
The code applies to organisations that share personal information to deliver public services in Wales and choose to sign up. That includes:
The code concerns information sharing for services to people in Wales. An organisation’s address alone does not decide eligibility: check the code’s membership criteria with WASPI, particularly for cross-border arrangements. Organisations elsewhere can still use its approach as a prompt to review their own practices.
Sharing information between services is where data protection often goes wrong. Some staff hold back information that should be shared, for example in a safeguarding case. Others share without a clear lawful basis or a written agreement.
A code gives everyone the same template and the same checks. That makes it easier for staff to share with confidence and easier for organisations to prove they got it right.
No. A code supports accountability; it does not supply a lawful basis for every disclosure or remove your responsibility to assess each sharing arrangement. Record the purpose, lawful basis, safeguards and responsibilities before sharing.
If you work in Wales and already use WASPI:
If you work in Wales and don’t use WASPI:
If you work elsewhere in the UK:
For one-off requests, such as from the police, see our guide to ad-hoc data sharing requests.
We support local authorities and schools, academies and colleges with data sharing agreements, DPIAs and day-to-day data protection advice. If you’d like a review of your information sharing arrangements, talk to our team about the support you need.
Discuss your information sharing arrangements
WASPI entry in the ICO’s register of approved codes
Regulator announcement, 28 September 2026
Content reviewed: 2 October 2026.
The short answer: Since 1 October 2026, private registered providers of social housing in England must have a STAIRs publication scheme. It covers information they hold about governance, spending, homes, performance, services, registers and housing management. Providers do not have to create new records. Appropriate redaction is allowed. The separate requirements for tenant information requests begin on 1 April 2027.
A publication scheme explains what information your organisation makes available routinely and where tenants can find it. They should not have to make a formal request to understand how you run homes and services.
The government’s STAIRs policy statement sets out the requirements. STAIRs now forms part of the Regulator of Social Housing’s Transparency, Influence and Accountability Standard.
For the wider background, read STAIRs: What Housing Associations Need to Know. This article focuses on the publication scheme itself.
The requirements apply to private registered providers of social housing in England. This includes housing associations. The policy does not provide a general exemption for small providers.
Local authority landlords are already subject to the Freedom of Information Act. Do not assume STAIRs applies to every housing organisation across the UK. Check your registration and the services you provide.
Your scheme must cover information you hold within seven areas. The examples below help you identify existing material. They are not a substitute for checking the policy statement.
Explain who runs the organisation and how decisions are made. Examples include senior staff roles, governance arrangements, decision-making policies and information about tenant consultations.
Show how money is used. Existing financial reports, grant information and explanations of how service charge revenue is spent can help cover this area.
Include information about managing and maintaining homes. Examples include maintenance plans, stock transfers and progress towards net zero.
Help tenants understand how services are performing. Examples include inspection outcomes, Tenant Satisfaction Measures, complaint figures, health and safety assessments and maintenance performance.
Describe the services tenants can use. Link to existing advice, guidance and service information, including how tenants can access support.
Review information held in legally required registers and other lists relating to social housing management. Assess what can reasonably be published without exposing protected information.
Include policies and strategies for managing social housing. Your existing housing management policies may already provide much of this information.
You do not have to create new records. Start with information your organisation already holds. This does not remove the need to identify it and make it accessible.
You do not have to publish every document without checks. Appropriate and reasonable redaction is permitted. Record why information is withheld and apply the policy statement’s safeguards.
It is not a one-off upload. Providers must review and update the information regularly. Assign an owner and choose a review cycle that fits your organisation.
Tenants must be able to identify and access the information. These five practical steps can help:
These are implementation suggestions. A particular page layout or quarterly review cycle is not prescribed by the policy statement.
If your scheme is not ready, start by identifying the gaps. Keep a clear record of your actions and who is responsible for them.
If you need help identifying gaps, explore our STAIRs Readiness Assessment.
Transparency does not mean publishing personal information without a lawful reason. Review documents for names, contact details, complaint information and details that could identify a tenant indirectly.
Do not automatically remove every name. Some information, such as senior staff roles, may be appropriate to publish. Assess the purpose and legal basis for each disclosure.
Where redaction is needed, remove the information securely. Check comments, tracked changes, hidden data and searchable text. A coloured box over text may leave the underlying information accessible.
Keep a record of decisions and have someone check the final public version. Our STAIRs housing FAQs cover further practical questions.
A STAIRs request concerns relevant information about the management of social housing. A subject access request (SAR) concerns a person’s own personal data.
For example, a request for a repairs policy is different from a request for personal information in a tenant’s repair records. One message may contain both.
Assess each part and route it correctly. The STAIRs policy directs providers towards the appropriate statutory route where a separate legal right of access applies. Do not apply the STAIRs 18-hour limit to a SAR.
The ICO’s right of access guidance explains the separate SAR requirements.
From 1 April 2027, tenants or their designated representatives can make written requests for relevant information. Providers should acknowledge them promptly.
The publication scheme has its own review and escalation route already. Do not wait until April 2027 to explain how tenants can raise missing information.
For earlier sector context, see our STAIRs update for housing associations.
The publication-scheme requirements apply from 1 October 2026 to private registered providers of social housing in England.
No. The publication scheme covers information already held. Providers still need to identify relevant information and make it accessible.
Yes, where appropriate and reasonable. Apply the policy statement’s safeguards, assess personal data carefully and record the reasons for redaction.
The separate information-request requirements begin on 1 April 2027. Providers must respond promptly, normally within 30 calendar days of receipt.
Tenants should first use their provider’s STAIRs review process. If dissatisfied with the review, they can escalate to the Housing Ombudsman under its Scheme.
No. STAIRs is a separate framework for private registered providers. It supports tenant access to housing management information but does not make those providers subject to FOI simply because STAIRs applies.
Need help reviewing your publication scheme or preparing your team for information requests? We can help you work through information rights and data protection questions.
Speak to our team about Information Rights Support.
External Attack Surface Management, usually shortened to EASM, is the continuous discovery and monitoring of everything your organisation exposes to the internet, domains, subdomains, cloud services, servers and applications, including the ones nobody currently has on a list.
Your external attack surface is every point an attacker could potentially reach from outside your network. That includes the systems your IT team knows about and manages deliberately, but it also includes things that accumulate without anyone fully tracking them, a test server spun up for a project and never decommissioned, a marketing microsite built by an agency years ago, a cloud storage bucket set up for a one-off task, a subdomain nobody remembers creating. None of these are necessarily malicious or even risky on their own, but each one is a potential entry point, and you can’t secure what you don’t know exists.
Penetration testing and vulnerability scanning both work against a defined, known scope, systems you’ve already identified and agreed to test. EASM works the other way round, it starts from the outside, mapping what’s actually visible on the internet under your organisation’s name, and works to identify assets you may not have deliberately included in any existing security process at all. It’s the discovery layer that should logically come before testing, since a pentest against a scope that’s missing half your real exposure only gives you confidence in the part you already knew about.
EASM tools and services continuously scan public sources, DNS records, certificate transparency logs, IP ranges and cloud provider metadata, to build and maintain a live map of everything associated with your organisation that’s reachable from outside. That map gets checked for common exposure issues, out of date software, exposed admin panels, misconfigured cloud storage, expired certificates and anything genuinely concerning gets flagged for investigation. Because it’s continuous rather than a one-off exercise, new exposure gets caught close to when it appears, not months later during the next scheduled review.
Organisations’ external footprints have grown substantially with the shift to cloud services, third-party tools and distributed teams who can spin up new infrastructure without necessarily going through a central IT process. That’s not a criticism of how modern organisations operate, it’s simply a consequence of how much easier it now is to stand up a new service, and it means the gap between what security teams officially track and what’s actually exposed has grown alongside it. EASM exists specifically to close that gap.
How is this different from just asking IT for a list of our systems? An internally maintained list only ever reflects what was deliberately recorded, and in practice things get missed, a project ends, a subdomain stays live, a cloud account gets set up outside the usual process. EASM discovers assets independently of any internal list, which is exactly the point, it finds what the list doesn’t know about.
Is this a one-off exercise or does it need to run continuously? It works best as continuous monitoring rather than a single scan, since new external assets appear constantly as an organisation operates. A one-off discovery exercise gives you an accurate picture on the day it runs, but that picture starts going out of date almost immediately.
What happens once something unexpected is found? Typically the finding gets triaged, confirmed as genuinely belonging to your organisation, assessed for how exposed or risky it actually is, and then either brought under proper management or decommissioned if it’s no longer needed. Not everything found is a problem, some of it is simply forgotten infrastructure that just needs tidying up.
Do we need this if we already do regular penetration testing? The two work together rather than replacing each other. A pentest assesses depth against an agreed, known scope. EASM addresses breadth, finding what should be in scope in the first place. Testing against an incomplete scope only ever gives you confidence in the part you already knew about.
It’s particularly valuable for organisations of meaningful size or with a history of mergers, acquisitions, agency-built projects, or multiple teams independently provisioning their own infrastructure, all situations where an accurate, centrally held inventory of external assets is unlikely to exist without deliberate effort. Even smaller organisations benefit from an initial discovery exercise, since the honest answer to “do you know everything your organisation exposes to the internet” is very often no, and finding that out is the necessary first step before any other security work can be properly scoped.
If you want an accurate picture of what your organisation actually exposes to the outside world, our External Attack Surface Management service is built to find out.
Generative AI tools like ChatGPT, Microsoft Copilot and Gemini can be used in schools under UK GDPR if used safely and effectively, with appropriate data protection policies in place.
To remain GDPR-compliant, schools should avoid using free versions of generative AI tools, as they may lack the necessary safety features. Instead, schools should use enterprise tools integrated into a broader workspace of educational tools, such as Copilot in Microsoft 365 or Gemini in Google Workspace.
Generative AI tools themselves don’t pose data protection risks; the risks depend on how they are used. These include:
Before using generative AI for any activity, schools should consult their appointed Data Protection Officer (DPO). A DPO can review the chosen AI tool(s), ensure that appropriate data policies are in place and advise staff on how to use them effectively.
The ICO requires a Data Protection Impact Assessment (DPIA) before using AI in high-risk processing activities, including any use of AI involving children’s personal data. A DPIA should outline how the data is processed and its purpose, assess necessity and identify and mitigate risks.
Government advice recommends that personal data not be used in generative AI tools in educational settings.
If it is necessary for schools to use personal data in AI tools, they must:
Government advice further recommends that staff members only use AI tools provided by their institution. This is likely to include:
These paid tools keep data within a managed school environment, don’t use data to train public AI models and respect existing security and privacy controls.
Data protection training can help staff understand UK GDPR compliance and what constitutes a data breach. Staff must understand what data should never be entered into AI tools and which AI platforms are approved for work use.
Generative AI can transform education, but it must be balanced with the responsibility to protect personal data and meet GDPR requirements.
At Data Protection People, we have extensive experience working with the education sector and can help schools implement generative AI securely. From outsourced DPO services to ongoing data protection advice, we can ensure your use of AI is compliant. Contact us today to understand how we can support you.
Can AI help you write a Data Protection Impact Assessment? And how do you assess the privacy risks of the AI system itself?
In S2 Ep38 of Data Protection Made Easy, Caine Glancy and Catarina Santos (Cate) explore both sides of the conversation: carrying out DPIAs for AI projects and using AI to help prepare an assessment.
Join Cate and Caine for a practical discussion about making informed decisions, checking assumptions and keeping people involved in the assessment process.
Watch the Full Episode on YouTube
Listen to the Full Episode on Spotify
Our free Friday sessions bring people together to discuss data protection topics, share practical advice and ask questions.
Our DPIA service helps you identify and assess privacy risks in new projects, systems or processes. We work with your team to document the assessment and recommend practical measures to reduce risks and support informed decisions.
Contact Data Protection People
Financial services businesses face overlapping responsibilities. How do they bring financial regulation and data protection together in practice?
In the first episode of Sector Spotlight, DPP’s Mark Farrell joins Phillip Garlick, CEO of Product Partnerships Limited (PPL), to discuss the relationship between FCA requirements and UK GDPR.
Created as part of the partnership between Data Protection People and PPL, this episode brings together perspectives on data protection, retail finance and the practical realities of running a regulated business.
Our promotional clips explore financial promotions, whether good compliance can support business growth, the cost of compliance in the financial sector, and AI’s promise and peril in data protection.
Watch or listen to the full episode to hear the wider conversation with Mark and Phillip.
Phillip is the CEO of Product Partnerships Limited, which delivers retail financial solutions and compliance support to consumer-facing businesses. PPL helps these firms offer finance to their customers and manage the regulatory responsibilities that come with it.
He has over 30 years’ experience in regulated, consumer-facing sectors, with a strong focus on governance, risk management and sustainable growth.
Phillip is a practising Chartered Director and Fellow of the Institute of Directors. He holds an Advanced Certificate in Governance & Risk from the International Compliance Association and an MBA from Leeds University.
Sector Spotlight is a separate series within Data Protection Made Easy, exploring data protection through conversations focused on particular sectors. This is episode 1 of the series, rather than an episode in our regular Season 2 numbering.
Watch the Full Episode on YouTube
Listen to the Full Episode on Spotify
If your organisation needs help navigating its data protection responsibilities, speak to our team about the support available.
Contact Data Protection People
Cate and Caine are back together on GDPR Radio, and Cate marks the occasion with a little singing before the conversation gets underway.
In S2 Ep36 of Data Protection Made Easy, Caine Glancy and Catarina Santos catch up on data protection news and share practical perspectives on what it means for organisations.
Expect a friendly discussion, familiar faces and plenty of conversation about the world of data protection.
Watch the Full Episode on YouTube
Listen to the Full Episode on Spotify
Our free Friday sessions bring people together to discuss data protection topics, share practical advice and ask questions.
If your organisation needs help with a data protection question or challenge, speak to our team about the support available.
Contact Data Protection People
AI redaction tools promise to make handling subject access requests easier. But what might they miss?
In S2 Ep35 of Data Protection Made Easy, Amber Sivill and Katerina Douni discuss AI redaction tools and the challenges organisations face when using them to support SAR responses.
Join them for a practical conversation about technology, redaction and the importance of checking information before it is shared.
Watch the Full Episode on YouTube
Listen to the Full Episode on Spotify
Our free Friday sessions bring people together to discuss data protection topics, share practical advice and ask questions.
If your organisation needs help managing subject access requests or reviewing its redaction process, speak to our team about the support available.
Contact Data Protection People
We host events on a weekly basis for the community of data protection practitioners and have built up a network of over 1,700 subscribers. Members receive weekly invites, exclusive offers, early access to selected content, our monthly newsletter, and first access to in-person events. Check out our upcoming events and become part of our growing community.
View AllOur mission is to make data protection and cyber security easy: easy to understand and easy to do. We do that through the mantra of benchmark, improve, maintain.
