Data Protection & Information Security Experts

Is Your Child’s Data Safe?

Is Your Child’s Data Safe?

Understanding Privacy Risks on Social Media & Gaming Platforms 

Children today are immersed in the digital world, spending hours on social media and gaming platforms. While these spaces offer entertainment and connection, they also expose children to significant risks. Personal data is often collected, stored, and shared—sometimes without adequate safeguards. As data protection practitioners, businesses, and parents, we must ensure children’s data is protected and handled responsibly. 

What is really happening?  

Many platforms rely on data collection for their business models, and children’s information is no exception. Social media apps track browsing habits, locations, and even biometric data. Gaming platforms encourage in-game purchases and often require extensive personal details for account creation. Targeted advertising can expose children to age-inappropriate content, while weak privacy settings make them vulnerable to online exploitation. 

One major concern is how easily children’s data can be accessed or misused. Even when platforms claim to offer security, breaches and leaks happen. Data is often shared with third-party advertisers, meaning a child’s online behaviour could be tracked across multiple websites. This raises questions about consent and whether children (or their parents) truly understand what they’re agreeing to when they sign up. 

Examples of real-world incidents highlight vulnerabilities children face online:  

In April 2023, TikTok was fined £12.7 million by the UK’s Information Commissioner’s Office (ICO) for misusing children’s data, including failing to obtain parental consent for users under 13 and not implementing adequate age verification measures.1 

Also, as of March 2025, the ICO launched investigations into TikTok, Reddit, and Imgur to assess their compliance with children’s data protection regulations. These investigations aim to ensure that these platforms have robust safety measures to prevent exposing young users to inappropriate or harmful content.2 

The gaming industry has also faced criticism for inadequate data protection practices. Regulators have fined video game companies for unlawful practices involving young people’s personal data, emphasising the need for stricter compliance with privacy and data protection laws.3 

Finally, the UK government is considering a social media ban for children under 16. Chief Medical Officer Chris Whitty has been tasked to assess the potential risks and harms associated with children using social media, which could lead to increasing the digital “age of consent” from 13 to 16.4 

These examples underscore the pressing need for enhanced data protection measures tailored to children’s online activities. 

UK GDPR & Children’s Data Protection 

The UK General Data Protection Regulation (UK GDPR) explicitly recognises that children require greater protection when it comes to their personal data. This is because they may be less aware of the risks, consequences, and safeguards available to them. Recital 38 of the UK GDPR emphasises that children’s personal data merits specific protection, particularly in the context of online services such as social networking, gaming platforms, and digital marketing. 

To address these concerns, UK GDPR imposes stricter obligations on organisations processing children’s data. Article 8 sets the legal age of digital consent at 13 in the UK, meaning that any online service provider offering services directly to children under this age must obtain verifiable parental consent before processing their data. Furthermore, organisations must ensure that privacy notices are written in clear, age-appropriate language, so children and their guardians fully understand how their information is collected, used, and shared. 

The principle of data minimisation plays a crucial role in safeguarding young users, requiring that only the necessary amount of personal data is collected and retained for as long as needed. Additionally, the right to erasure, also known as the “right to be forgotten” (Article 17), allows children or their guardians to request the deletion of their data if it is no longer necessary or has been unlawfully processed. 

A significant requirement under UK GDPR is that platforms must implement high privacy settings by default, particularly for children’s accounts. This aligns with the Age-Appropriate Design Code (Children’s Code), issued by the Information Commissioner’s Office (ICO), which mandates that services likely to be accessed by children must provide a high level of data protection by design and default. Despite these legal requirements, enforcement remains a challenge, with many online platforms failing to fully implement child-friendly privacy measures, leaving young users vulnerable to data misuse and online exploitation. 

 The Online Safety Act 2023 

The Online Safety Act 2023 introduces a comprehensive legal framework designed to regulate online platforms and ensure the safety of children in the digital environment. Recognising the increasing risks posed by harmful content, data misuse, and exploitative online practices, the Act places a legal duty of care on service providers to identify and mitigate potential dangers to children using their platforms. This legislation is particularly relevant for social media networks, gaming platforms, and other digital services accessible to minors. 

A key requirement under the Act is that companies must conduct mandatory risk assessments to evaluate how their platforms may expose children to illegal or harmful material, including content that promotes self-harm, exploitation, or misinformation. The legislation mandates that platforms implement proportionate measures to prevent such risks, ensuring compliance through robust safety mechanisms and content moderation systems. 

Age verification and assurance mechanisms form another cornerstone of the Online Safety Act. Service providers are now legally obligated to implement technology that effectively determines whether a user is underage, thereby preventing children from accessing inappropriate or harmful content. This aligns with the Age-Appropriate Design Code (Children’s Code), which complements both UK GDPR and the Online Safety Act by setting high standards for protecting children’s data and ensuring digital services act in their best interests.5 6 

Despite these legal safeguards, enforcement and implementation remain a challenge. Many online platforms still operate within regulatory grey areas, making compliance a complex but essential responsibility for organisations that process children’s data. 

 Conclusion 

The protection of children’s data and online safety is a shared responsibility between organisations, regulators and parents. UK GDPR provides a strong legal foundation by requiring high privacy settings, minimal data collection, and clear parental consent mechanisms, while the Online Safety Act enforces stricter obligations on platforms to protect children from online harms. 

For businesses, compliance is no longer an option but a legal necessity. Organisations processing children’s data must integrate privacy-by-design principles, conduct risk assessments, and implement robust age verification systems to meet their legal obligations.  

Parents, too, play an essential role by actively engaging with their children’s online activities, leveraging their UK GDPR rights, and advocating for greater transparency from digital service providers. While legislation provides a crucial framework, the practical implementation of these laws will determine whether they effectively safeguard children in an increasingly digital world. 

By adopting a proactive and legally sound approach, organisations can not only comply with evolving regulatory requirements but also build trust with users and create a safer, more responsible digital ecosystem for future generations. 

Join the conversation

This article was written by Data Protection Expert, Catarina Santos who will be joining our audience live on the Data Protection Made Easy podcast on the 14th of March 2024 between 12:30PM and 13:30PM. It’s completely free to join and anyone is welcome to get involved, if you would like to sign up for this upcoming discussion simply visit our events page and register for this discussion for free.

Written by Catarina Santos

Should You Share Your Passwords with Loved Ones? A Guide to Proper Password Storage

We use passwords all the time, they are the keys to our online lives. From banking to social media, streaming services to work accounts, our personal and professional data is locked behind passwords. This raises an important question: Should you share your password with loved ones?

While trust is fundamental in any relationship, sharing passwords can expose you to serious security risks. Even if you trust someone completely, their security practices may not be as stringent as yours. Their device may be vulnerable to malware, they could fall victim to a phishing attack, or they might reuse passwords across multiple accounts, increasing the risk of exposure.

Risks of Sharing Passwords

• Security vulnerabilities – Password sharing increases the risk of unauthorised access, data breaches, and identity theft. The person you share with may not follow strict security measures, putting your information at risk.
• Legal and compliance issues – Many services, including banking platforms and workplace systems, prohibit password sharing. Violating these terms can result in account suspension, financial liability, or legal consequences.
• Loss of control – Once a password is shared, it becomes difficult to track who has access. Even if you trust one person, they may unknowingly pass it along to others or store it insecurely.

When Password Sharing Might Be Acceptable

There are some cases where sharing passwords may be necessary, but these should be carefully managed:

• Emergency situations – Granting a trusted individual access to essential accounts can be helpful in case of medical or financial emergencies.
• Family account management – Some services, like streaming platforms, allow for shared access through family plans, reducing the need to share credentials.
• Work-approved credential sharing – In professional settings, teams may need shared access to tools. In these cases, businesses should use secure password management solutions to protect credentials.

Best Practices for Secure Password Management

To ensure security while managing passwords, consider the following best practices:

• Use a password manager – Use tools to securely store and share credentials without revealing the actual password.
• Enable multi-factor authentication (MFA) – Adding an extra layer of verification, such as an SMS code or biometric authentication, makes it harder for unauthorised users to access accounts.
• Create unique passwords for each account – Reusing passwords across different platforms increases vulnerability. Unique, strong passwords should be used for each account.
• Monitor account activity – Regularly check for suspicious logins or unauthorised access attempts and update security settings as needed.
• Securely share passwords when necessary – If you must share a password, use a password manager’s built-in sharing feature rather than sending credentials via email or text.
• Update passwords regularly – If a password has been shared in the past, change it periodically and remove access for those who no longer need it.

Conclusion

Sharing passwords with loved ones is a personal decision that comes with significant security risks. While some situations may justify limited sharing, strong security practices are essential to protect sensitive information. By using password managers, enabling multi-factor authentication, and maintaining vigilance, you can safeguard your digital identity while preserving trust and convenience.

At Data Protection People, we specialise in helping businesses and individuals navigate complex data security challenges. If you need guidance on secure password management, compliance, or cybersecurity best practices, get in touch with our expert consultants today.

What is the Online Safety Act? Everything Parents & Businesses Need to Know

The Online Safety Act is a landmark piece of UK legislation designed to create a safer digital environment for users, particularly children. It places legal obligations on online platforms, social media companies, and digital service providers to safeguard users from harmful and illegal content while promoting transparency and accountability. The Act is regulated by Ofcom, the UK’s communications watchdog, and has far-reaching implications for parents, businesses, and internet users alike.

Understanding the Online Safety Act

Enacted in October 2023, the Online Safety Act introduces comprehensive rules requiring online platforms to take proactive measures to detect and mitigate illegal and harmful content. The legislation is particularly focused on:

• Protecting children from exposure to harmful or age-inappropriate material.
• Combating misinformation and preventing the spread of illegal content, including terrorism and child sexual exploitation.
• Ensuring digital platforms fulfil their duty of care, promoting safer user interactions and responsible content moderation.

The Act enforces strict safety protocols, such as age verification systems, content risk assessments, and transparent reporting requirements. It is being implemented in phases to give businesses time to adapt to the new rules.

Key Obligations and Phased Implementation

The Online Safety Act mandates that online platforms:

1. Conduct Risk Assessments: Identify and evaluate the risks of illegal and harmful content on their services.

1. Implement Age Verification: Ensure that children are not exposed to age-inappropriate or harmful material.
2. Maintain Transparency: Publish regular reports detailing safety measures and content moderation practices.

The implementation is phased to help businesses adapt gradually:

• By 16 March 2025: Platforms must complete risk assessments related to illegal harms.
• From 17 March 2025: Safety measures, as outlined in the Act’s codes of practice, must be implemented.
• By April 2025: All user-to-user and search services must conduct a Children’s Access Assessment to determine if their platforms are likely to be accessed by children. If the service deems that is likely, then they need to carry out a children’s risk assessment by July 2025.

This phased approach allows digital service providers to build robust safety frameworks while ensuring compliance with the Act.

Implications for Parents and Businesses

For Parents

In today’s digital age, children are more connected than ever. This brings fantastic opportunities for learning and socialising but also exposes them to risks. The Online Safety Act is designed to offer stronger protections, but it’s important for parents to stay involved too.

As mentioned above, the Act:

• Removes or restricts harmful content, including anything that promotes self-harm, eating disorders, cyberbullying or violent and extremist behaviour.
• Introduces strict age verification, where websites with adult content must have robust systems to prevent underage access.
• Enhances parental controls, where platforms should provide tools that allow parents to manage and monitor their child’s online activities.
• Prevents online grooming and exploitation, where companies must use technology to detect and report harmful interactions quickly.

However, technology alone is not enough. As a parent, you can do your part by:

• Using parental controls to limit access to age-inappropriate content.
• Talking to your child about online safety, privacy settings, and what to do if they encounter something upsetting.
• Monitoring their online activity while respecting their growing independence.
• Keeping an open dialogue so they feel comfortable sharing concerns.

The Online Safety Act lays the groundwork, but parental involvement is still key to keeping children safe online.

For Businesses

For companies operating in the digital space, the Online Safety Act introduces new responsibilities to ensure user safety and maintain transparency, including:

• Duty of care for online platforms: If your platform hosts user-generated content—like social media sites, messaging apps, or forums—you must actively monitor and remove harmful material.
• Transparency reporting: Regular reports must be published detailing content moderation efforts and safety measures.
• Combating misinformation: Stronger policies are needed to tackle misinformation, particularly about health, elections, and crisis events.
• Balancing encryption and safety: Although end-to-end encryption is essential for user privacy, the Act requires businesses to allow law enforcement access to flagged harmful content.

How can Businesses ensure compliance?

Navigating the requirements of the Online Safety Act might seem challenging, but early action can safeguard your business from costly penalties and reputational damage. Here’s how to get started:

• Review and update content moderation policies: Use a combination of AI-driven tools and human moderators to quickly identify and remove harmful content.
• Strengthen user reporting mechanisms: Make it easy for users to flag inappropriate or illegal content.
• Implement advanced age verification systems: This is especially important for platforms containing adult or age-sensitive material.
• Stay informed: Regularly check for updates from Ofcom to ensure ongoing compliance with evolving standards.

The Future of Online Safety Regulation

The Online Safety Act marks a turning point in digital governance in the UK, setting a new standard for online safety and platform accountability. However, it also raises complex questions about privacy, freedom of speech, and how companies will balance safety with user rights.

The digital landscape is constantly evolving, and so will this legislation. By staying informed and proactive, businesses can navigate these changes successfully while continuing to provide safe and positive online experiences.

Conclusion

The Online Safety Act is a major step forward in regulating the internet. It offers better protections for children and other vulnerable users while imposing strict obligations on businesses to ensure user safety.

At Data Protection People, we help businesses navigate complex regulatory landscapes, ensuring compliance with laws like the Online Safety Act and UK GDPR. If your organisation needs expert guidance on online safety, data protection, or digital compliance, contact us today.

Source: https://www.gov.uk/government/publications/online-safety-act-explainer/online-safety-act-explainer

Understanding Workplace Surveillance & Your Rights

Can My Employer Track Me? Understanding Workplace Surveillance & Your Rights

Employer surveillance has become an increasingly common practice in recent years. Companies monitor employees for various reasons, such as ensuring productivity, maintaining security, and complying with industry regulations. However, with advances in monitoring technology, employees may wonder: How much tracking is too much? What are your rights when it comes to workplace surveillance in the UK? This guide explains the legal framework, the different types of tracking, and what employees need to know to protect their employees’ rights and freedoms.

What is Workplace Surveillance?

Workplace surveillance refers to the monitoring of employee activities, communications, and movements by an employer. The methods used can vary widely depending on the industry, company policies, and the level of oversight required. Here are some of the most common types of workplace surveillance:

• Email and Message Monitoring – Employers may track workplace emails and internal messaging systems to ensure compliance with company policies and detect security threats.
• Internet and Browsing Activity Tracking – Some organisations monitor the websites employees visit during work hours to prevent misuse of company resources and ensure productivity.
• Keystroke Logging – This involves tracking keyboard activity to measure employee efficiency and detect potential security incidents.
• Screen Recording and Webcam Monitoring – Some remote work arrangements involve screen monitoring software or mandatory webcam usage to ensure engagement during work hours.
• Call and Voicemail Monitoring – Employers in customer service or sales roles may record calls for quality assurance, training, or regulatory compliance.
• GPS Tracking and Location Monitoring – Field-based employees using company devices may be subject to GPS tracking for route efficiency and attendance verification.
• Biometric Surveillance – Fingerprint, facial recognition, or retinal scans may be used for access control, attendance tracking, and security.
• Badge or RFID Access Control Logs – Companies may track physical access to offices, buildings, and restricted areas using employee ID cards.

Is Workplace Surveillance Legal in the UK?

Yes, but it must comply with UK data protection laws. This includes the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Employers must ensure that workplace monitoring is lawful, necessary, and proportionate to business needs. Excessive or intrusive monitoring without justification could be deemed a violation of employee rights.

Key Legal Requirements for Employers

• Transparency & Employee Notification – Employers must inform employees of the type and extent of monitoring through clear workplace policies, typically outlined in an employee privacy notice.
• Lawful Basis for Monitoring – Surveillance must be based on a legitimate reason, such as security, fraud prevention, regulatory compliance, or workplace efficiency.
• Proportionality & Minimisation – Employers should not collect more data than necessary, it is key to ensure that monitoring is proportionate to the intended purpose and the information collected is not used for any other incompatible purpose.
• Retention & Security of Data – Collected surveillance data must be securely stored and only retained for as long as necessary.
• Access & Employee Rights – Employees have numerous rights under UK data protection law, one of which is the right to request access to their personal data.
• Human Rights Considerations – The right to privacy under the Human Rights Act 1998 may apply if monitoring is excessive or unjustified.

Please note this list is not exhaustive.

Your Rights as an Employee

If you believe you are being monitored at work, you have several rights under UK data protection laws:

• The Right to Be Informed – Your employer should clearly communicate what data is being collected, how it will be used, and why the monitoring is necessary.
• The Right to Access Your Data – You can submit a Subject Access Request (SAR) to see what personal data your employer holds about you, including surveillance records.
• The Right to Rectification – You have the right to correct any inaccurate personal data that belongs to you, this could be required where your office attendance is monitored for example.
• The Right to Erasure – You have the right to erase your personal data. Please note that this right is qualified, meaning that your employer may have a legitimate reason to refuse your request.
• The Right to Restriction – The UK GDPR provides situations when you can restrict the processing of your personal data.
• The Right to Object – If you feel that the monitoring is excessive, disproportionate, or unnecessary, you can raise an objection and request that the surveillance be reviewed.
• Rights relating to automated decision making – Data subjects have the right to not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
• The Right to Withdraw Your Consent – This only applies when the lawful basis for the processing is your consent.
• The Right to Complain to the ICO – You have the right to complain to the UK’s supervisory authority if you feel your personal data has been processed unlawfully – note that the ICO will recommend you solve any issues with the organisation in the first instance.

How Can Employers Ensure Compliance?

Employers should follow best practices to balance business needs with employee privacy rights:

• Develop a Transparent Workplace Surveillance Policy – Outline what monitoring occurs, why it is necessary, and how employee data is handled.
• Use Monitoring Proportionately – Avoid excessive tracking and focus only on necessary business needs.
• Offer Opt-Outs Where Possible – Employees should have the ability to opt out of certain types of non-essential monitoring, such as tracking of personal devices.
• Ensure Data Security – Collected monitoring data should be encrypted, stored securely, and accessed only by authorised personnel.
• Provide Employee Training – Ensure that employees understand workplace monitoring policies, their rights, and how their data is used.
• Conduct Regular Audits – Review surveillance practices periodically to ensure compliance with UK GDPR and evolving data protection laws.

The Future of Workplace Surveillance

With advancements in AI-driven monitoring software, biometric security, and remote work tracking tools, workplace surveillance is expected to become even more sophisticated. However, as monitoring capabilities grow, so do concerns about privacy and employee rights. The UK government and regulatory bodies, such as the ICO, continue to assess the balance between employer interests and personal privacy.

Conclusion

Employers in the UK have the right to monitor employees for legitimate business purposes. Surveillance must be transparent, necessary, and lawful. Employees should stay informed about their rights, review company policies, and seek legal advice if they believe their privacy is being infringed upon.

At Data Protection People, we help businesses develop legally compliant workplace surveillance policies while ensuring the fair treatment of employees. If you need guidance on workplace monitoring policies, data protection laws, or regulatory compliance, contact our team today.

GDPR Radio – Episode 208

GDPR Radio – Episode 208: The Latest in Data Protection News

Welcome to Episode 208 of the Data Protection Made Easy Podcast, where our expert hosts Catarina Santos, Caine Glancy, and Joe Kirk dive into the latest news, trends, and regulatory updates shaping the world of data protection. This week’s GDPR Radio session was packed with insights, lively discussion, and active participation from our engaged community of listeners.

What Was Covered in This Episode?

In this edition of GDPR Radio, our hosts explored the biggest stories in data protection, cybersecurity, and regulatory compliance, providing expert analysis on:

• The latest enforcement actions from the ICO and other regulators
• Key legislative updates and what they mean for businesses
• High-profile data breaches and lessons to learn from them
• Emerging trends in data privacy, AI governance, and cybersecurity

With live audience participation, our community contributed thoughts, experiences, and pressing questions, making this session a must-listen for data protection professionals, legal teams, and compliance officers looking to stay ahead of industry developments.

How to Join Future Live Sessions

The Data Protection Made Easy Podcast is not just a source of expert insights—it’s an interactive community-driven discussion. Every Friday at 12:30 PM (UK time), we host a free live session on Microsoft Teams, where attendees can:
✔ Engage with data protection experts in real-time
✔ Share experiences and learn from peers across industries
✔ Access valuable tools, templates, and guidance shared during the session

Want to get involved? Sign up for our upcoming episodes and receive weekly invites! Click here to register.

Why Join Our Community?

With over 1,400 subscribers and thousands of weekly listeners, the Data Protection Made Easy Podcast is the go-to platform for professionals who want to:

• Stay ahead of industry changes and regulatory updates
•  Learn from real-world case studies and expert-led discussions
•  Connect with a like-minded community passionate about GDPR, cyber risk, and data privacy

Best of all, our sessions are completely free, with no sales pitches—just high-value content, expert insights, and practical advice that you can take back to your organisation.

Listen Back Anytime

Couldn’t join live? No problem! Episode 208 of GDPR Radio is now available to stream on Spotify, Amazon Music, and all major podcast platforms.

Listen to this episode now using the player below:

Next week, we return with a special topical discussion on “Ethical Design for a Child-Friendly Digital Environment.” Make sure to subscribe and stay updated with all our latest episodes!

Check out our full podcast library for more episodes.

Big Brother – The Ethics of Employee Monitoring

Big Brother – The Ethics of Employee Monitoring

Employee monitoring is becoming more widespread as organisations look to improve productivity, ensure security, and maintain compliance. But where do we draw the line between necessary oversight and employee privacy? In this week’s Data Protection Made Easy Podcast episode, Joe Kirk and Caine Glancy delve into the legal, ethical, and practical aspects of workplace surveillance and how businesses can navigate these challenges under UK GDPR.

What Was Discussed in This Episode?

1. The Growing Role of Employee Monitoring

With the rise of hybrid and remote working, many organisations have introduced monitoring tools to track employee performance, security, and system usage. But are these tools being used appropriately? Our hosts explore the different types of monitoring, including:

• Time tracking software – used to log working hours and productivity.
• Screen recording and keystroke tracking – implemented to monitor employee activity on company systems.
• CCTV and biometric access – ensuring security in physical workplaces.
• AI-powered surveillance tools – detecting suspicious behaviour and improving cybersecurity.

2. The Legal Landscape: What Does UK GDPR Say?

Organisations must carefully consider lawful bases when processing employee data. Monitoring activities must comply with UK GDPR principles, particularly:

• Lawfulness, fairness, and transparency – Employees must be informed about how they are being monitored and why.
• Purpose limitation – Monitoring should only be conducted for specific, justified purposes.
• Data minimisation – Only necessary data should be collected, and excessive surveillance should be avoided.

The discussion also covers employee rights, including the ability to challenge intrusive surveillance and request access to monitored data.

3. Ethical Considerations: Balancing Trust and Compliance

While some level of monitoring may be necessary, excessive surveillance can erode trust, reduce morale, and even create legal risks. Joe and Caine examine:

• The psychological impact of constant surveillance in the workplace.
• Whether AI-driven monitoring is inherently biased or unfair.
• How organisations can create transparent policies that respect employee rights while protecting business interests.

4. Practical Steps for Businesses

How can organisations strike the right balance? Our hosts offer best practices for businesses, including:

• Conducting Data Protection Impact Assessments (DPIAs) before introducing monitoring tools.
• Ensuring clear policies and open communication with employees.
• Regularly reviewing monitoring practices to ensure compliance and fairness.

Earn IAPP CPE Credits on the Podcast

If you’re an IAPP-certified professional, you can claim 1 Continuing Privacy Education (CPE) credit for every episode of Data Protection Made Easy you listen to. Simply track your attendance and submit the episode details via the IAPP portal.

Our podcast is designed to provide real-world insights and professional development, helping data protection practitioners stay up to date with industry trends.

Join Our Community – Listen Live or On-Demand

The Data Protection Made Easy Podcast is completely free and designed to make data protection topics accessible, engaging, and easy to understand. With over 1,400 subscribers, our sessions provide a unique opportunity to connect with experts, discuss real-life challenges, and access valuable resources.

How to Join Future Live Sessions

We host weekly sessions every Friday from 12:30 PM – 1:30 PM via Microsoft Teams. You can:
Sign up for a single session via our Events Page
Subscribe for weekly invites and never miss an episode

Why Join Live?

• Participate in the live Q&A and chat with data protection professionals.
• Get access to useful tools and templates shared during the session.
• Stay ahead of industry news and legislative updates.

If you can’t join us live, you can listen back to all episodes on Spotify, Amazon Music, and other streaming platforms.

Listen to all past episodes here: Spotify Podcast Page

Upcoming Episodes

Friday, 7th March – GDPR Radio
Our fortnightly news round-up returns! We’ll cover the latest UK GDPR enforcement actions, ICO guidance, and industry developments.

Friday, 14th March – Designing for a Child-Friendly Digital Environment
How should organisations approach data protection for minors? Join us for a deep dive into ethical design, new regulations, and best practices for protecting children online.

Want to be part of the discussion? Sign up now and join the UK’s leading data protection podcast.

Listen Back & Stay Connected

If you missed this episode, you can catch up anytime! Our full library of 200+ episodes is available to stream on demand.

Listen Now
Subscribe for future sessions

Whether you’re a DPO, privacy professional, or just passionate about data protection, we’d love to have you in our community. Join us every Friday for the latest insights from Data Protection People.

Cyber Love or Cyber Risk

Cyber Love or Cyber Risk? A Data Protection Valentine’s Special

Exploring the Intersection of Love, Trust, and Data Protection

Love is in the air—but so are data risks! In this special Valentine’s Day edition of the Data Protection Made Easy Podcast, hosts Joe Kirk and Catarina Santos explore the hidden risks behind online dating, password sharing, and third-party trust in the digital world.

Whether you’re swiping right on a dating app or sharing your Netflix password with a loved one, personal data is constantly being exchanged. But how much do we really know about where that data goes and how secure it is?

What We Covered in This Episode

1. Dating Apps & Data Breaches – Who’s Really Holding Onto Your Personal Information?

Online dating has revolutionised the way people connect, but it has also created new privacy challenges. In this episode, we examine:

• Major data breaches in the dating industry – What can we learn from past incidents?
• How dating platforms collect and share user data – Are you really in control of your personal information?
• Best practices for protecting your identity when using online dating services.

2. Sharing Passwords – A Love Language or a Cybersecurity Nightmare?

From streaming accounts to banking apps, many couples share passwords without considering the risks. We discuss:

• The dangers of reusing passwords across multiple platforms.
• Whether it’s ever safe to share credentials and how to do it securely.
• How businesses can educate employees about password hygiene in the workplace.

3. Finding a Trusted Partner – In Love and in Business

Just as trust is essential in relationships, it’s also crucial when selecting third-party vendors who process personal data. In this section, we explore:

• Due diligence for third-party suppliers – How to vet companies that handle your customers’ data.
• The risks of sharing sensitive business data with external providers.
• Why legal agreements and data protection contracts matter in building strong business relationships.

Why You Should Listen to This Episode

✔ Real-World Insights: Learn from real data breaches and mistakes made by companies handling personal information.
✔ Practical Advice: Understand what you can do to keep both personal and business data safe.
✔ Interactive & Engaging: Our hosts break down complex issues into easy-to-understand, relatable discussions.

Join Us for Future Episodes!

This episode is part of our ongoing commitment to making data protection easy to understand and accessible. If you enjoyed the discussion, why not join us live next time?

🔹 We host live discussions every Friday at 12:30 PM (UK Time).
🔹 Sign up via our Events Page to get weekly invites.
🔹 Can’t make it live? Catch up anytime on Spotify, Amazon Music, or your favourite streaming platform.

Data protection isn’t just for businesses—it’s for everyone. Tune in to learn how to protect yourself and your organisation in a world where love and data are both at risk.

GDPR Radio – Episode 204

GDPR Radio: Episode 204 – Latest Data Protection Updates and Insights

The Data Protection Made Easy podcast is dedicated to simplifying complex data protection topics. Making data protection compliance easy to understand and more accessible to all. In Episode 204 of GDPR Radio, our expert panel delved into the latest industry news, regulatory updates, and key legislative changes affecting businesses across the UK and beyond.

This fortnightly GDPR Radio session, recorded live every Friday, brings together data protection professionals, legal experts, and compliance specialists to dissect real-time developments in privacy law and cybersecurity. Listeners gain valuable insights, practical advice, and expert analysis to stay ahead in an ever-evolving regulatory landscape.

What Was Covered in Episode 204?

In this episode, our experts examined:

• Recent Enforcement Actions – A deep dive into the latest ICO rulings, fines, and regulatory decisions, highlighting key takeaways for organisations.
• Legislative Developments – Updates on upcoming data protection laws, including amendments to the UK GDPR and the impact of global privacy regulations.
• Emerging Risks and Trends – Discussions on AI governance, cybersecurity threats, and evolving compliance challenges facing organisations in 2024.
• Industry Best Practices – Practical guidance on how businesses can strengthen their data protection strategies, mitigate risk, and ensure compliance.

Why Listen to the Data Protection Made Easy Podcast?

With over 1,400 subscribers, hundreds of live attendees every week, and 30,000+ streams on Spotify. The Data Protection Made Easy podcast has established itself as the go-to platform for data protection professionals. Unlike other industry discussions, our sessions are designed to be:

• Accessible and Engaging – Breaking down complex legal and regulatory issues into clear, easy-to-understand conversations.
• Completely Free and Interactive – We encourage live participation, Q&A sessions, and open discussions with experts.
• Actionable and Practical – Every session provides real-world insights that businesses can implement immediately.
• Non-Promotional – We don’t sell or push services. Our goal is purely to educate, inform, and support the data protection community.

Join Our Live Sessions – Be Part of the Conversation

If you’re passionate about data protection or looking to stay ahead of the latest compliance changes, why not join our live discussions? The Data Protection Made Easy podcast is recorded live every Friday at 12:30 PM, and anyone is welcome to register for free.

Our weekly episodes alternate between:

🔹 GDPR Radio – Our flagship news session covering the latest updates, enforcement actions, and legislative developments.
🔹 Topical Discussions – Deep dives into specific areas of data protection and cybersecurity, featuring expert guest speakers and interactive debates.

How to Listen and Subscribe

If you missed Episode 204, you can listen back using the Spotify player below or on any major streaming platform, including Amazon Music, Apple Podcasts, and Google Podcasts.

🔗 View Upcoming Events and Register for Live Sessions

🎧 Listen to the Data Protection Made Easy Podcast on Spotify

By subscribing, you’ll receive weekly invitations to our live discussions, ensuring you never miss a critical update in the world of data protection.