Resources

Business Development Executive Job

Join Our Team as a Business Development Executive

Location: Leeds (Hybrid – 4 days in office)
Department: Sales & Marketing
Contract Type: Full-Time, Permanent
Salary: £28,000–£35,000 + Uncapped Commission (DOE)
Start Date: Immediate

Are You Ready to Grow With a Business That’s Going Places?

We’re hiring a Business Development Executive at a pivotal moment for Data Protection People. With a new Sales & Marketing Director onboard and a full-scale transformation underway, this is your chance to join a team on the rise.

You’ll take ownership of lead generation, build meaningful B2B relationships, and support our mission to simplify data protection and cyber security. If you’re target-driven, motivated by growth, and ready to shape your sales career, we want to hear from you.

What Will You Be Doing?

• Generate new business leads through outbound activity and referrals
• Follow up on warm prospects and re-engage past clients
• Manage your pipeline using Salesforce and keep the CRM up to date
• Book and attend meetings (in-person or virtual) to understand client needs
• Support product demonstrations and help close deals
• Achieve monthly KPIs and contribute to revenue targets
• Cross-sell new services to existing clients
• Attend industry events to represent the business and generate leads
• Work closely with delivery teams to ensure smooth handovers

Who We’re Looking For

Essential:

• Proven B2B sales or business development experience
• Excellent communication, negotiation, and relationship-building skills
• Confident using CRM systems and Microsoft Office
• Motivated, self-driven, and ready to hit the ground running

Desirable:

• Experience with Salesforce CRM
• Sales background in consultancy, tech, or professional services

What You’ll Get

• £28k–£35k base salary + commission (depending on experience)
• Hybrid working – 3 days per week in our Leeds office
• Free onsite parking at The Tannery
• Up to 30 days holiday + bank holidays
• Access to expert mentoring and career development support
• Regular team socials, charity events, and wellness perks

About Our Location

You’ll work from our vibrant office at The Tannery, 91 Kirkstall Road, LS3 1HS. We’re just a 10-minute walk from Leeds train station, with excellent public transport links and free parking available.

Ready to Apply?

If you’re excited by the opportunity to grow your sales career with a forward-thinking, purpose-led organisation—apply today. Email [email protected] Submit your CV and tell us why you’re the right fit for the team.

Subject Access Requests and Internal Conflicts of Interest

Subject Access Requests and Internal Conflicts of Interest: Navigating the Grey Areas

When it comes to Subject Access Requests (SARs), few are more complex, or more sensitive, than those submitted by employees and ex-employees. Unlike customer SARs, which are often straightforward, staff-related requests are frequently wrapped up in wider disputes, grievances, or pending legal claims. At Data Protection People, we see it time and again: an employee leaves under difficult circumstances, then shortly afterwards, a SAR lands in HR or Legal’s inbox. It’s no coincidence. These types of requests are often tactical, designed to uncover evidence, test procedural fairness, or support an employment tribunal claim. That’s perfectly within the rights of the data subject but it raises real challenges for employers, especially when conflicts of interest are involved. This blog is about Subject Access Requests and Internal Conflicts of Interest.

Why Internal SARs Are So Tricky

Employee SARs don’t just trigger administrative effort — they often force organisations to walk a tightrope between transparency and risk. You’re being asked to hand over information that may include:

• Emails between managers

• Notes from disciplinary meetings

• Internal chats or instant messages

• Performance reviews

• Legal advice (potentially exempt)

All of this might involve opinions, judgements, or allegations made by other staff members — sometimes senior managers, sometimes HR personnel. And when the very people handling the SAR are involved in the subject matter, conflicts of interest can quietly undermine the integrity of the process.

What Is a Conflict of Interest in SAR Handling?

A conflict of interest occurs when someone involved in responding to a SAR has a personal stake, consciously or not, in the outcome. This could be the HR officer who issued the warning the requester is contesting. Or the manager whose conduct is under scrutiny. Or even an internal investigator who has exchanged emails about the subject.

When these individuals are responsible for locating, reviewing, or redacting data, impartiality is compromised. There’s a risk of information being withheld, over-redacted, or delayed, not necessarily out of malice, but due to unconscious bias or protective instincts.

And that’s a problem. Because if the data subject suspects foul play or receives an incomplete response, they can escalate to the ICO, lodge a complaint, or use it to strengthen their legal case.

Practical Steps to Manage Subject Access Requests and Internal Conflicts of Interest

Organisations should assume that internal SARs will be scrutinised more heavily and act accordingly. Here are practical steps to manage them with confidence and compliance:

1. Separate the People from the Process

Ensure that anyone directly involved in the dispute does not participate in locating, reviewing, or approving the SAR response. Where possible, assign SAR handling to someone independent, ideally within your data protection or legal team.

2. Document Everything

Keep a clear record of:

• Who handled the request

• What searches were conducted

• What redactions were applied and why

• What exemptions were used

This is your audit trail, invaluable if the decision is challenged or reviewed by the ICO.

3. Be Transparent About Exemptions

If you’re withholding data under an exemption (e.g., legal privilege or management planning), be upfront about it in your response. You’re not required to give full detail, but clarity fosters trust.

4. Use a SAR Triage Approach

Have a process in place to flag SARs that involve:

• Internal disputes or grievances

• Legal proceedings or tribunal claims

• High volumes of emails involving senior staff

These should be prioritised and escalated to senior data protection personnel, not left to junior HR or admin staff.

5. Treat SARs as More Than Admin

A SAR isn’t just a compliance exercise,  it’s an insight into how your organisation handles people, transparency, and power. Even when there’s legal protection to withhold certain content, always consider the human context and reputational risk.

The Legal Landscape: Don’t Cut Corners

There’s a temptation in contentious SARs to protect the organisation first. But the law is clear: SARs are a right, not a favour. Employers cannot ignore, delay, or heavily redact responses purely to protect internal politics.

Yes, exemptions under the Data Protection Act 2018 may apply, such as:

• Legal advice and privilege

• Confidential references

• Management forecasting or planning

But these must be applied fairly and justifiably. Misuse of exemptions can lead to enforcement action or reputational damage.

Final Thoughts: Integrity is Everything

When a SAR becomes part of a wider conflict, the stakes are higher, for both the data subject and the organisation. Mishandling the process, whether intentionally or through poorly managed conflicts of interest, risks turning a manageable issue into a major liability.

At Data Protection People, we support organisations with complex and high-risk SARs, especially those involving internal dynamics. From independent reviews to redaction support and strategic advice, our goal is to help you handle even the toughest SARs with clarity, consistency, and compliance. To find out more about Subject Access Requests and Internal Conflicts of Interest listen to our podcast episode here.

Need help with a sensitive SAR?
Get in touch with Data Protection People,  the UK’s leading data protection consultancy. Our experts are on hand to help you manage requests professionally, fairly, and legally.

The UK Data Bill

More Delays, More Questions – What’s Really Happening with the UK Data Bill?

In a significant turn of events for the UK’s data governance landscape, the House of Lords has delivered a powerful rebuke to the government’s ongoing attempts to relax rules for artificial intelligence companies. Peers backed an amendment to the Data Use and Access Bill (DUA Bill) that would require AI developers to disclose which copyright-protected materials they have used to train their models. 

This legislative pushback is not only a victory for creators and rights holders, but also a necessary check against opaque AI development practices that clash with the fundamental transparency and accountability principles enshrined in UK GDPR. 

While this debate may appear niche, it’s about far more than copyright. It’s about direction, principle, and pace. The government finds itself caught between wanting to move fast on digital reform and the growing public and professional concern that it’s leaving too many critical rights and safeguards behind. 

The UK Data Bill – More than a technicality 

This is the second time peers have tried to build stronger protections into the UK data bill, and the concern is clear: that certain sectors in this case, the UK’s creative industries are being asked to sacrifice their intellectual property without proper consultation, clarity, or compensation.  

The amendment, passed in the House of Lords on 12 May 2025 and led by Baroness Beeban Kidron, requires AI developers to declare which copyrighted content has been used during the training of their large language models (LLMs) or generative AI systems.  

For AI providers, this requirement introduces several new burdens: 

• Model provenance tracking – AI companies will now be expected to identify and document source materials with precision. 

• Copyright rights-holder mapping – The relationship between copyright and personal data may overlap, requiring hybrid legal assessments. 

• Further legislative delays – The amendment sends the bill back to the Commons and sets up a likely back-and-forth (“ping-pong”) between chambers. 

Tightening the Definition of Scientific Research: Why Amendment 43B Matters 

Another key flashpoint in the Lords’ debate was the definition of “scientific research”. Critics have feared that overly vague language could allow companies to justify data processing under the loose guise of research, blurring the line between genuine science and commercial experimentation. 

To address this, Amendment 43B, tabled by Viscount Colville, proposes a more structured approach. It defines scientific research using the internationally recognised OECD Frascati Manual and requires that such activity adhere to appropriate ethical, legal, and professional frameworks. 

Supporters say this brings much-needed clarity and protects public trust, particularly in sensitive areas like health and AI. But others warn it could impose unnecessary red tape. Critics, including the government, argue that most researchers already work under existing ethical standards, and that formalising these requirements in legislation could add bureaucratic burdens without clear benefits. 

As the Minister put it, this might risk “chilling basic and curiosity-driven research”, especially in universities and early-stage innovation. The question is whether this safeguard enhances public interest, or simply slows scientific progress without fixing a clearly defined problem. 

Meanwhile, the clock is ticking 

There’s another reason this matters. The current data adequacy agreement with the European Union, the legal basis that allows personal data to flow freely from the EU to the UK, expires at the end of 2025. It may seem far away, but in regulatory terms, that’s the blink of an eye. 

If the EU concludes that the UK’s new data regime no longer offers “essential equivalence” to GDPR, there’s a real risk the adequacy decision won’t be renewed. This would be a major headache for businesses that operate across borders, especially SMEs that don’t have the resources to manage complex legal workarounds. 

The EU has made clear that it’s watching UK reforms closely. Every amendment, every concession, every consultation outcome will be weighed against the EU’s high bar for data protection. And right now, it’s not entirely clear where the UK will land. 

So where does that leave us? 

For now, the UK data bill returns to the Commons. The government can either accept the Lords’ changes or try to remove them, which would trigger another confrontation in the upper house. That back-and-forth could mean more delays, and more uncertainty for businesses trying to plan ahead. 

It’s a frustrating situation. The UK does need a modern, responsive data regime. But reform without clarity, trust, and proper engagement will only slow things down further. 

At this point, we urge organisations not to wait on the sidelines. Review your data flows, understand where your EU connections lie, and keep a close eye on how the adequacy conversation develops over the next 6–12 months. The decisions made in Parliament today could have serious operational and legal implications tomorrow. 

As ever, our team is here to help clients navigate this shifting landscape. Check out our podcast on the DUA Bill here

Exploring Signatures as Biometrics

When Your “John Hancock” Becomes Sensitive Data: Exploring Signatures as Biometrics

Ever looked at your signature and thought, “It’s just a fancy way I write my name”? Think again. In our increasingly digital world, that casual scribble at the bottom of forms is gaining new significance, particularly in places like Jamaica, where the Jamaican Data Protection Act (JDPA) now classifies signatures as sensitive biometric data, putting them in the same category as fingerprints and DNA.

This classification isn’t just fancy legal talk, it’s recognising that your signature has unique behavioural patterns that only you make.

What Makes Your Signature Biometric Data?

Under Jamaica’s Data Protection Act, biometric data is defined as “any information relating to the physical, physiological or behavioural characteristics of an individual, which allows for the unique identification of the individual.” But what exactly makes a signature biometric?

Consider what happens when you sign your name:

• Your hand moves in patterns nobody else can perfectly replicate
• You apply distinctive pressure with your pen
• Your personal hand-eye coordination manifests in each stroke
• Your signature even reveals subtle hints about your personality and current mood

The way you make loops in your letters, the special touches you add, and how fast you move the pen on the paper. These things are just as unique to you as your face or fingerprints.

In today’s digital landscape, e-signatures take this biometric data collection even further:

• They capture exactly how quickly you move the stylus
• They note when you pause (even for milliseconds)
• They measure precisely how much pressure you’re applying
• They record the exact timing between each stroke

The Dual Nature of Signatures

Signatures occupy a unique position in the spectrum of biometric identifiers:

1. A traditional form of verification – Signatures have been used for centuries as a means of authentication, predating modern digital identification methods
2. A behavioural biometric – Each signature contains distinctive characteristics including pressure points, speed, stroke order, and style that can be analysed to verify identity.

This duality creates an interesting challenge. People easily give signatures without concern, unlike fingerprints or facial scans, which raise privacy worries. However, the JDPA classifies signatures as “sensitive personal data,” meaning they need extra protection.

Take a moment to count how many times you’ve signed something in the last month alone:

• Credit card receipts
• Package delivery confirmations
• Work documents
• Medical intake forms

Each instance represents you handing over sensitive personal data without giving it a second thought!

Implications for Organisations

The classification of signatures as biometric data has several significant implications:

1. Data Protection Officer Requirement: Organisations regularly collecting signatures may need to appoint a dedicated officer to oversee data protection compliance.
2. Enhanced Security Measures: Signatures require stronger security measures than ordinary personal data, including appropriate technical and organisational safeguards.
3. Explicit Consent Requirements: Organisations collecting signatures need proper consent mechanisms that specifically address the biometric nature of signature data.
4. Records Management Challenges: Both physical and digital signatures must be properly stored, retained, and eventually disposed of with appropriate security measures.

Practical Steps Forward

Organisations processing signatures should consider taking these steps:

1. Audit current signature collection practices
2. Assess whether a Data Protection Officer appointment is necessary
3. Review consent mechanisms to ensure they address the sensitive nature of signature data
4. Implement appropriate security measures for both physical and digital signature storage
5. Develop retention policies that limit unnecessary storage of signature data

Conclusion

Your signature is more than just a name. It is a piece of YOU. It is a biological data that reveals how your brain and body work together. It contains patterns as unique as a fingerprint. Yet, we share it freely without much thought. By classifying signatures as “sensitive personal data,” the JDPA highlights their role as unique personal identifiers. This recognition ensures they receive the protection they deserve.

Next time someone casually asks you to “sign here,” remember you’re not just confirming something, you’re handing over biometric data (a sensitive personal data) that’s increasingly protected by law around the world.

As businesses adjust to new regulations, they need to balance their practical needs with stronger data protection, keeping signatures both secure and easy to use.

With growing concerns about data privacy, it’s time we give our “John Hancock”, the protection they truly deserve.