Under Article 30 of the UK GDPR, organisations acting as data controllers or processors generally need to maintain records of their processing activities (RoPA). It applies to organisations of different sizes, but if you have fewer than 250 employees, then you may be exempt. TL;DR: Both data controllers and data processors must maintain a RoPA….
-
-
RoPA stands for Record of Processing Activities. It is a document that a business or organisation maintains to record how it collects, uses, stores and shares personal data. It is a legal requirement under UK GDPR. How To Get Started With Creating a RoPA To start creating an effective RoPA, you must assess your resources….
-
China’s Supreme People’s Court (SPC) issued guidance on handling disputes involving artificial intelligence on 7 September 2026. The guidance provides a framework for applying existing laws to AI-related disputes, particularly where AI systems have caused harm. It addresses personality rights, the processing of personal data, intellectual property, consumer protection and AI-generated content. Applying Existing Laws…
-
AI redaction tools can save time on subject access requests (SARs). They scan large sets of documents, find personal information and suggest what to hide before a response goes out. What they cannot do is take responsibility for the result. They can miss information about other people or hide information the requester is entitled to….
-
Getting a notification through an app like ASOS seems like fairly standard practice, whether it’s informing you about new deals on that jacket you’re eyeing up or reminding you about its current offers and deals but I’d bet you wouldn’t expect that notification to announce that ASOS had been hacked. The issue with this news…
-
When a financial services firm suffers a cyber incident, the first question is usually technical: what has happened, and how do we contain it? Close behind comes a regulatory question that is getting harder to answer: who do we have to tell, and by when? For years the data protection answer has been familiar. Report…
-
Charities handling complex Subject Access Requests (SARs) need to identify the requester’s personal data while carefully considering third-party information, safeguarding concerns, confidentiality and any exemptions that apply. Complex charity SARs often involve third-party data and safeguarding information. Redaction should protect other people’s personal data without unnecessarily removing the individual’s information. Whistleblower, multi-agency and child SARs…
-
The ICO has approved a UK GDPR code of conduct for information sharing between public services in Wales. The Wales Accord on the Sharing of Personal Information (WASPI) code was approved on 24 September 2026 and announced on 28 September 2026. What happened? WASPI is an existing framework that helps organisations in Wales share personal…
-
The short answer: Since 1 October 2026, private registered providers of social housing in England must have a STAIRs publication scheme. It covers information they hold about governance, spending, homes, performance, services, registers and housing management. Providers do not have to create new records. Appropriate redaction is allowed. The separate requirements for tenant information requests…
-
External Attack Surface Management, usually shortened to EASM, is the continuous discovery and monitoring of everything your organisation exposes to the internet, domains, subdomains, cloud services, servers and applications, including the ones nobody currently has on a list. What “attack surface” actually means Your external attack surface is every point an attacker could potentially reach…
Join our community
Our mission is to make data protection easy: easy to understand and easy to do. We do that through the mantra of benchmark, improve, maintain.