Dutch AP fines Uber €825m: what meaningful human review looks like
The Dutch Data Protection Authority (AP) has fined Uber €825 million over automated driver-account deactivations. The decision, reported on 21…
Articles
Practical guidance on UK GDPR, data protection, and privacy compliance. From ICO enforcement updates to implementation guides, we help you stay informed and compliant.
Data protection training for staff: a practical UK employer checklist
Data protection training for staff works best when it is part of an everyday operating routine, rather than a generic…
ICO action against the Metropolitan Police: why training and assurance must be demonstrable
An ICO enforcement notice and reprimand issued to the Metropolitan Police Service (MPS) offer a practical reminder for any organisation…
Agentic AI and GDPR: a practical guide to compliant adoption
An agent that can read a customer record, call a tool and write the result back into a system changes…
ICO investigation leads to sentence for unlawful council-record access: what employers should do
A new ICO case is a useful reminder that personal-data risk is not limited to phishing, lost devices or external…
CNIL connected-vehicle location rules: what fleet managers and telematics providers should check
A connected car, van, or scooter generates location data every time it moves. Fleet dashboards, rental recovery tools, and telematics…
ICO fines Thermotech and Jacksons Marketing £370,000 for nuisance calls to TPS numbers
On 8 July 2026, the ICO fined Thermotech Wall and Loft Surveys Ltd £240,000 and Jacksons Marketing Ltd £130,000 after…
AEPD fines Amadeus €14.4M over traveller profiling: what the booking-data case means for reuse projects
A B2B platform holds years of customer booking data collected for one operational purpose. A product team wants to mine…
Can you reuse customer data for a new purpose? ICO’s 2026 compatibility rules explained
Your team collected customer data for one stated purpose. Six months later, product wants to mine the same database for…
When exactly can UK marketers use the soft opt-in?
Unsolicited email and SMS to people based in the UK “individual subscribers” normally needs explicit consent under UK ePrivacy/PECR electronic…
GDPR & Slack: How to stay compliant with GDPR
Slack is where your team talks. It is not where your GDPR programme lives. Under the UK GDPR Article 28,…
Can I Request a Copy of All My Employment Data from My Employer Under GDPR?
The General Data Protection Regulation (GDPR) gives you the explicit right to request and receive a copy of all personal…
Garante fines Emirates €180,000 over assisted-travel health data
Italy's Garante fined Emirates €180,000 over MEDIF health-data transparency and retention. Practical lessons for accessibility and assisted-travel data.
London Clinic ICO caution: what staff medical-record misuse teaches employers
The ICO has issued a formal caution to a former healthcare professional after concluding a criminal investigation linked to medical…
Irish DPC fines HSE €300,000 after Tullamore ransomware breach
The Irish Data Protection Commission has fined the Health Service Executive €300,000 after a ransomware attack on the laboratory information…
Is Employee Data Subject to GDPR? How must it be protected?
Yes. Employee data is personal data, so GDPR applies whenever an employer collects, stores, shares, searches, or deletes it. The…
When Do You Need to Conduct a GDPR Risk Assessment/DPIA?
In practice, people often say “GDPR risk assessment”, but the legal test under the UK GDPR is whether you need…
ICO fines South Staffordshire £963,900 after phishing-led breach exposed 633,887 people’s data
The ICO has fined South Staffordshire Plc and South Staffordshire Water Plc £963,900 after a phishing-led cyber attack led to…
NHS data breach disciplinary disparity: why staff rarely face dismissal
NHS staff rarely face dismissal for data breaches. Analysis of the Southport and Nottingham record access scandals and what they…
California sues 23andMe: why genetic-data security failures become a board issue
California says 23andMe failed to protect genetic data and misled consumers after the 2023 breach. Here is why the lawsuit…