Agentic AI and GDPR: a practical guide to compliant adoption
An agent that can read a customer record, call a tool and write the result back into a system changes…
Articles
Practical guidance on UK GDPR, data protection, and privacy compliance. From ICO enforcement updates to implementation guides, we help you stay informed and compliant.
ICO investigation leads to sentence for unlawful council-record access: what employers should do
A new ICO case is a useful reminder that personal-data risk is not limited to phishing, lost devices or external…
CNIL connected-vehicle location rules: what fleet managers and telematics providers should check
A connected car, van, or scooter generates location data every time it moves. Fleet dashboards, rental recovery tools, and telematics…
ICO fines Thermotech and Jacksons Marketing £370,000 for nuisance calls to TPS numbers
On 8 July 2026, the ICO fined Thermotech Wall and Loft Surveys Ltd £240,000 and Jacksons Marketing Ltd £130,000 after…
AEPD fines Amadeus €14.4M over traveller profiling: what the booking-data case means for reuse projects
A B2B platform holds years of customer booking data collected for one operational purpose. A product team wants to mine…
Can you reuse customer data for a new purpose? ICO’s 2026 compatibility rules explained
Your team collected customer data for one stated purpose. Six months later, product wants to mine the same database for…
When exactly can UK marketers use the soft opt-in?
Unsolicited email and SMS to people based in the UK “individual subscribers” normally needs explicit consent under UK ePrivacy/PECR electronic…
GDPR & Slack: How to stay compliant with GDPR
Slack is where your team talks. It is not where your GDPR programme lives. Under the UK GDPR Article 28,…
Can I Request a Copy of All My Employment Data from My Employer Under GDPR?
The General Data Protection Regulation (GDPR) gives you the explicit right to request and receive a copy of all personal…
Garante fines Emirates €180,000 over assisted-travel health data
Italy's Garante fined Emirates €180,000 over MEDIF health-data transparency and retention. Practical lessons for accessibility and assisted-travel data.
London Clinic ICO caution: what staff medical-record misuse teaches employers
The ICO has issued a formal caution to a former healthcare professional after concluding a criminal investigation linked to medical…
Irish DPC fines HSE €300,000 after Tullamore ransomware breach
The Irish Data Protection Commission has fined the Health Service Executive €300,000 after a ransomware attack on the laboratory information…
Is Employee Data Subject to GDPR? How must it be protected?
Yes. Employee data is personal data, so GDPR applies whenever an employer collects, stores, shares, searches, or deletes it. The…
When Do You Need to Conduct a GDPR Risk Assessment/DPIA?
In practice, people often say “GDPR risk assessment”, but the legal test under the UK GDPR is whether you need…
ICO fines South Staffordshire £963,900 after phishing-led breach exposed 633,887 people’s data
The ICO has fined South Staffordshire Plc and South Staffordshire Water Plc £963,900 after a phishing-led cyber attack led to…
NHS data breach disciplinary disparity: why staff rarely face dismissal
NHS staff rarely face dismissal for data breaches. Analysis of the Southport and Nottingham record access scandals and what they…
California sues 23andMe: why genetic-data security failures become a board issue
California says 23andMe failed to protect genetic data and misled consumers after the 2023 breach. Here is why the lawsuit…
ICO secures over £118,000 in confiscation orders against former RAC employees — why employee access abuse still demands hard controls
On 4 June 2026, the Information Commissioner’s Office said it had secured £118,852.32 in confiscation orders against two former RAC…
Nottingham dismissed 11 staff. Liverpool reportedly dismissed none. What NHS leaders should learn
Two NHS record-access scandals now sit side by side in the public record. On 21 May 2026, Nottingham University Hospitals…
ICO AI code of practice: what UK organisations should do before the next strategy lands
On 29 May 2026, the Information Commissioner’s Office said its 2026/27 AI work will include an AI code of practice,…