GDPR Archives - Measured Collective https://measuredcollective.com/category/gdpr/ Thu, 30 Jul 2026 15:58:23 +0000 en-GB hourly 1 https://measuredcollective.com/wp-content/uploads/2023/05/cropped-mc-icon-1-120x120.png GDPR Archives - Measured Collective https://measuredcollective.com/category/gdpr/ 32 32 Agentic AI and GDPR: a practical guide to compliant adoption https://measuredcollective.com/agentic-ai-gdpr-compliant-adoption/ Thu, 30 Jul 2026 11:42:57 +0000 https://measuredcollective.com/agentic-ai-and-gdpr-can-your-dsar-process-see-the-whole-tool-chain/ An agent that can read a customer record, call a tool and write the result back into a system changes the compliance job. The question is no longer whether a model can produce useful text. It is whether the organisation can account for each personal-data use, control the agent’s permissions and explain its decisions when ...

Read more

The post Agentic AI and GDPR: a practical guide to compliant adoption appeared first on Measured Collective.

]]> Can you reuse customer data for a new purpose? ICO’s 2026 compatibility rules explained https://measuredcollective.com/can-you-reuse-customer-data-for-a-new-purpose-icos-2026-compatibility-rules-explained/ Mon, 29 Jun 2026 06:07:19 +0000 https://measuredcollective.com/?p=14980 Your team collected customer data for one stated purpose. Six months later, product wants to mine the same database for analytics, marketing wants to cross-sell, and someone suggests training an AI model on support tickets. UK GDPR’s purpose limitation principle does not ban reuse outright, but it does require compatibility. The ICO refreshed its purpose ...

Read more

The post Can you reuse customer data for a new purpose? ICO’s 2026 compatibility rules explained appeared first on Measured Collective.

]]> When Do You Need to Conduct a GDPR Risk Assessment/DPIA? https://measuredcollective.com/when-do-you-need-to-conduct-a-gdpr-risk-assessment-dpia/ Tue, 16 Jun 2026 00:17:09 +0000 https://wpstaging.measuredcollective.com/?p=12720 In practice, people often say “GDPR risk assessment”, but the legal test under the UK GDPR is whether you need a data protection impact assessment before you start processing. The question is not whether a project feels sensitive. It is whether the processing is likely to create a high risk to people’s rights and freedoms, ...

Read more

The post When Do You Need to Conduct a GDPR Risk Assessment/DPIA? appeared first on Measured Collective.

]]> ICO fines South Staffordshire £963,900 after phishing-led breach exposed 633,887 people’s data https://measuredcollective.com/ico-fines-south-staffordshire-963900-after-phishing-led-breach-exposed-633887-peoples-data/ Mon, 15 Jun 2026 22:28:38 +0000 https://measuredcollective.com/?p=14830 The ICO has fined South Staffordshire Plc and South Staffordshire Water Plc £963,900 after a phishing-led cyber attack led to the personal information of 633,887 people being extracted and published on the dark web. For compliance leaders, the point is simple. The ICO says the case exposed familiar gaps in access controls, monitoring, patching, and ...

Read more

The post ICO fines South Staffordshire £963,900 after phishing-led breach exposed 633,887 people’s data appeared first on Measured Collective.

]]> NHS data breach disciplinary disparity: why staff rarely face dismissal https://measuredcollective.com/nhs-data-breach-disciplinary-disparity/ Sun, 14 Jun 2026 03:44:52 +0000 https://measuredcollective.com/?p=14927 NHS staff rarely face dismissal for data breaches. Analysis of the Southport and Nottingham record access scandals and what they mean for data protection compliance.

The post NHS data breach disciplinary disparity: why staff rarely face dismissal appeared first on Measured Collective.

]]> Nottingham dismissed 11 staff. Liverpool reportedly dismissed none. What NHS leaders should learn https://measuredcollective.com/nottingham-liverpool-nhs-disciplinary-disparity-record-access/ Tue, 02 Jun 2026 08:30:00 +0000 https://measuredcollective.com/?p=14905 Two NHS record-access scandals now sit side by side in the public record. On 21 May 2026, Nottingham University Hospitals NHS Trust said 11 employees had been dismissed after inappropriate access to records connected to the June 2023 Nottingham attacks. In Merseyside, reporting across April and May 2026 says nearly 50 staff at hospitals in ...

Read more

The post Nottingham dismissed 11 staff. Liverpool reportedly dismissed none. What NHS leaders should learn appeared first on Measured Collective.

]]> ICO AI code of practice: what UK organisations should do before the next strategy lands https://measuredcollective.com/ico-ai-code-of-practice-what-uk-organisations-should-do-before-the-next-strategy-lands/ Mon, 01 Jun 2026 06:38:09 +0000 https://measuredcollective.com/?p=14907 On 29 May 2026, the Information Commissioner’s Office said its 2026/27 AI work will include an AI code of practice, dedicated guidance on agentic AI, and more support for consumers dealing with increasingly personalised AI products. That does not mean the code exists yet. It means the regulator has shown where UK organisations will face ...

Read more

The post ICO AI code of practice: what UK organisations should do before the next strategy lands appeared first on Measured Collective.

]]> UK Government Advances Facial Recognition Rollout — What This Means for Privacy Compliance https://measuredcollective.com/uk-facial-recognition-expansion-privacy-compliance-2026/ Sun, 26 Apr 2026 08:49:30 +0000 https://measuredcollective.com/?p=14800 UK live facial recognition expansion raises data protection concerns. What managers should watch as police biometrics use widens in 2026.

The post UK Government Advances Facial Recognition Rollout — What This Means for Privacy Compliance appeared first on Measured Collective.

]]> EDPB Issues New Guidelines on AI Systems and Personal Data — Key Changes for EU Organisations https://measuredcollective.com/edpb-ai-models-personal-data-gdpr-guidance/ Sun, 26 Apr 2026 08:49:25 +0000 https://measuredcollective.com/?p=14796 EDPB Opinion 28/2024 clarifies GDPR rules for AI models and personal data. What HR, leadership, and marketing teams must do now.

The post EDPB Issues New Guidelines on AI Systems and Personal Data — Key Changes for EU Organisations appeared first on Measured Collective.

]]> Reddit Fined £14.47m by ICO for Children’s Privacy Failures — 2026 https://measuredcollective.com/reddit-ico-fine-childrens-privacy-failures-2026/ Sun, 26 Apr 2026 08:49:23 +0000 https://measuredcollective.com/?p=14794 Reddit fined £14.47m by ICO for children's privacy failures under GDPR and DPA 2018. What this means for your organisation.

The post Reddit Fined £14.47m by ICO for Children’s Privacy Failures — 2026 appeared first on Measured Collective.

]]> EDPB Launches 2026 Coordinated GDPR Enforcement on Transparency – What Teams Need to Prepare https://measuredcollective.com/edpb-launches-2026-coordinated-gdpr-enforcement-on-transparency-what-teams-need-to-prepare/ Sun, 26 Apr 2026 06:41:27 +0000 https://measuredcollective.com/edpb-launches-2026-coordinated-gdpr-enforcement-on-transparency-what-teams-need-to-prepare/ The EDPB's 2026 coordinated enforcement action targets GDPR transparency. Learn what HR, marketing, and compliance teams should check now.

The post EDPB Launches 2026 Coordinated GDPR Enforcement on Transparency – What Teams Need to Prepare appeared first on Measured Collective.

]]> Advanced Computer Software Group Fined £3m by ICO for NHS Ransomware Data Breach — 2025 https://measuredcollective.com/advanced-computer-software-group-fined-3m-by-ico-for-nhs-ransomware-data-breach-2025/ Sun, 26 Apr 2026 06:41:22 +0000 https://measuredcollective.com/advanced-computer-software-group-fined-3m-by-ico-for-nhs-ransomware-data-breach-2025/ The ICO fined Advanced Computer Software Group £3m for the 2022 NHS ransomware data breach. Learn what this means for your data security compliance.

The post Advanced Computer Software Group Fined £3m by ICO for NHS Ransomware Data Breach — 2025 appeared first on Measured Collective.

]]> EU AI Act Prohibited Systems Ban Takes Effect — What HR and Compliance Teams Need to Know https://measuredcollective.com/eu-ai-act-prohibited-systems-ban-takes-effect-what-hr-and-compliance-teams-need-to-know/ Sun, 26 Apr 2026 06:41:20 +0000 https://measuredcollective.com/eu-ai-act-prohibited-systems-ban-takes-effect-what-hr-and-compliance-teams-need-to-know/ The EU AI Act's prohibited systems ban is now in force. Here's what HR and compliance teams need to know about banned AI tools and next steps.

The post EU AI Act Prohibited Systems Ban Takes Effect — What HR and Compliance Teams Need to Know appeared first on Measured Collective.

]]> Cross-Border Data Breach Lawsuits: Courts Are Coming for You https://measuredcollective.com/cross-border-data-breach-lawsuits-courts-are-coming-for-you/ Wed, 11 Mar 2026 06:44:46 +0000 https://measuredcollective.com/cross-border-data-breach-lawsuits-courts-are-coming-for-you/ An Estonian crypto company with no office in the US just got dragged into a California courtroom. A facial recognition firm with no UK presence just lost its appeal against a £7.5m ICO fine. The message from courts on both sides of the Atlantic is the same: if you collect data from a jurisdiction’s residents, ...

Read more

The post Cross-Border Data Breach Lawsuits: Courts Are Coming for You appeared first on Measured Collective.

]]>