Balancing privacy and protection. Sharing student data is an essential responsibility for schools, especially for vulnerable children who face challenges requiring additional support. Whether it’s for safeguarding, accessing services, or maintaining...

Understanding the risks and compliance considerations. AI is revolutionising the workplace by enhancing operations and boosting efficiency. A notable trend is the adoption of AI-driven note-taking tools like Otter.ai and Microsoft Copilot, which...

Risks result from adverse effects of data processing and data breaches. What adverse effects do we need to consider? In doing Data Protection Impact Assessments (DPIAs), we are considering risks that result from possible harms to data subjects....

Under GDPR your suppliers (data processors or joint data controllers) are obliged to tell you "without undue delay" about a data breach they have suffered that has affected data that you are the controller for. For the avoidance of doubt, your...

Responding to Freedom of Information (FOI) requests correctly and within mandated timescales is an important part of complying with the principles of transparency and accountability under the GDPR and the Freedom of Information Act 2000. We have put...

Did you know, in 2023, 76% of UK ransomware victims were in the education sector? Schools are prime targets for cybercriminals, with phishing attacks leading the way. In fact, over 94% of educational organisations reported being targeted by phishing...

Romance scams continue to persist and evolve with technology, scammers are now targeting victims across multiple platforms including social media, gaming communities, and even professional networks like LinkedIn. According to Experian recent data...

As we celebrate UK Safer Internet Day on 11 February 2025, let’s take a moment to reflect on this year’s theme of "Too Good to Be True? Protecting yourself and others from scams online" highlighting the importance of being cautious and vigilant in...

Under UK GDPR, and as Controller, you must have a lawful basis for processing personal data (and remember that anything you do with personal data – including storing it or deleting it – counts as processing). UK GDPR won’t make processing lawful...

Data breaches, Cyber Security incidents, Subject Access Requests (SARs), and Freedom of Information (FOI) requests can often lead to a variety of complaints that require meticulous and thoughtful handling. These situations, while challenging,...