Insights, Guides & Data Protection Resources

Manage GDPR risks across your supply chain when working with third-party data processors.Learn how to strengthen processor contracts, conduct supplier due diligence and manage sub-processors effectively. Understand Article 28 requirements, ongoing supplier monitoring and practical steps for UK GDPR compliance.

Learn how UK GDPR applies when employees and organisations use AI tools with personal data. This guide covers generative AI risks, safe prompting, supplier checks, automated decision-making, DPIAs, acceptable use policies and staff training. Discover how UK businesses can benefit from AI while protecting customer, employee and confidential information.

Learn how long UK businesses can retain personal data under UK GDPR. This guide explains the storage limitation principle, common retention periods, retention schedules, secure deletion and the risks of keeping records for too long. Discover how to create clear, purpose-based retention rules that support legal compliance, accountability and effective records management.

Learn when a Data Protection Impact Assessment is required under UK GDPR and how to complete one effectively. This step-by-step guide covers high-risk processing, DPIA screening, necessity and proportionality, risk assessment, mitigating measures, ICO consultation and team responsibilities, helping UK organisations embed privacy into projects from the planning stage.

Consent under UK GDPR is more than a checkbox. For consent to be valid, it must be freely given, specific, informed and unambiguous — and people must be able to withdraw it just as easily as they gave it. This guide explains when consent is the right lawful basis, where organisations often get it wrong, and how UK teams can collect, record and manage consent with confidence.

Cookie consent is more than adding a banner to your website. Under PECR and UK GDPR, users must have a genuine choice over non-essential cookies, with clear information, granular options and an easy way to reject or withdraw consent. This guide explains which cookies need consent, what a compliant cookie banner should look like, and how UK marketing and web teams can avoid common compliance mistakes.