Personal Data Protection

In June 2021, the EU published an adequacy decision meaning that they accept that the UK GDPR provides an equivalent level of protection for personal data transfers to that outlined within the EU GDPR.  If you never transfer personal data into or out of the UK, then the provisions for international data transfers will not […]

The first question we need to answer is: What is a document management system (DMS)?  Simply, it is a means of receiving, tracking, managing, and storing documents that is line with your data protection and privacy policies.  A query we get quite often at CSRB is, does UK GDPR apply to hard copy documents? The

A data protection audit determines whether the policies and procedures implemented to regulate data privacy and the use of data are working as planned. An audit will typically assess the organisation’s procedures, systems, records, and activities.  Using data protection audits to just tick a box on a compliance sheet misses the opportunity to add value

Earlier in this series of blogs we looked at the value that the Data Protection Officer (DPO) can bring to your organisation. We looked then at the core responsibilities of the DPO.  However, there are some aspects of Articles 37-39 of the UK GDPR, the ones that describe the function of a DPO, that make

Direct marketing consists of any marketing that relies on direct communication with individuals (data subjects). You are most likely on the receiving end of direct marketing within your business and personal life most days of the week.  There is more than a little confusion about what is acceptable under the law, or indeed which regulations

UK GDPR Article 5 sets out seven key principles which lie at the heart of all personal data processing. There are two paragraphs that stand out, the first maps out the data processing principles, and the second focuses on accountability. It states: ‘The [data] controller shall be responsible for, and be able to demonstrate compliance

One of the seven data processing principles of the UK GDPR is ‘accountability’.  You must be able to demonstrate, to both external and internal data subjects, your adherence and compliance to UK data protection legislation. The UK GDPR states that: ‘You need to put in place appropriate technical and organisational measures to meet the requirements

Have you had a letter from the ICO about the data protection fee? Have you carried out a self-assessment to see if you should be paying the fee? Read our latest blog to learn more about an area of data protection that can come as a surprise to business owners. The Information Commissioners Office (ICO)

Your organisation’s Privacy Notice is more than just part of your website, it is the public aspect of your data protection compliance. Learn more about this vital document here.  In earlier pieces we have looked at the rights of those whose personal data you hold to be informed about how their data is collected and

In one of our earlier blogs, we looked at the roles of the Data Controller and Data Processor.  As a brief reminder the data controller legally owns the personal data, decides how personal data can be used and how it is stored, while the data processor acts on behalf of the data controller. The processor