GDPR Advisors UK

28/08/2026

I was party to a data breach last week.

Nothing major but still a breach. I was trying to collect a parcel for my daughter from the local shop.

The gentleman behind the counter couldn't find it in the pile, so he checked his handheld terminal.

"What's the name?" he asked.

I told him. He looked. And then he turned the screen around to show me.

There was my daughter's name and right along side it, the names of several other customers, with the status of their parcels. Clear as anything.

I didn't say a word. I'm not going to stand in the shop and lecture someone on data protection law, anyway, we regularly collect parcels from there so I didn't want to be rude. He was trying to help me find a parcel. He just didn't think about what else was on the screen when he turned it around.

But that's a data breach.

No bad intent. No negligence. Just a small moment where personal information about people who had no idea became visible to a stranger.

This is how most data breaches actually happen. Nothing exciting, nothing malicious, just an innocent mistake while trying to be helpful.

The screen that faces the wrong way. The document left open on a shared desk. The email that included one person too many.

None of these feel like data breaches in the moment. That's exactly why they happen.

27/08/2026

I've spent a lot of time recently clearing out my late dad's garage.

65 years of bits and pieces. Tools for cars he no longer has. Old paint. Chunks of wood saved because they might come in useful one day.

My sister and I have said "what is this?" so many times I've lost count.

I'll admit, we've been putting it off. We knew it needed doing. But there was always a reason not to start, until the house sale forced our hand.

It struck me that this is exactly how most organisations treat compliance.

The privacy policy that hasn't been looked at since someone wrote it three years ago. The risk register that might still reflect how the business operated before the last restructure. The policies in a folder that nobody is quite sure are still accurate.

It sits there. It makes you feel vaguely guilty. And nobody quite knows where to start.

Then something happens, a client asks for your data processing agreement, a contract requires ISO 27001, a subject access request lands in your inbox and now suddenly it's urgent.

The job you've been putting off because you don't know where to start, or don't know what half of it means, can't be put off any longer.

It doesn't have to wait until something forces your hand.

If compliance has been sitting on your to-do list making you feel guilty, reply or drop me a message. Sometimes you just need someone to help you work out what's worth keeping and what can go.

26/08/2026

Responding to SARs efficiently yet legally can overwhelm time-strapped small businesses and getting it wrong can have serious consequences. But there’s good news! I'm excited to offer a Subject Access Requests Made Simple Decision Tree. It sets out how to steer your SAR response from request to resolution.

Help those tasked with responding in a compliant way by downloading it here https://www.rfr.bz/fa57691d8

25/08/2026

You might not care about GDPR.

But the people you work with do.

And that means it matters whether you like it or not.

If you work with larger organisations — as a supplier, a contractor, a service provider — they are almost certainly asking you for things.

Your privacy policy.
A data processing agreement.
A data sharing agreement.
Evidence that you handle personal data responsibly.

They need to know that working with you doesn't create a compliance problem for them. So they ask. And they keep asking until they're satisfied.

Even your customers are doing this. People are more aware of their data rights than they were five years ago. They notice. They ask questions.

The result is a kind of don't care, made to care dynamic that pulls organisations toward compliance whether they intended to get there or not.

Now — if you're reading this, you're probably not that organisation. You care about getting this right.

But here's the question worth asking:

Do the organisations you work with?

Your suppliers, your contractors, the smaller businesses in your supply chain — can they actually meet your standards? Are the documents they're sending you doing the job they're supposed to?

Getting your own house in order is one thing. Making sure the people around you can meet your requirements is another challenge entirely.

If supplier conversations about data protection are going in circles, reply or drop me a message. It's a very common problem — and usually a straightforward one to untangle.

24/08/2026

I went for an interview last week.

Not for a job but to volunteer as a Community First Responder. Someone who goes out to patients before the ambulance arrives to keep things stable whilst help is on its way.

I'd forgotten how nerve-wracking interviews are. I pitch for work all the time, but this is different. Promoting yourself rather than your services is a strange kind of pressure.

I walked out replaying every answer, thinking about what I should have said.

Except for one question.

They asked what I understood about confidentiality.

I said: I'm a GDPR consultant.

They said: oh. Right. We don't need to know anything else.

There are some advantages to this job. 😂

We did talk through some brilliant confidentiality scenarios though — the everyday moments that catch people out. Someone spots your car outside a neighbour's house. A well-meaning comment that says a little too much.

It reminded me of a receptionist I once overheard telling a caller that a colleague "wasn't in — she's having trouble with her gallbladder again."

Completely well-meaning. Probably didn't give it a second thought.

Confidentiality isn't always dramatic. Sometimes it's just a friendly chat that goes slightly further than it should.

Oh and the feedback came back. They were impressed, apparently. Formal training starts soon.

Wish me luck. 🙂

21/08/2026

Embracing Change: The Shift to Remote Work

Remember when working from home was viewed as a hobby, not a serious professional choice? I do. When I first set up my home office, I mimicked a traditional office setting, with cabinets and printers. The goal was to prove that even though I was at home, I was still serious about my business and I had everything I needed to work effectively. You can see in the picture below my first day in the new office.

But things have changed, and for the better! Thanks to the pandemic, the world got a crash course in remote working, and we've proven that we can be efficient and balance work with life, all without stepping foot in a traditional office. Many organisations now operate a hybrid pattern of working with days in the office and days from home. This gives the best of both worlds with the exchange of ideas and team environment in the office and time to focus on specific tasks when working from home.

I enjoy working from home (with the office dog). What has been your experience of remote working and do you think perceptions have changed about home working?

20/08/2026

What is the soft-opt in?

You may have heard the phrase used but are unsure what it is.

It can be really useful for marketing purposes so I wrote a blog about it. You can find it here - https://www.rfr.bz/fbab43daa

If you have questions, just drop me a message.

19/08/2026

Website GDPR compliance can be one of the biggest headaches for organisations today. There, I've said it 🤔 It's something that businesses of all sizes struggle with, often feeling overwhelmed by the complexity of requirements and not knowing where to start.

Getting your website compliant with GDPR isn't just about having a privacy policy - it requires a comprehensive approach to how you collect, process, and protect visitor data.

Many organisations think they're compliant because they have a cookie banner, but there's so much more to consider.

I've seen countless websites that are missing decisive elements of GDPR compliance, from inadequate consent mechanisms to unclear data processing information.

That's why we've created this step-by-step checklist - to take the confusion out of website compliance.

It covers everything from essential privacy notices to lawful basis for processing, data subject rights, and security measures 📌

The checklist is completely free and designed to guide you through each requirement in a clear, practical way - https://www.rfr.bz/f890f1df6

It's the same framework we use with our clients to ensure nothing is missed in their website compliance journey.

18/08/2026

What is considered Personal Information or Personal Data under GDPR?

https://www.rfr.bz/fb084ffac

What is Personal information or Personal Data as considered by GDPR?

17/08/2026

Small business owners: Take the stress out of GDPR compliance!

Your GDPR Advisor offers weekly expert calls to address your specific data security concerns as well as email support.

Attend as needed, get tailored advice, and choose your payment plan.

Let's make GDPR manageable together!

Book an intro call or learn more: gdpradvisorsuk.com/your-gdpr-advisor/