GDPR Advisors UK

14/10/2026

We believe in making GDPR compliance easy and stress-free. That's why we've created our FREE GDPR Compliance Checklist for Websites. Download it now and start protecting your customer data with confidence! 🛡️ https://www.rfr.bz/f930135cf

13/10/2026

One of the questions we get asked a lot is "Should I be registered with the Information Commissioner's Office?" Here's a little video to help you with the answer -

Enjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube.

12/10/2026

When Does an "Anonymous" Survey Lose its Anonymity?

Many employers use anonymous surveys to gather feedback from staff on workplace issues. The idea is that anonymity will encourage people to share their true, unfiltered opinions without fear of repercussions.

However, the reality is that anonymity can be easily compromised when surveys ask for too much identifying information. This happened with a friend recently when she told me about an "anonymous" survey at their workplace. In addition to the usual questions, the survey asked respondents to provide details such as their department, age, gender, ethnicity, and length of employment.

While names were not collected, in this organisation, providing those personal details makes it easy to determine who said what. In this case, my friend works in a department of just 10 people. As the youngest female employee who is also the newest hire, it doesn't take much deductive reasoning to figure out who made certain comments, even without a name attached.

This raises an important question - when does an anonymous survey cease to be anonymous? The answer is that it happens when the survey collects enough individualised information that respondents become identifiable, regardless of whether their names are included.

The goal of an anonymous survey is to create an environment where people feel safe to share their honest thoughts and feedback. But that safety and confidentiality is undermined if the survey data can be easily traced back to specific individuals.

Employers who want to get authentic, actionable insights from their staff should be careful about the type and amount of personal information they request in anonymous surveys. The more identifying details collected, the less truly anonymous the process becomes. Striking the right balance is key to getting the valuable feedback you need while respecting employee privacy.

Have you had experiences with anonymous surveys that felt less than confidential? I'd be interested to hear your perspective on this issue in the comments.

09/10/2026

I'm not a great one for putting myself out there.

As an introvert, I'm quite happy working away in the background providing a great service to my clients.

You may remember a few weeks ago we talked about my mastermind group. Well we were talking recently and I said I was representing a client who was working with Ebay and we were going to have a meeting with Ebay's legal team about data sharing. My masterminders described it as a bit David and Goliath and it is.

To me whether its eBay, Google, or GoDaddy who are attending the meeting, I'm there to represent my client and their interests, the size of the other party is irrelevant. Often the other companies will send two or three of their legal or data protection team and its a case of making sure my clients interests are protected.

In the business world, it doesn't matter how small or big you are, if you are our client, we will always fight your corner and make sure that your business interests are protected.

We know that not every business can have a data protection and information security consultant support them and that's why we developed "Your GDPR Advisor".

This low-cost membership service provides small and medium sized organisations with prompt access to expert advice, ensuring that they can navigate the complexities of data protection compliance and information security without breaking the bank.

You can find out a bit more here - https://www.rfr.bz/feb356f58. If you have questions, please feel free to contact me, I'm always happy to help.

The Subscription where you can access a qualified GDPR and information security professional to answer your questions and get professional support.

08/10/2026

This week, a client's experience brought the significance of business continuity and supplier vetting into sharp focus.

Here's what happened: My client, a small business, outsources their accountancy to another small firm, a partnership of two brothers. When one brother was hospitalised, and the other understandably preoccupied, the accountancy business grounded to a halt. The ripple effect? My client's business also came to a standstill. 🛑

With no access to make payments, check invoices, or run payroll, it was a disaster waiting to happen. The aftermath? Disgruntled suppliers, delayed staff payments, and a significant disruption to their operations.

What's the lesson here? The need for due diligence and contingency plans, especially when dealing with small businesses. It's crucial to consider scenarios where key individuals might be unavailable. Moreover, maintaining access to critical systems like banking and payments is paramount. 💡

Moving forward, we'll be revising their business practices, probably scouting for a new accountant, and evaluating suppliers.

Could your business face a similar situation? Let's ensure it doesn't.

.

07/10/2026

Email Marketing is one of the biggest challenges for businesses and one which we get lots of questions about.

We have created this booklet with 7 things you should be doing to make sure you are GDPR compliant. You can get it here - https://www.rfr.bz/f9ba15105

We use Brevo as our mail provider so your data is stored within the UK or EEA. We don't share your information with any other organisations and won't use it for anything other than the newsletter and providing your freebie.

06/10/2026

I've been dealing with my father's estate recently, and the experience with his life insurance policy from 1972 has been quite an eye-opener.

The process of getting the policy paid out has been dragging on, with various hurdles along the way, a story for another time.

The latest challenge that made me pause was their request for identity verification.

They casually suggested I "just email across a copy of my passport" - a suggestion that immediately raised security concerns for me.

When I expressed my reservations about sending sensitive documents via email, their alternative solution was equally frustrating. They suggested I get a copy certified by a local solicitor and send it by post. When I asked could I just send a photocopy, they said no, it had to be a certified copy.

This creates an interesting dilemma - either send an unverified copy through an unsecure email channel or invest time and money in getting a certified copy to send by post.

What's particularly puzzling is the apparent double standard in their verification requirements. How can they accept an uncertified digital copy via email (which could easily be manipulated), yet insist on a certified copy when sent through traditional mail?

This inconsistency in security standards seems to highlight a disconnect in their security protocols.

The whole situation raises important questions about how financial institutions handle personal data and identity verification in our increasingly digital world.

It's concerning that such verification information is being treated with different levels of scrutiny depending merely on the transmission method.

I'm curious to hear about others' experiences with insurance companies and their identity verification processes. Have you encountered similar inconsistencies in how your personal documents are handled? What do you think would be the most secure yet practical solution for situations like this?

protection

05/10/2026

I get it, sometimes data protection and information security are just not a priority.

However, sometimes not having robust practices in place starts to hold your business back and is costing you money. Those you are working with are looking for assurance about your data protection compliance and information security practices and you just can't evidence it. Maybe you don't even know where you should start and what needs to be in place.

We have taken on two clients in the last week where we are going to act as their data protection and information security advisor. We are going to get everything they need in place. And we are creating it to suit their business, no boring and complicated templates here. We'll do some training with the staff team but the whole point of this service is that it takes minimum time and knowledge from the in-house team so leaves them to do what they are good at in the business.

If you are looking for help with data protection and information security, please give us a call, we are happy to talk about the best service for you.

02/10/2026

"That's not for us."

"Yes, actually it's for every small business"

What am I talking about?

Information Security. Every business should be considering how they secure their information. Obviously a small business doesn't have the resources or budget of big business but it can be susceptible to the same threats. The good thing is that a small business can manage them better with some easy steps.

One of the most common cyber security threats is phishing emails. In a small business it is easy to identify them and delete them before they become an issue. Sharing that phishing emails have been received within a small team can also raise awareness.

When we are implementing ISO 27001, the information security standard, there are lots of good practices that small businesses could use to protect their data. It's just a case of thinking how to implement them for your business.

What do you think the risks for small business are?

01/10/2026

The Struggle to Grasp Lawful Basis under GDPR is real!

In the past week, I've found myself immersed in numerous discussions centered around the intricate concept of lawful basis under the General Data Protection Regulation (GDPR). To bring the problem home, I was reviewing the privacy policy of a care agency, I encountered a statement that left me utterly perplexed and, quite frankly, in fits of laughter. The agency declared that their lawful basis for processing personal information was simply "legitimate interests" for every single type of processing they conducted. This claim not only demonstrated a profound lack of understanding of data protection requirements but also raised concerns about the potential consequences.

One such consequence that immediately came to mind was the failure to conduct a legitimate interest assessment, which is a crucial step when claiming "legitimate interests" as the lawful basis for data processing. It became glaringly apparent that this particular company had no grasp of the appropriate lawful basis applicable to their specific circumstances, nor did they comprehend the implications of choosing the "legitimate interests" option.

These experiences have highlighted a troubling trend: organisations often default to using "legitimate interests" as their lawful basis for processing personal data, without fully considering whether this basis is truly appropriate for their specific data processing activities.

The question that begs to be asked is: "Is all of your data processing genuinely based on legitimate interests?" Answering this query requires an understanding of your organisation's data processing practices and of the various lawful bases outlined by the GDPR.

Navigating the complexities of lawful basis under the GDPR can be a daunting task, but it is an essential step in ensuring compliance and safeguarding the privacy rights of individuals. By having a clear understanding of each lawful basis, organisations can make informed decisions and implement data processing practices that align with the principles of the GDPR.

If you struggle with lawful basis let me know, I have a free training on it. Just DM me and I'll get it sent across.