Contents

1. How UK GDPR Came About
2. What Stayed the Same
3. What Changed
4. International Data Transfers Post-Brexit
5. If Your Business Operates in Both the UK and EU
6. UK GDPR Reform Agenda in 2026

How UK GDPR Came About

Here’s UK GDPR explained from the start, because the timeline shapes the rules you follow today:

• 25 May 2018: GDPR starts applying across the EU, including the UK. The Data Protection Act 2018 comes into force on the same day, filling in the areas GDPR left to national law.
• 31 January 2020: The UK leaves the EU. A transition period keeps EU GDPR in place.
• 1 January 2021: The transition period ends. The European Union (Withdrawal) Act 2018 turns EU GDPR into domestic law, with amendments so it works in a UK-only context. That version becomes UK GDPR.
• 28 June 2021: The European Commission adopts adequacy decisions for the UK, so data keeps flowing from the EU.
• 19 June 2025: The Data (Use and Access) Act 2025 receives Royal Assent. Its main data protection changes take effect on 5 February 2026.

Post-Brexit GDPR in the UK is really two texts read together. UK GDPR sets the core rules, and the Data Protection Act 2018 adds the exemptions, extra conditions and enforcement powers the ICO uses.

What Stayed the Same

The core of the law didn’t move. These areas still match closely between the two regimes:

• The six principles in Article 5, from lawfulness and fairness through to integrity and confidentiality, plus the duty to show accountability
• The original lawful bases for processing, although the UK has since added one (covered below)
• Individual rights, including access, rectification, erasure, restriction, portability and objection
• Accountability duties, such as records of processing, DPIAs, and data protection by design
• DPO requirements, with the same three triggers set out in Article 37
• Breach reporting, with 72 hours to tell the regulator and no undue delay in telling people at high risk

If you built a GDPR programme before 2021, much of it still works in the UK today.

What Changed

The GDPR Brexit changes, and the differences UK GDPR has built up since, fall into four areas:

• The regulator: The ICO now oversees UK processing on its own. EU supervisory authorities have no say over UK-only processing, and the ICO has no say inside the EU.
• International transfers: The UK makes its own adequacy decisions and uses its own transfer tools, such as the International Data Transfer Agreement.
• The one-stop shop: The EU’s lead authority system no longer covers the UK. EU firms that target UK customers without a UK base need a UK representative under Article 27 of UK GDPR.
• Reform: The Data (Use and Access) Act 2025 has started a gap between the two texts that will keep widening.

Some of the differences look small on paper but change real decisions:

The UK age comes from Article 8, which matters to any online service that relies on children’s consent. In any EU GDPR UK comparison, transfers create the most ongoing work, so they get their own section next.

International Data Transfers Post-Brexit

For GDPR after Brexit, UK businesses need to keep an eye on three main data routes:

• UK to EU: The UK recognises the EEA as adequate, so personal data can flow from the UK into the EU without extra paperwork.
• EU to UK: The European Commission renewed its UK adequacy decisions in December 2025. They now run until 27 December 2031, with a mid-point review after four years.
• UK to US: Organisations certified under the UK Extension to the EU-US Data Privacy Framework can receive UK data directly. That route opened on 12 October 2023. For any other US recipient, you need the IDTA or the UK Addendum to the EU’s standard contractual clauses, plus a transfer risk assessment under the rules in Chapter V.

EU adequacy isn’t permanent. The Commission monitors UK law and can suspend or amend its decisions if UK protection drifts too far, and the 2025 reforms will feature in its next review. If adequacy fell away, every EU business sending you personal data would need standard contractual clauses and a transfer assessment, adding cost and delay to routine data flows.

If Your Business Operates in Both the UK and EU

Dual compliance doesn’t mean running two programmes. You keep one set of policies and manage two regulatory relationships:

• One policy set: You can run one set of policies built on GDPR. UK differences then go into short annexes covering lawful bases, cookies, automated decisions, and transfers.
• EU representative: If you have no EU establishment but offer goods or services to people in the EU, or monitor their behaviour there, Article 27 of EU GDPR requires you to appoint a representative in the EU. The exception is processing that’s occasional and low risk.
• Complaints: UK residents complain to the ICO, and EU residents complain to the authority in their own country. Without an EU establishment, you could face more than one EU authority over the same issue. Since June 2026, UK law has also required you to handle complaints directly and acknowledge each one within 30 days.
• Breach reporting: A single breach can mean reports to the ICO and to one or more EU authorities, each within 72 hours.

UK GDPR Reform Agenda in 2026

The Data (Use and Access) Act’s main data protection changes took effect on 5 February 2026. Some loosen the rules, and others tighten them.

What’s relaxed:

• Recognised legitimate interests: This seventh lawful basis covers listed purposes, such as preventing crime, safeguarding vulnerable people and responding to emergencies, without the usual balancing test.
• Automated decisions: Articles 22A to 22D allow more solely automated decisions, provided safeguards are in place. The limits stay tighter where special category data is involved.
• Cookies: Some low-risk cookies, such as basic analytics and those that remember a user’s preferences, no longer need consent.
• Subject access: Searches now only need to be reasonable and proportionate.
• Transfers: The new “not materially lower” test replaces the stricter equivalence standard.

What’s stricter:

• Marketing fines: Fines under PECR, the UK’s electronic marketing and cookie rules, can now reach £17.5 million or 4% of worldwide turnover, matching UK GDPR.
• Complaints: Since 19 June 2026, you must give people a way to complain to you directly.
• Children: Online services likely to be used by children must factor in children’s higher protection needs when designing their data protection measures.
• The regulator: The ICO is moving to a new structure as the Information Commissioner.

Each relaxation is optional. You can keep your existing EU-standard approach, which is the simpler route if you serve both markets.

UK GDPR vs EU GDPR isn’t a choice between two programmes. You need one programme with UK and EU annexes, kept up to date as both sides change. For a full UK GDPR guide, our GDPR hub covers lawful bases, rights and transfers in depth.

If you need a presence in the EU, our GDPR EU representative service covers it. Need dual UK-EU compliance support? Talk to KEWDATA.

The post UK GDPR vs EU GDPR: What Actually Changed and Why It Matters appeared first on KEWDATA.

• A global platform fined over £14 million for failing to protect children
• A water company fined after a cyber attack went unnoticed for almost two years
• Nuisance marketers sending millions of illegal texts

Each case exposes a gap that plenty of other organisations still have. Here are this year’s major ICO enforcement actions, what went wrong in each, and the lessons you can apply to your own business.

Contents

1. ICO’s 2026 Enforcement Priorities
2. Notable Fines in 2026
3. Most Common Reasons for ICO Fines
4. What the ICO Looks for in a Regulatory Investigation
5. How to Use Enforcement Cases to Audit Your Own Business
6. What Happens After an ICO Fine?

ICO’s 2026 Enforcement Priorities

The ICO has been open about where it’s looking. Its focus areas for this year are:

• Children’s privacy: The Children’s Code strategy drove both of this year’s children’s data fines, and the ICO is extending that work to mobile games.
• AI and biometrics: The ICO’s AI and biometrics strategy, updated in March 2026, covers automated decisions in recruitment and scrutiny of foundation models. Since May 2026, the ICO has also had a statutory duty to prepare a code of practice on AI.
• Online tracking: The ICO’s 2025/26 annual report says its cookie compliance work has brought 979 of the top 1,000 UK websites into line.
• Direct marketing: Nuisance calls and texts remain a steady source of fines. Since 5 February 2026, the Data (Use and Access) Act 2025 has raised the maximum PECR fine from £500,000 to £17.5 million or 4% of global turnover, whichever is higher.

Notable Fines in 2026

Four cases stand out among 2026’s UK data protection fines, each for a different reason.

Reddit: £14.47 million

In February, the ICO fined Reddit £14.47 million for failing to protect children’s data. Reddit’s terms barred under-13s, but the platform had no age checks in place to enforce that rule. That meant it had no lawful basis for processing younger children’s data. It also didn’t assess the risks to child users in a DPIA until January 2025. This is the largest of the GDPR fines UK businesses have faced in 2026, and Reddit has said it will appeal.

The lesson: A rule in your terms of service isn’t a control. If children could use your service, you need to know who your users are and assess the risks before you process their data.

South Staffordshire Water: £963,900

In May, the ICO fined South Staffordshire Plc and South Staffordshire Water Plc £963,900 after a cyber attack affected 633,887 people.

• How it started: A phishing email installed malware that went undetected for about 20 months.
• What the ICO found: Only about 5% of the IT environment was monitored. Unsupported software, including Windows Server 2003, was still in use, and vulnerability scanning wasn’t carried out regularly.
• The reduction: The ICO cut the fine by 40% because the company admitted liability early and accepted the findings.

The lesson: You can’t protect what you don’t watch. Monitoring, patching and least-privilege access are legal requirements, not optional extras.

KRA Consultancy: £300,000

In May, the ICO fined KRA Consultancy £300,000 for sending more than 5.5 million unsolicited marketing texts, some of them posing as bailiff notices. The messages led to more than 60,000 complaints. The ICO also issued an enforcement notice banning the firm from marketing without consent.

The lesson: Bought-in marketing lists carry your risk, not the seller’s. Check consent before you send anything.

MediaLab (Imgur): £247,590

In February, the ICO fined Imgur’s owner MediaLab £247,590 for processing children’s data without a lawful basis between September 2021 and September 2025. It had no age checks, no parental consent for under-13s and no completed DPIA.

The lesson: The fine was smaller than Reddit’s, but the failings were the same. Size doesn’t change what the ICO expects.

Beyond fines, ICO action in 2026 has included more penalties for nuisance calls and texts, plus reprimands for public bodies, among them police forces.

Most Common Reasons for ICO Fines

Look across GDPR enforcement UK cases and the same failures keep showing up:

• Failure to put appropriate security in place: Article 32 requires security that matches the risk. Security failings sit behind several of the largest data breach fines UK organisations have faced.
• Inadequate consent or no lawful basis: This covers marketing without consent under regulation 22 of PECR. It also covers processing children’s data without the parental consent Article 8 requires for online services offered to under-13s.
• Failure to respond to DSARs: Article 15 gives people the right to access their data. The ICO has used reprimands and enforcement notices against organisations with request backlogs, and in September 2026 it opened an investigation into Police Scotland’s response times.
• Inadequate breach reporting: Article 33 sets a 72-hour deadline to report a breach to the ICO. Late detection eats into that window before it starts.
• Poor third-party controls: Processors need contracts with the terms Article 28 requires, and those contracts need checking. A supplier’s breach can quickly become yours.

What the ICO Looks for in a Regulatory Investigation

The size of an ICO GDPR fine follows the factors in Article 83. They include:

• The nature, gravity and duration of the breach
• Whether it was intentional or negligent
• What you did to limit harm
• The measures you already had in place
• Your previous breaches
• How fully you cooperated
• The types of data involved

UK GDPR penalties go up to £17.5 million or 4% of worldwide annual turnover, whichever is higher.

In practice, investigators look for evidence in four areas:

• Documentation: Article 5(2) makes you responsible for showing compliance, not just achieving it. Records of processing, policies and DPIAs are your proof.
• Due diligence: They check for risk assessments, supplier checks, and security testing carried out before anything went wrong.
• DPO involvement: They ask whether your DPO was consulted, and whether you recorded their advice and acted on it.
• Breach response quality: They look at how fast you spotted the breach, contained it, reported it, and told the people affected.

Cooperation counts. ICO penalties come down when organisations engage openly, as the 40% reduction for South Staffordshire shows.

How to Use Enforcement Cases to Audit Your Own Business

Each 2026 case maps to a question you can ask about your own organisation. Treat any “no” or “not sure” as a priority.

• Security: Do you know what share of your IT environment you monitor? Have you retired unsupported software and scanned for vulnerabilities this quarter?
• Lawful basis: For every marketing list, can you prove consent or a valid soft opt-in? If children could use your service, do you know their ages?
• DPIAs: Does every high-risk processing activity have a DPIA that’s current?
• DSARs: Could you answer a subject access request in full within one month today?
• Breach response: Would you detect an intrusion yourself, or wait for a ransom note? Could you report within 72 hours?
• Third parties: Does every processor have a compliant contract, and when did you last check how they handle your data?

What Happens After an ICO Fine?

The penalty is only the start. Here’s what follows:

• Publication: The ICO publishes penalty notices and press releases, so customers, investors, and the media see the findings.
• Appeal: You can appeal to the First-tier Tribunal, as Reddit plans to do. An appeal can take years to resolve.
• Mandatory remediation: Enforcement notices can order specific changes, like the ban on marketing without consent in KRA’s case.
• Continued monitoring: The ICO keeps watching after the fine. It’s still reviewing the age checks Reddit has since introduced.
• Compensation claims: Article 82 gives people the right to claim compensation for damage caused by a breach.

You’ll get a better outcome by engaging cooperatively. Report on time, be candid about what happened, and accept findings early where they’re fair.

Every ICO fine in 2026 traces back to a gap the organisation could have found first. A GDPR audit from our team tests the areas you choose against these exact failure points. You get a ranked list of what to fix first.

Concerned about your ICO risk exposure? Book a GDPR audit.

The post ICO Enforcement in 2026: Key Fines, Trends, and Lessons for UK Businesses appeared first on KEWDATA.

Contents

1. The Risk-Tiered Structure of the EU AI Act
2. Which UK Businesses Are In Scope?
3. High-Risk AI Systems: Is Yours on the List?
4. Key Deadlines in 2026
5. How the AI Act Relates to GDPR
6. What UK AI Policy Says
7. Practical First Steps

The Risk-Tiered Structure of the EU AI Act

If you want the EU AI Act explained in one sentence, here it is: the more harm an AI system could cause, the more rules it carries. The Act sorts AI into four tiers.

• Unacceptable risk (banned): These practices have been prohibited since 2 February 2025. They include social scoring, manipulative techniques that exploit people’s vulnerabilities, untargeted scraping of facial images to build recognition databases, and emotion recognition in workplaces and schools outside medical or safety uses. Two more bans start on 2 December 2026: AI that generates non-consensual intimate imagery, and AI that generates child sexual abuse material.
• High risk (regulated): Examples include credit scoring, CV screening and pricing for life and health insurance. These systems must meet strict requirements before they reach the market and while they’re in use.
• Limited risk (transparency obligations): Chatbots must tell people they’re talking to AI, and deepfakes and AI-generated content must be labelled or marked. These duties apply from 2 August 2026.
• Minimal risk (no specific obligations): Spam filters, stock forecasting tools and AI in video games fall here. The Act encourages voluntary codes of conduct for these systems.

General-purpose AI models, such as large language models, have their own set of rules. Those have applied to model providers since August 2025.

Which UK Businesses Are In Scope?

The Act follows where the AI has its effect, not where the company is based. EU AI Act obligations reach:

• Providers that place AI systems or general-purpose models on the EU market, or put them into service there, wherever they’re established
• Deployers established in the EU, and providers and deployers outside the EU whose AI output is used in the EU
• Importers and distributors that bring AI systems into the EU market

You don’t need an office, staff or servers in the EU to be caught. A London fintech whose credit model scores applicants in Ireland is in scope. So is a UK insurer pricing health cover for customers in Spain. Non-EU providers of high-risk systems must also appoint an authorised representative in the EU before they place those systems on the market.

High-Risk AI Systems: Is Yours on the List?

Annex III of the Act lists eight areas where AI use counts as high-risk:

1. Biometrics: remote biometric identification, biometric categorisation and emotion recognition, where the law permits them
2. Critical infrastructure: safety components in digital infrastructure, road traffic, and the supply of water, gas, heating and electricity
3. Education and vocational training: admissions, grading, and monitoring students during tests
4. Employment: recruitment, CV filtering, decisions on promotion and dismissal, task allocation and performance monitoring
5. Essential services: eligibility for public benefits, creditworthiness checks and credit scoring, risk assessment and pricing for life and health insurance, and emergency call triage
6. Law enforcement
7. Migration, asylum and border control
8. Administration of justice and democratic processes

AI built into products already covered by EU safety law, such as medical devices and machinery, can also be high-risk under Annex I.

For high-risk AI, UK firms in fintech, healthtech and insurance should look first at four scenarios:

• Credit scoring models used on EU applicants. Fraud detection is excluded.
• Underwriting or pricing tools for life or health cover sold to EU residents.
• AI diagnostic software sold as a medical device in the EU.
• Recruitment tools that screen candidates for EU roles.

An Annex III system can avoid the high-risk label if it only performs a narrow procedural task or doesn’t materially shape the outcome of a decision. That exemption never applies to systems that profile people, and you must document your reasoning either way.

If a system is high-risk, the AI Act requirements include:

• A risk management system
• Governance for training data
• Technical documentation
• Automatic logging
• Human oversight
• Standards for accuracy and cybersecurity
• Registration in the EU database

Key Deadlines in 2026

The Digital Omnibus on AI, Regulation (EU) 2026/1744, came into force on 27 July 2026 and moved the high-risk dates back. EU AI Act 2026 planning now means meeting transparency duties today and preparing high-risk systems for 2027.

Fines reach €35 million or 7% of worldwide annual turnover for banned practices, and €15 million or 3% for most other breaches. The Omnibus also softened the AI literacy duty. You now need to take measures that support staff AI literacy rather than guarantee a set level.

How the AI Act Relates to GDPR

The AI Act works alongside data protection law. It doesn’t replace it. Four overlaps matter most:

• DPIAs: A high-risk AI system that processes personal data will almost certainly need a data protection impact assessment under Article 35 of UK GDPR and its EU equivalent. AI Act deployers must use the provider’s instructions to complete theirs. Deployers of credit scoring and life or health insurance pricing tools must also carry out a fundamental rights impact assessment, which can now build on the DPIA.
• Transparency: Your privacy information has to explain how you use personal data in AI. The AI Act adds separate disclosure duties for chatbots and AI-generated content.
• Human oversight: High-risk systems must be designed so a trained person can monitor them, step in, and override the output.
• Automated decisions: In the EU, Article 22 of the GDPR still restricts solely automated decisions with legal or similarly serious effects. The UK replaced its version with Articles 22A to 22D on 5 February 2026. The UK rules allow more automated decisions, provided safeguards are in place, with stricter limits where special category data is involved. If you serve both markets, design to the EU standard.

What UK AI Policy Says

The AI regulation UK businesses face at home looks very different. The UK has no AI Act, and the government hasn’t introduced an AI bill. Existing regulators apply five cross-sector principles in their own areas. The January 2025 AI Opportunities Action Plan also pushes regulators to support AI growth.

The ICO leads on the data protection side:

• It published an AI and biometrics strategy in June 2025.
• Since May 2026, it has had a statutory duty to prepare a code of practice on AI and automated decision-making.
• It consulted on updated guidance on automated decision-making and profiling in spring 2026.

Sector regulators, including the FCA and Ofcom, set their own AI expectations on top.

The divergence creates risk. The UK widened the rules on automated decisions, while the EU added a full regime written specifically for AI. Meeting UK AI compliance standards alone won’t satisfy the EU, so firms active in both markets need to map their systems against both sets of rules.

Practical First Steps

You have time before the high-risk deadlines, but not much. These four steps put you in control:

1. Build an AI inventory: List every AI system you build, buy or embed, including AI features inside SaaS tools. Record who owns each one, what data it uses, and where its output goes.
2. Classify the risk: Place each system in a tier, and write down your reasoning, especially if you rely on an Annex III exemption.
3. Run a gap assessment: Compare high-risk and limited-risk systems against the requirements that apply to them. Check your vendor contracts as well, because providers must give deployers the information they need to comply.
4. Set up a governance framework: For AI governance, UK and EU expectations overlap: a named owner, a written AI policy, a human oversight process, staff training, an incident process and regular reviews.

The EU AI Act puts real duties on UK firms already. The transparency rules apply now, and the high-risk obligations follow in December 2027. Our team helps you inventory your AI, classify each system and close the gaps, drawing on regulator-facing experience from regulated finance. Our AI Act compliance service covers each step.

Where your models process personal data, our AI and LLM data protection support covers that side too.

Get your AI Act readiness assessment from KEWDATA.

The post The EU AI Act: What UK Businesses Must Know in 2026 appeared first on KEWDATA.

What a DPO Actually Does Day-to-Day

Under Article 37 of UK GDPR, you must appoint a DPO in three situations:

• You’re a public authority.
• Your core activities involve regular and systematic monitoring of people on a large scale.
• Your core activities involve large-scale processing of special category or criminal offence data.

Article 37 also lets the DPO be an employee or someone working under a service contract. Both options in this comparison are equally lawful.

The DPO’s Core Tasks Under Article 39

The DPO’s tasks are set out in Article 39:

• Advising: telling the organisation and its staff what data protection law requires of them, including advice on data protection impact assessments.
• Monitoring: checking compliance with UK GDPR and your own policies, including staff training and internal audits.
• Acting as the contact point: for the ICO, and for people with questions about how you use their data.

Article 38 sets the conditions. The DPO must be involved early in data protection issues and given the resources to do the job. They take no instructions on how to carry out their tasks, and they report to your highest level of management. Any other duties they hold must not create a conflict of interest. The same rules apply if you appoint a DPO voluntarily. And whoever you appoint, your organisation stays responsible for compliance. The DPO advises and monitors.

In practice, a DPO’s week might include:

• reviewing a new supplier contract
• answering a product team’s question about a planned feature
• escalating a difficult subject access request
• assessing a possible breach against the 72-hour reporting deadline
• preparing a report for the board

The time this takes follows the volume and risk of your processing more closely than your headcount. A 60-person healthtech handling patient records can need more DPO time than a 400-person business holding little beyond HR and marketing data. The work also arrives in bursts. Weeks can pass quietly, then a breach, a DPIA and a client audit land in the same fortnight.

The Cost of Hiring an In-House DPO

Indeed’s UK salary data, drawn from 329 advertised salaries and updated on 2 October 2026, puts the average DPO salary in the UK at £46,635. Most advertised roles fall between about £30,500 and £71,300. London pays more: Glassdoor’s figure for the city, based on 62 self-reported salaries as of September 2026, is £69,638.

Salary is only the starting point. Employing a DPO adds:

• Employer National Insurance: 15% on earnings above £5,000 a year for 2026/27.
• Pension: at least 3% of qualifying earnings under auto-enrolment.
• Training and CPD: keeping up with the Data (Use and Access) Act 2025, ICO guidance and sector rules.
• Professional membership: annual IAPP membership, which also covers the certification maintenance fee for qualifications such as CIPP/E.
• Recruitment: agency fees, or the internal time spent hiring.
• Cover: someone has to step in during holidays, sickness and notice periods.

National Insurance and pension alone add this to the salary figures above:

Two more points affect the real cost of a DPO. First, Article 37 requires the DPO to have expert knowledge of data protection law and practice. In fintech, healthtech or insurance, that points to the upper end of the salary range, not the average. Second, a single hire is one person. If your processing needs more than one person’s time, the cost of in-house cover rises with it.

The Cost of an Outsourced DPO Service

Outsourced DPO services are priced as a retainer, and the price follows the work. The main drivers are:

• how much personal data you process, and how sensitive it is
• how many countries and regulators you deal with
• how many DSARs, incidents and DPIAs you expect in a year
• the response times you need

We haven’t quoted a market range for outsourced DPO cost here. Published prices are hard to compare like for like: one provider’s retainer includes DSAR handling and breach support, while another charges for both separately. When you compare DPO service prices, compare what’s in scope, not just the monthly figure.

As an example of scope, here’s how KEWDATA’s DPO as a service is set up.

Included:

• a named DPO who holds CIPP/E and is registered with the ICO and other European regulators
• ongoing advice and compliance monitoring
• monthly reporting and an annual review
• escalation support for difficult subject access requests
• availability during UK business hours

Charged extra:

• full DSAR response management
• urgent or out-of-hours incident support

The retainer can be adjusted as your processing grows or shrinks, and there’s no long-term lock-in. An employee’s cost doesn’t flex like that.

Capability Comparison

Cost is only half the decision. Here’s how the two options compare on what the DPO can actually do.

For regulated businesses, the external DPO benefits that count most are breadth and independence. A DPO who has handled ICO correspondence for other fintech and healthtech clients brings that experience to your first incident. An in-house DPO’s strength is presence: they hear about the new project in a meeting, not three weeks later in an email.

Risk Factors for Each Option

In-house

• Key person risk: If your only DPO resigns or goes on long-term leave, the legal duty to have one doesn’t pause. Replacing a specialist can take months.
• Knowledge gaps: One person rarely covers law, IT security and your sector equally well.
• Conflict of interest in smaller organisations: In a small business, the obvious internal candidates are the Head of IT, the COO or the head of HR. All three decide how personal data is used, so they’d be monitoring their own decisions. That’s exactly the conflict Article 38 rules out.

Outsourced

• Response time: An external DPO works within agreed hours. KEWDATA’s service covers UK business hours, with urgent out-of-hours incident support available at extra cost. Decide in advance how a weekend breach reaches the right person.
• Less day-to-day presence: Staff may not think to ask someone outside the building. Regular check-ins and a clear route for questions close most of that gap.
• Onboarding overhead: The first weeks go on learning your systems, data flows and suppliers. That takes time from your team. A provider who already knows your sector shortens it.

Which Businesses Suit Each Option?

Small businesses

Start by checking whether you need a DPO at all, because many small businesses don’t. If you do, an outsourced DPO is the more practical fit. You get expert knowledge without a full salary, and without the conflict problems of handing the role to an existing manager.

Mid-market businesses in regulated sectors

Outsourced or hybrid. One workable model pairs an internal privacy lead, who handles day-to-day questions and records, with an outsourced DPO who provides independent advice, monitoring and board reporting.

Large enterprises with complex processing

An in-house DPO, supported by outsourced advisory. A full-time DPO makes sense once the workload fills the role. Outside specialists can then cover peaks, other jurisdictions, or areas such as AI.

Comparing Your DPO Options?

If an outsourced DPO fits your business, KEWDATA provides a named, CIPP/E-certified DPO, backed by a team with regulator-facing experience from heavily regulated finance. UK and European requirements are covered from one provider, with no long-term lock-in. Your organisation stays responsible for compliance, with an independent adviser reporting to your board.

Explore KEWDATA’s outsourced DPO service

The post In-House DPO vs Outsourced DPO: Which Is Right for Your Business? appeared first on KEWDATA.

Knowing the difference helps you ask for the right thing, pay for the right amount of work, and get an outcome you can use. A quick check suits some situations. Others need evidence that stands up to scrutiny.

What Is a GDPR Review?

A GDPR review is a light-touch, advisory check. It looks at one area of your data protection work, or takes a quick read across several, and tells you whether anything looks wrong.

A review might focus on:

• Consent: whether your forms, cookie banner and marketing opt-ins collect valid consent
• Privacy notices: whether they give people the information required by UK GDPR Article 13 and Article 14
• Staff training: whether people know how to spot a breach or a subject access request
• Breach procedure: whether your team knows who to tell and how fast

A review relies on conversations and a sample of documents rather than testing. Findings might come back verbally or as a summary, and the work costs less and finishes sooner than an audit.

A GDPR compliance review is a good sense-check when you want to know whether a specific area needs attention. It isn’t evidence that you’re compliant.

What Is a GDPR Audit?

A GDPR audit is formal, documented, and evidence-based. Instead of asking whether things look right, it tests whether what you do matches what your policies say, and whether both match what the law requires. Some providers call it a GDPR compliance audit, but the substance is the same.

An audit covers an agreed scope. That can mean all of your processing activities, or the business unit, system or set of processes that carries the most risk.

What the auditor examines:

• processing activities and your record of processing
• technical and organisational measures, such as access controls, encryption and retention
• contracts with processors and other third parties
• training records
• breach logs and subject access request logs

The audit ends with a written gap report and a plan for fixing what it finds.

Internal or external? You can run a GDPR internal audit with your own compliance team, or bring in an external auditor. An internal audit costs less and builds in-house knowledge. An external one brings independence, which matters if the findings will go to a board, an investor or a regulator.

Whichever route you take, the ICO’s data protection audit framework is a useful benchmark. It sets out nine toolkits covering the areas the regulator looks at in its own audits, starting with accountability. The ICO designed it for larger organisations and points small businesses to its self-assessment resources instead.

When Should You Get a Review vs an Audit?

What’s prompting the question, and who will read the answer, decides which one fits. The table below matches common situations to the better option and the reason for it.

Both can produce a GDPR gap analysis. The difference is depth: a review’s gap analysis reflects what people told the reviewer, while an audit’s reflects what the auditor tested.

What Does a GDPR Audit Actually Cover?

The six areas below form the core of a GDPR audit checklist. Each one tests a different link between your paperwork and what happens day to day.

1. Document review: Policies, privacy notices, records of processing, DPIAs, retention schedules, and earlier audit reports. The auditor checks that they exist, that they’re current, and that they agree with each other.
2. Data mapping validation: Your data map or record of processing is checked against how data actually moves through your systems, integrations and suppliers. Gaps show up here when new tools get added faster than records get updated.
3. Staff interviews: Conversations with the people who handle data, such as HR, marketing, developers and system administrators, to understand how processing works in practice.
4. System checks: A review of access controls, encryption, retention settings and logging, to confirm that the measures in your documents exist in your systems.
5. Supplier contract review: Processor contracts are checked for the terms required by UK GDPR Article 28, and transfers outside the UK are checked for a valid transfer mechanism.
6. Training records: Who has been trained, when, and whether the content fits their role.

In a UK GDPR audit, the benchmark is UK GDPR and the Data Protection Act 2018. If you also process data about people in the EU, the auditor can test against the EU GDPR as well, since the two regimes differ in places.

What Do You Get at the End?

A review might end with a conversation. An audit ends with documents you can act on and share with others who need to see them:

• Gap report: What the auditor tested, what they found, and which legal requirement each gap relates to.
• Risk-rated findings: Each gap rated by severity, so you can see what carries real regulatory risk and what’s administrative.
• Remediation roadmap: Prioritised actions, each with an owner and a suggested timescale.
• Executive summary: A short version for your board or leadership team.

An audit tells you what to fix. Making the fixes is a separate piece of work, which your team can take on or bring in outside help for.

How Often Should You Audit?

UK GDPR doesn’t set a fixed audit frequency, but it does expect ongoing checks. Under Article 5(2), you must be able to show that you comply. Article 24(1) says your measures should be reviewed and updated where necessary, and Article 32(1)(d) asks for a process to regularly test, assess and evaluate your security measures.

We recommend a full audit once a year as a default, with a lighter review in between if your processing hasn’t changed much.

Some events justify an audit outside that cycle:

• a personal data breach
• a major system change, such as a move to a new platform or cloud provider
• entering a new market, particularly one with its own data protection law
• a merger, acquisition or restructure
• a new DPO starting who needs an accurate baseline

Ready to Book a GDPR Audit?

If you need evidence rather than reassurance, an audit is the right call. Our GDPR audit service covers an agreed scope, tests your documents against your systems, and ends with a risk-rated roadmap. Get in touch, and KEWDATA will help you agree on the scope that fits your organisation.

Book a Free Audit Scoping Call

The post GDPR Audit vs GDPR Review: Understanding the Difference appeared first on KEWDATA.

This DPIA guide answers all three. It covers the legal triggers, the projects where a DPIA makes sense anyway, what a finished assessment contains, and how long the work takes. If you’re working out how to do a DPIA for the first time, start with the definition.

What Is a DPIA?

A DPIA is a structured risk assessment you carry out before processing personal data in a way that’s likely to put people at high risk. The duty comes from Article 35 of UK GDPR. The ICO describes it as “a process designed to help you systematically analyse, identify and minimise the data protection risks” of a project or plan.

Two things set a DPIA apart from other compliance paperwork:

• It looks forward: Article 35(1) requires the assessment before the processing starts. A DPIA written after launch can’t shape decisions that have already been made.
• It focuses on people: The risks it weighs are risks to individuals, such as discrimination, fraud, or losing control of their personal data. Risks to your business come second.

A DPIA doesn’t have to remove every risk. Its job is to bring risk down and help you judge whether what’s left is acceptable.

The Data (Use and Access) Act 2025 left the UK GDPR DPIA duty in place. The ICO has flagged that its DPIA guidance is under review following the Act.

When Is a DPIA Legally Required?

The law names three situations where a DPIA is always required, and the ICO adds a list of its own. Meeting any one of them makes a DPIA mandatory.

The three triggers in Article 35(3)

• “Systematic and extensive” profiling: The wording comes straight from Article 35(3)(a). It means automated evaluation of people, including profiling, that leads to decisions with legal or similarly serious effects on them. Automated credit decisions and recruitment screening are common examples.
• Large-scale special category or criminal offence data: For example, a private healthcare provider’s patient records, or a background-check firm’s conviction data.
• Large-scale public monitoring: Systematic monitoring of a publicly accessible area, such as a network of smart cameras across a chain of shopping centres.

The ICO’s list

Under Article 35(4), the ICO publishes its own list of processing that needs a DPIA. The ICO’s guidance on when you need a DPIA names ten types:

• new or novel uses of technology, including AI
• decisions about access to a product, service or benefit that rely on automated decisions, profiling or special category data
• large-scale profiling
• biometric data
• genetic data
• matching or combining data from several sources
• invisible processing, where you didn’t collect the data from the person and telling them would take disproportionate effort
• tracking location or behaviour
• targeting children or other vulnerable people
• processing where a breach could put someone’s physical health or safety at risk

Five of these (new technology, biometrics, genetic data, invisible processing and tracking) trigger a DPIA only when they come with at least one other risk factor from the European guidelines the ICO points to.

Prior consultation when high risk remains

Sometimes a DPIA shows a high risk you can’t reduce. In that case, you must consult the ICO before processing starts. Under Article 36 of UK GDPR, the ICO has up to eight weeks to give written advice, and it can extend that by six weeks for complex processing. You can’t go ahead until that consultation is done, so the time belongs in your project plan from day one.

What happens if you skip it?

Leaving out a required DPIA breaches Article 35 in its own right. The ICO’s guidance on what a DPIA is warns that this “may leave you open to enforcement action”, including a fine of up to £8.7 million or 2% of global annual turnover, whichever is higher. It also leaves you with no record of how you weighed the risks if a complaint or breach follows.

When Is a DPIA Good Practice Even If Not Mandatory?

Plenty of projects fall short of the legal triggers but still carry enough risk to justify an assessment. The ICO’s own advice is that “if in any doubt, we would always recommend that you do a DPIA”. Three situations deserve one:

• New products that use any personal data: An app, a customer portal or a loyalty scheme. Changing a design on paper is far cheaper than rebuilding a feature after launch.
• New third-party data sharing: Sending customer data to a partner, a marketing platform or a new processor. The DPIA records what you share, why, and which contract terms protect it.
• New surveillance or monitoring systems: CCTV, staff monitoring software, or access logs. Monitoring that falls below the Article 35(3) threshold can still feel intrusive to the people being watched.

A voluntary DPIA also gives you a record you can show a client or regulator who asks how you assessed the risk.

What Does a DPIA Cover?

Article 35(7) sets out four minimum contents. Three more come from elsewhere in Article 35 and the ICO’s guidance, and all seven together make a complete assessment:

1. Description of the processing, Article 35(7)(a): What data you’ll collect, from whom, how it flows, who can see it, and why you need it.
2. Necessity and proportionality, Article 35(7)(b): Whether the processing is needed for your purpose, whether less data would do, and your lawful basis.
3. Risk assessment, Article 35(7)(c): The risks to individuals, rated by likelihood and severity.
4. Mitigation measures, Article 35(7)(d): The safeguards and security measures that reduce each risk, plus the risk left over.
5. DPO advice and sign-off, Article 35(2): If you have a DPO, the law requires you to seek their advice. The ICO expects you to record that advice and who signed off the DPIA. Where you don’t follow the DPO’s advice, you need to record your reasons.
6. Consultation record, Article 35(9): The views of the people affected, or their representatives, where appropriate. If you decide not to consult them, note why.
7. Review schedule, Article 35(11): When you’ll check that the processing still matches the assessment, at least whenever the risk changes.

There’s no DPIA template UK law requires you to use. The ICO says there is “no definitive DPIA template that you must follow” and offers a sample you can adapt.

Common DPIA Mistakes

Weak DPIAs tend to fail in one of four ways. Each one breaks the link between the assessment and the decisions it’s meant to shape.

• Doing it after the fact: Once a system is built, the assessment can only describe risks. It can’t design them out.
• Treating it as a checklist: The DPIA Article 35 requires is a risk exercise, not a form. Ticking “yes” to every question without testing the answers produces a document that won’t hold up under questioning.
• Leaving the DPO out: Seeking your DPO’s advice is a legal requirement where you have one. Bringing them in at the end for a signature misses the point of the advice.
• No review cycle: A DPIA goes stale as soon as the system changes. The ICO says you “should not view a DPIA as a one-off exercise to file away”.

How Long Does a DPIA Take?

The time a DPIA takes comes down to how complex the processing is and how much documentation you already hold. The table shows what shapes the effort for common project types.

Prior consultation adds the Article 36 response period on top of the assessment itself.

How KEWDATA helps

We start with a free scoping call to confirm whether you need a DPIA and how big the job is. You get a timeline before any work begins. Our consultants then work through six stages:

1. mapping the processing with your developers and product team
2. assessing necessity, proportionality and lawful basis
3. identifying and scoring the risks
4. designing mitigations your team can act on
5. assessing residual risk and supporting sign-off, including ICO prior consultation where needed
6. setting triggers for future reviews

Your organisation stays responsible for the DPIA and the final decision on the processing. Our role is to support the assessment and give you the evidence behind that decision.

Need a DPIA for Your Next Project?

Get expert support before processing starts, while the design can still change. Our DPIA and privacy risk assessment service covers the full assessment, from mapping the processing to a signed-off record with review triggers.

Book a Free DPIA Scoping Call

The post What Is a DPIA and When Does Your Business Need One? appeared first on KEWDATA.

This guide walks through the full process: what counts as a valid request, how long you actually have, and the five steps from verifying who’s asking to filing the record afterwards. It also covers the mistakes that land businesses in front of the regulator.

What Is a Data Subject Access Request?

A subject access request, also called a SAR or DSAR, is someone asking for a copy of the personal data you hold about them. It comes from Article 15 of the UK GDPR, and it’s one of the strongest rights individuals have over their own information.

A few things catch businesses out:

• Anyone can make one: Customers, employees, former employees, job applicants, suppliers, and members of the public all have this right.
• There’s no set format: A SAR can arrive by email, letter, phone call, web form, social media message, or in conversation. Someone doesn’t have to use the words “subject access request” for it to count.
• It can go to anyone in your organisation: A request sent to a sales rep or posted on your Facebook page is still valid. Your staff needs to recognise one when it lands.
• You usually can’t charge: A fee is only allowed if the request is manifestly unfounded or excessive, or if someone asks for further copies of the same information.

What the person is entitled to receive:

• Confirmation that you’re processing their personal data
• A copy of that personal data
• Supplementary information: why you’re processing it, who you share it with, how long you’ll keep it, where you got it from, and their other rights

That last part matters. A SAR response isn’t just a data dump. It has to explain what you’re doing with the information and why.

The Time Limit and When You Can Extend It

The deadline is one calendar month, not 30 days. It starts the day you receive the request. So a request received on 3 March is due by 3 April. If there’s no matching date in the following month, you get until the last day of that month.

Extending to three months

You can extend by a further two months, giving three months in total, when the request is complex or when someone has made several requests. Complexity is judged case by case. A large volume of records on its own doesn’t automatically make a request complex.

If you extend, you have to tell the person within the first month and explain why. Extending quietly, or telling them on day 29 without a reason, won’t hold up.

Stopping the clock

Two situations pause the deadline:

• Asking for clarification: If you hold a lot of information about someone, or the request is vague, you can ask them to narrow it down. As the ICO’s guide to subject access explains, the clock pauses on the day you ask and restarts the day after they reply. You can only do this where clarification is reasonably required, and you can’t force anyone to narrow their request.
• Verifying identity: Where you genuinely need proof of who’s asking, the time limit runs from when you receive that proof.

The Data (Use and Access) Act 2025 put both of these on a statutory footing and confirmed that your search has to be reasonable and proportionate rather than exhaustive.

Whatever you do, record it. If a complaint reaches the ICO, you need to show when the pause started, what you asked for, and when the clock restarted.

Step 1: Verify the Identity of the Requestor

Sending someone else’s personal data to the wrong person is a data breach. Identity verification protects you and the person whose data it is.

Do this:

• Ask for ID only where you have real doubt about who’s asking
• Use what you already hold, such as confirming details from their account
• Ask quickly, within a few days of the request, not three weeks in
• Accept proportionate evidence, such as a photo of a driving licence or a reply from a verified email address

Don’t do this:

• Ask everyone for ID as standard
• Demand more documents than you need
• Insist on certified copies or originals by post when a scan would do
• Use verification as a delaying tactic

If someone emails from an address already on your system, you probably don’t need anything further.

Requests made by someone else. Solicitors, family members, and other representatives can make a SAR on someone’s behalf. Check they have authority, usually through written consent or a power of attorney, and satisfy yourself that releasing the data to that person is appropriate.

Step 2: Identify All Data Held on the Individual

This is where most of the work sits. Personal data spreads further through a business than people expect.

Where to look:

• CRM and customer databases: account records, order history, support tickets, call notes
• Email: mailboxes across the business, including messages that mention the person rather than being addressed to them
• HR systems: contracts, appraisals, disciplinary files, absence records, recruitment notes
• Finance systems: invoices, payment records, expense claims
• Cloud storage and shared drives: spreadsheets, reports, project documents
• Collaboration tools: Slack, Teams, and similar platforms
• CCTV and access logs, where the person is identifiable
• Backups and archives

Structured versus unstructured data. Pulling a customer record out of a CRM is straightforward. Finding every mention of someone across years of email threads and shared documents is much harder. Unstructured data is where teams lose days, so scope the search early and use whatever search tools your systems offer.

On backups. You need to search backups where it’s reasonable and proportionate to do so, but you’re not expected to restore every historical backup to find one record. Document what you searched and what you decided to leave out, along with your reasoning.

Step 3: Apply Exemptions

Not everything you find has to go out. The UK GDPR and Schedule 2 of the Data Protection Act 2018 set out exemptions, and each one applies to specific material rather than the whole response.

• Third-party data: Article 15(4) says the right to a copy must not adversely affect other people’s rights. Where a document names someone else, you can either redact their details, or disclose if that person consents or if disclosure is reasonable without consent. Weigh up any duty of confidentiality you owe them, what they’d expect, and whether they’ve objected.
• Legal professional privilege: Legal advice and material prepared for litigation stays exempt.
• Management forecasts: Business planning material, such as restructuring proposals or promotion plans, can be withheld where disclosure would prejudice the business activity in question.
• Confidential references: References given in confidence for employment, education, training, or appointment to office are exempt, whether your organisation gave or received them.
• Negotiations: Records of negotiations with the requester can be withheld where disclosure would prejudice those negotiations.

Apply exemptions narrowly. Redacting a name from a paragraph is fine. Withholding a whole document because one line is privileged is the kind of decision the ICO will question.

Step 4: Compile and Send the Response

Format. If the request arrived electronically, respond electronically unless the person asks otherwise. Common options are a PDF pack, a secure portal or file transfer link, or a physical copy for someone without reliable email access. Whatever you pick, send it securely. Emailing an unencrypted file of HR records to the wrong address turns a SAR into a breach.

What your cover letter needs to include:

• Confirmation that you’re processing their personal data
• The purposes you’re processing it for
• The categories of personal data involved
• Who you’ve shared it with or will share it with, including any overseas recipients
• How long you’ll keep it, or how you decide that
• Where the data came from, if you didn’t get it from them
• Whether there’s any automated decision-making or profiling
• Their rights to rectification, erasure, restriction, and objection
• Their right to complain to the ICO
• Details of your own complaints procedure

That last point changed recently. From 19 June 2026, the Data (Use and Access) Act requires controllers to run a formal complaints procedure for data subjects, so your response templates need to point people to it alongside the ICO.

If you’ve redacted anything or applied an exemption, say so and explain why in general terms. Silent redactions look like something’s being hidden.

Step 5: Document the Request and Response

Accountability under Article 5(2) means being able to show how you handled the request, not just that you handled it.

Keep a record of:

• When the request arrived and how
• What the person asked for
• Identity verification steps and when you completed them
• Any clarification you sought, and when the clock paused and restarted
• Any extension, the reason, and the date you told them
• Which systems you searched and how
• Exemptions applied and the reasoning behind each
• What you sent, when, and how
• Any follow-up correspondence

How long to keep it. No fixed retention period exists in law for SAR records. Most organisations align it with their wider retention schedule and the time limits for bringing a claim, which usually means keeping the correspondence and decision log for a few years. Whatever you settle on, write it into your retention policy and apply it consistently. Keeping copies of the disclosed data forever creates its own problem.

Common SAR Mistakes That Lead to ICO Complaints

1. Missing the deadline without explanation: Late responses are the most common cause of complaints. If you need an extension, ask for it within the first month and give a reason.
2. Treating identity checks as a delay tactic: Asking for ID you don’t need, or asking three weeks in, reads as obstruction.
3. Over-redacting: Blacking out large sections without explaining why invites a complaint and rarely survives scrutiny.
4. Searching too narrowly: Checking the CRM and stopping there misses email, shared drives, and HR files. Requesters often know what you hold.
5. Sending data without the supplementary information: A pile of records with no explanation of purposes, recipients, or retention isn’t a compliant response.

Need Help Handling a SAR?

A single complex request can absorb a week of your team’s time, and the deadline doesn’t move for holidays or busy periods. KEWDATA supports UK organisations through the whole process, from scoping a difficult request to applying exemptions and preparing the response pack.

See our DSAR support service for how that works.

The post How to Handle a Subject Access Request: Step-by-Step for UK Businesses appeared first on KEWDATA.

What Does GDPR Article 37 Actually Say?

Article 37 gives you three tests. Meet any one of them, and appointing a DPO stops being optional.

You need a DPO if you’re a public authority or body. You need one if your core activities involve regular and systematic monitoring of individuals on a large scale. And you need one if your core activities involve large-scale processing of special category data, or data relating to criminal convictions and offences. The ICO’s guidance sets out the same three conditions and confirms they apply to both controllers and processors.

UK GDPR and EU GDPR use the same three tests, so the starting question is the same on both sides of the Channel. The detail around those tests differs, though:

• In the UK, the Data Protection Act 2018 defines which organisations count as public authorities.
• EU member states can add national rules that require a DPO in more situations. Germany, for example, requires one where at least 20 people regularly work on the automated processing of personal data.

If your business is established in the EU, check the national law of each country involved, not just the GDPR itself.

The Three Types of Organisations That Must Appoint a DPO

1. Public authorities and bodies: Local councils, NHS trusts, and most public sector organisations fall under this trigger automatically, regardless of size or how much data they process. Courts acting in their judicial capacity are the one exception.
2. Large-scale, regular and systematic monitoring as a core activity: This covers organisations whose core activities involve tracking people on an ongoing basis. Behavioural advertising platforms, fitness apps logging location around the clock, and retail chains running facial recognition across a store network all sit inside this trigger. A single CCTV camera above a till doesn’t. A nationwide network of smart cameras feeding into an analytics platform likely does.
3. Large-scale processing of special category or criminal offence data as a core activity: Special category data includes health data, genetic data, biometric data used to uniquely identify someone, and data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or a person’s sex life or sexual orientation. A private healthcare provider, a genetic testing company, or a background-checking firm handling criminal record data at volume all fall inside this trigger.

What counts as a core activity?

Core activities are the processing operations your organisation needs to carry out to meet its main objectives. A hospital can’t provide care without processing patient health data, so that processing is a core activity. Payroll and IT support for your own staff are support functions, so they don’t count, even though every organisation runs them.

What Does “Large-Scale” Actually Mean?

This is the question every UK business ends up asking. GDPR gives no number. There’s no threshold anywhere that says “10,000 records” or “50,000 customers.”

Instead, the ICO points to five factors, drawn from guidance the Article 29 Working Party originally issued and the EDPB later carried forward: the number of data subjects affected, the volume of personal data, the range of data items involved, the geographic scope of the activity, and how long or permanent the processing is.

You don’t need every factor present for processing to count as large-scale. A health app used by hundreds of thousands of people across the UK, collecting data continuously, would almost certainly qualify. Processing that involves a small number of people, for a short time, in one location, would not.

Because there’s no fixed number, the ICO expects organisations to document their own reasoning. If you conclude you don’t need a DPO, write that reasoning down. It’s your evidence of accountability if anyone ever asks.

Voluntary DPO Appointment: When Is It Worth Doing?

Some businesses outside Article 37 appoint a DPO anyway. The reasons we see most are commercial:

• Enterprise procurement questionnaires asking who oversees data protection
• Investors checking during due diligence that someone owns the privacy programme
• Working in sectors under close regulatory attention, such as FinTech, HealthTech, legal, or HR

Before you go down this route, know that a voluntary DPO carries the same statutory requirements as a mandatory one. Your DPO must:

• have expert knowledge of data protection law and practice
• carry out the tasks set out in Article 39
• report directly to your highest management level
• get the resources they need to do the job
• work without instructions on how to carry out those tasks

You also can’t dismiss or penalise them for doing the job. If you want data protection support without those formal duties, appoint a privacy lead or adviser instead, and don’t give the role the DPO title.

Three Options If You Need a DPO

1. Hire in-house: A dedicated employee who handles your data protection work. Costs depend on the person’s experience and how much data protection work your organisation generates, so this suits organisations with enough ongoing work to justify a dedicated role.
2. Designate an existing staff member: This works when the person has the right expertise and their other duties don’t create a conflict of interest. Article 38 sets the rules: the DPO reports directly to your highest management level, can’t take instructions on how to carry out DPO tasks, and can’t be dismissed or penalised for doing the job. They can hold other duties, as long as those duties don’t put them in a position to decide why and how personal data gets processed.
3. Outsource the function: An external provider covers the role under a service contract, which Article 37(6) allows. Our outsourced DPO service covers this, alongside our wider DPO and data governance support if you need more than the DPO role alone.

Frequently Asked Questions

Is a DPO required for SMEs?

Only if one of the three Article 37 triggers applies. Size alone doesn’t create the obligation. A small company doing large-scale special category processing needs a DPO. A larger company doing low-risk, low-volume processing might not.

Can the CEO or HR director be the DPO?

It depends on their other duties. A DPO’s additional responsibilities must not create a conflict of interest, and roles that decide the purposes and means of processing are likely to. Senior positions such as chief executive or head of HR can fall into that category, so assess the specific role before designating anyone.

What happens if I don’t appoint a DPO when required?

You’re in breach of Article 37, which the ICO can act on separately from whatever underlying issue prompts an investigation. It also weakens your position if a breach or complaint happens later, since you can’t point to a documented, independent oversight function.

Do I need to register my DPO with the ICO?

Not in the sense of a formal registration process, but Article 37(7) requires you to publish your DPO’s contact details and communicate them to the ICO. This sits separately from the standard ICO data protection fee registration most organisations already complete.

Can my DPO also be my legal counsel?

It’s possible, as long as the two roles don’t conflict. The risk comes when legal counsel advises on or decides how personal data gets processed, because the DPO then has to assess decisions they helped make. Check the specific duties before combining the roles.

Not Sure Where You Stand?

You can work through the Article 37 test on your own, and if you conclude you don’t need a DPO, keep a written record of your reasoning. If you’re still unsure whether your business needs a DPO in the UK, see how KEWDATA assesses your DPO obligation, or book a free 30-minute scoping call.

Book a Free DPO Scoping Call

The post GDPR Article 37 Explained: When Is a DPO Mandatory? appeared first on KEWDATA.

Done well, a DPIA is more than a form to file. It sits at the heart of good risk management and feeds directly into how you keep track of compliance over time. This guide explains what a Data Protection Impact Assessment is, when the law requires one, what it should contain, how to rate risk, which template to use, and how it connects to ongoing compliance monitoring. 

KEWDATA helps UK and international businesses run these assessments and stay compliant with confidence.

Table of Contents

1. What Is a Data Protection Impact Assessment?
2. What Is a Data Protection Impact Assessment GDPR?
3. Why Is a DPIA Important?
4. What Does a Data Protection Impact Assessment Include?
5. The DPIA Process: The ICO’s Nine Steps
6. How to Rate Risk in a DPIA
7. Which DPIA Template Should You Use? ICO vs NHS
8. DPIAs for Children’s Data
9. How Does DPIA Support Compliance Monitoring?
10. What Are Compliance Monitoring Solutions?
11. Understanding a Compliance Monitoring System
12. When Should Businesses Conduct a Data Protection Impact Assessment?
13. How DPIA and Compliance Monitoring Work Together
14. Conclusion

What Is a Data Protection Impact Assessment?

A Data Protection Impact Assessment, usually shortened to DPIA, is a structured process for working out how a project might affect people’s privacy, before that project begins. You look closely at what you plan to do with personal data, find the risks, and decide how to reduce them.

Think of it as a safety check for data. Just as a builder checks a site for hazards before work starts, a business uses a DPIA to check a new activity for privacy risks. That might be launching a new app, rolling out a monitoring tool, or bringing in an AI system that processes customer information.

Organisations carry out a DPIA for two reasons. The first is to protect people, by catching risks before they turn into real harm. The second is to protect the business, by showing regulators, customers, and partners that data protection was built in from the start rather than bolted on later. It is one piece of the wider set of data protection solutions a business uses to stay compliant.

What Is a Data Protection Impact Assessment GDPR?

Under the GDPR, a DPIA is not just good practice. In many cases, it is the law. The Data Protection Impact Assessment GDPR requirement sits in Article 35, which says you must carry out a DPIA before any processing that is likely to result in a high risk to people’s rights and freedoms.

The GDPR names three situations that always require one:

• Systematic and extensive profiling that has a significant effect on people, such as automated decisions that shape what someone is offered, charged, or approved for.
• Large-scale processing of special category data, which means sensitive information like health, biometric, or racial data, along with data about criminal convictions.
• Large-scale, systematic monitoring of a public area, for example, widespread CCTV or tracking.

Beyond these, the ICO publishes its own list of ten more processing types that need a DPIA, covering things like using innovative technology, combining datasets, or processing children’s data. There is also a short screening checklist to help you decide. If you are unsure whether an activity qualifies, running a quick screening step through a DPIA and privacy risk assessment is the sensible first move.

Why Is a DPIA Important?

A DPIA matters because it turns data protection from guesswork into a clear, evidence-based process. Its real value shows up in three ways.

First, it identifies potential data protection risks early. By looking hard at a project before it starts, you find weak spots you might otherwise miss, such as collecting more data than you need or sharing it with a risky third party. Catching these on paper is far cheaper than fixing them after a breach.

Second, it helps you assess the impact of those risks. Not every risk is equal. A DPIA lets you weigh how likely a problem is and how much harm it could cause, so you can focus your effort where it matters most. This is the heart of good risk management, and it is exactly where an outsourced DPO adds value.

Third, it supports responsible data protection practices across the business. A DPIA forces you to justify why you need the data and to build in safeguards from the start. There is a legal edge too, since failing to carry out a required DPIA can bring fines of up to 10 million euros or 2 percent of global turnover, with a similar cap under the UK GDPR.

What Does a Data Protection Impact Assessment Include?

A proper DPIA follows a clear shape, and the GDPR sets out what it must cover as a minimum. A complete assessment usually works through these stages:

• A description of the processing: Explain what data you will collect, why you need it, how it will flow through your systems, and who it will be shared with.
• An assessment of necessity and proportionality: Show that you actually need the data for your purpose and are not collecting more than required.
• An assessment of the risks: Identify what could go wrong for the people whose data you hold, and judge how likely and how serious each risk is.
• Risk mitigation measures: Set out the steps you will take to reduce each risk, such as tighter access controls, encryption, or collecting less data in the first place.
• Documentation and sign-off: Record your findings and decisions, and get the assessment approved by the right people.

The final stage is review. A DPIA is not a one-off document you file and forget. The law expects you to revisit it whenever the processing changes or the level of risk shifts, and reviewing high-risk activities at least once a year is sound practice.

The DPIA Process: The ICO’s Nine Steps

The ICO sets out a clear, repeatable process for running a DPIA. Following it keeps you on track and gives regulators a shape they recognise. The cycle runs through nine stages:

1. Identify the need for a DPIA: Screen your project against the triggers to confirm whether an assessment is required.
2. Describe the information flows: Map what data you collect, how it moves through your systems, who handles it, and how long you keep it.
3. Consider consultation: Decide whose views you need, including, where appropriate, the people whose data you are processing.
4. Assess necessity and proportionality: Confirm you have a lawful basis and are not collecting more than you need.
5. Identify and assess risks: Work out what could go wrong for individuals, and how likely and how serious each risk is.
6. Identify measures to mitigate risks: Decide what controls will reduce each risk to an acceptable level.
7. Sign off and record outcomes: Get the assessment approved and document every decision.
8. Integrate outcomes into your plan: Build the agreed measures into the project so they actually happen.
9. Keep it under review: Revisit the DPIA whenever the processing or its risks change.

You can follow the full detail on the ICO’s DPIA guidance, which walks through each step in depth.

How to Rate Risk in a DPIA

Step five is where many people get stuck, because “risk” can feel vague. A simple scoring method fixes that. For each risk you identify, you score two things: how likely it is to happen, and how serious the impact would be if it did. Multiply the two together, and you get a risk score that tells you what to prioritise.

A common approach uses a five-by-five scale. Likelihood runs from rare (1) to almost certain (5). Impact runs from negligible (1) to catastrophic (5). Multiplying likelihood by impact gives a score from 1 to 25:

• Low risk (roughly 1 to 4): manageable, keep under review.
• Moderate risk (roughly 5 to 9): needs mitigation and monitoring.
• High risk (roughly 10 to 15): requires strong controls before you proceed.
• Severe risk (roughly 16 to 25): must be reduced, and if it stays high, you have to consult the ICO.

The real value of scoring is that you do it twice: once before mitigation and once after. Recording the risk score both with and without your controls applied shows exactly how much difference your safeguards make, and it is one of the clearest ways to demonstrate that your DPIA did its job. Getting this scoring right is something an experienced data protection and compliance partner can help you standardise.

Which DPIA Template Should You Use? ICO vs NHS

You do not have to build a DPIA from scratch, and choosing the right template saves time. Two official, free templates cover most needs, and knowing when to use each helps.

The ICO template is the general-purpose choice. It suits businesses in any sector and walks you through screening, describing the processing, assessing necessity, scoring risks, and recording measures. If you are a private company handling customer or employee data, the ICO’s DPIA template is usually the right starting point.

The NHS England template is built for health and care data, though it can be used for any data, including employment data. It is the better fit if you work in health or social care, or if you handle patient information, because it reflects the specific governance that sector expects, including sign-off roles like the Caldicott Guardian and the senior information risk owner. It also builds a preliminary screening assessment into the opening questions. You can find it on the NHS England DPIA, which explains exactly when the template can be used.

Whichever you choose, the content matters more than the format. Both cover what the GDPR requires, so pick the one that fits your sector and adapt it to your project.

DPIAs for Children’s Data

Children’s data deserves extra care, and the rules reflect that. If your online service is likely to be accessed by children, you must complete a DPIA. This comes from the ICO’s Age Appropriate Design Code, also known as the Children’s Code, which applies to apps, websites, games, and other online services that children are likely to use.

The reason is simple. Children may be less aware of the risks of sharing their data, so the law asks you to look harder before you process it. A DPIA for a children’s service should assess risks with the child’s best interests in mind, consider how features like profiling or location tracking could affect them, and build in protections by default. The ICO’s guidance on DPIAs for children’s data sets out what to cover.

If you design any service that children might use, treat a DPIA as essential rather than optional. It protects the children who use your service, and it protects you from getting the balance wrong.

How Does DPIA Support Compliance Monitoring?

A DPIA and compliance monitoring fit together naturally. The DPIA gives you a clear starting picture of your risks and the controls you put in place. Compliance monitoring is how you keep checking, over time, that those controls are still working and still enough.

Think of the DPIA as the map and monitoring as the regular journey checks. The assessment tells you where the risks are and what you decided to do about them. Monitoring then keeps an eye on whether those decisions are holding up as your business, your data, and the rules around it all change.

This link matters because risk is never static. A control that was strong last year might have gaps today. By feeding the findings of your DPIA into ongoing auditing and monitoring, you turn a single assessment into a living part of how you manage data protection, rather than a snapshot that quickly goes out of date.

What Are Compliance Monitoring Solutions?

Compliance Monitoring Solutions are the tools and services that help a business keep track of whether it is meeting its data protection duties on an ongoing basis. Instead of checking compliance once and hoping for the best, these solutions let you watch it continuously.

In practice, they bring together a few things. They help you keep records of your data processing and your DPIAs in one place. They flag when something needs review, such as a DPIA that is due a fresh look. And they help you track actions, so risks you identified actually get dealt with rather than forgotten. Strong data security also watches your systems for unusual activity that could signal a problem.

The point of good Compliance Monitoring Solutions is to make oversight manageable. Data protection has a lot of moving parts, and trying to hold it all in your head or across scattered spreadsheets is how things slip. A structured solution keeps everything visible and under control.

Understanding a Compliance Monitoring System

A Compliance Monitoring System is the joined-up setup a business uses to oversee its data protection compliance from one place. Where individual solutions handle specific jobs, a system ties them together into a single, ongoing process.

A good system does three main things. It monitors, by keeping a live view of your controls, risks, and obligations. It documents, by holding your records, policies, DPIAs, and evidence in an organised way that you can produce on request. And it supports ongoing oversight, by making sure reviews happen on time and nothing important falls through the cracks.

The real benefit is accountability. Under the GDPR, you have to be able to prove you meet your duties, not just claim you do. A proper governance and monitoring system gives you that evidence ready to go, whether a regulator asks or a big client runs due diligence before signing.

When Should Businesses Conduct a Data Protection Impact Assessment?

The simple rule is this: carry out a DPIA before you start any processing that could pose a significant risk to people, not after. Timing is everything, because the whole point is to catch problems before they happen.

Certain moments are clear triggers. You should run a DPIA when you plan to use personal data in a new or large-scale way, adopt new technology like AI, profile people to make decisions about them, process sensitive data at scale, or monitor a public area. If you are combining datasets, tracking behaviour, or handling children’s data, a DPIA is very likely needed.

Even when the law does not strictly demand one, running a DPIA is often a smart move. It is one of the clearest ways to show you take privacy seriously. When in doubt, a quick screening assessment tells you whether a full DPIA is required, and getting expert input early through a privacy audit can save a great deal of trouble later.

How DPIA and Compliance Monitoring Work Together

Bring the two together, and you get a full cycle of data protection risk management. Rather than a one-off task, it becomes a loop that keeps your business protected as things change. The cycle runs like this:

• Risk identification: The DPIA finds the privacy risks in a new activity before it starts.
• Risk assessment: You weigh how likely and how serious each risk is, so you know where to focus.
• Mitigation: You put controls in place to reduce those risks to an acceptable level.
• Monitoring: Your compliance monitoring keeps checking that the controls are working over time.
• Review: When something changes, or on a regular schedule, you revisit the DPIA and update it.

Run this way, DPIAs and monitoring stop being separate chores and become one continuous process. The DPIA sets the baseline, monitoring keeps watch, and review closes the loop and starts it again. That is how strong businesses keep data protection under control for the long term, rather than lurching from one panic to the next.

Conclusion

A Data Protection Impact Assessment is one of the most practical tools a business has for managing privacy risk. It helps you spot problems before they happen, meet your legal duties, and prove you take data protection seriously. Paired with steady compliance monitoring, it becomes part of a living system that keeps your business protected as it grows and as the rules change.

KEWDATA helps businesses turn that into a clear, managed process. Our team runs DPIAs that meet the GDPR, builds practical monitoring into how you work, and stays with you as your needs change. If you want to know where your risks sit and how to keep them under control, our data protection and compliance services are a strong place to start.

Book your free consultation: https://kewdata.ai/contact-us/

The post Data Protection Impact Assessment: A Guide to GDPR Risk Assessment and Compliance Monitoring appeared first on KEWDATA.

Protecting your data is no longer optional. It is a core part of running a responsible, resilient business. This is where Data Protection Services come in. They give you the expertise, tools, and ongoing support to keep your information safe and meet your legal duties. 

KEWDATA helps UK and international businesses do exactly that, turning data protection from a worry into a strength. This guide explains what these services cover and how they help.

Table of Contents

1. What Is Data Protection?
2. Why Is Data Protection Important for Businesses?
3. What Are Data Protection Services?
4. Understanding Data Protection Solutions
5. Data Protection and Security
6. What Is Data Protection Security?
7. Data Protection Cyber Security
8. The Importance of Customer Data Protection
9. Privacy Data Protection for Businesses
10. Choosing the Right Data Protection Services
11. Conclusion

What Is Data Protection?

Data protection is the practice of keeping personal and sensitive information safe and handling it in a fair, lawful way. It covers everything from how you collect data to how you store it, use it, share it, and eventually delete it. Done properly, it protects both the people whose data you hold and the business that holds it.

At its core, data protection answers a few simple questions. What information do you have? Why do you have it? Who can access it? And how do you keep it safe from loss, theft, or misuse? Getting clear answers to these is the foundation of everything else.

For organisations, data protection matters because it sits at the meeting point of law, trust, and security. Privacy rules like the UK GDPR require it. Customers expect it. And your own resilience depends on it. Treat it well, and it becomes a quiet advantage that runs through your whole business.

Why Is Data Protection Important for Businesses?

The clearest reason is risk. Data breaches are common, expensive, and damaging. Beyond the direct cost of cleaning up, a breach can mean regulatory fines, lost customers, and a dent in your reputation that lingers for years. Most breaches are not the work of master hackers either. Around 82 percent of them involve some human element, such as a staff member clicking a phishing email or mishandling a file.

There is a legal weight to it as well. Privacy laws place real duties on businesses to protect the information they hold and to respect people’s rights over it. Fall short, and the penalties can be steep, running into millions under the UK GDPR. Good privacy data protection keeps you on the right side of these rules and ready to prove it.

Then there is trust, which is harder to measure but just as valuable. Customers and partners increasingly check how you handle data before they commit. Strong protection wins you business. Weak protection quietly loses it.

What Are Data Protection Services?

Data Protection Services are professional services that help a business protect its data and meet its legal duties, delivered by experts rather than left to an already busy internal team. They pull together the legal, organisational, and technical sides of data protection into one joined-up approach.

A good service usually covers several areas. It starts with understanding what data you hold and where the risks sit, often through an audit that shows exactly where you stand. From there it can include writing policies, setting up processes for handling data requests, planning for breaches, training staff, and giving you a named expert to turn to when questions come up.

The real value is that this support is ongoing. Data protection is not a job you finish once. Laws change, your business grows, and new risks appear. A steady service keeps your protection current, so you are never caught out by a rule you did not know had changed.

Understanding Data Protection Solutions

Data Protection Solutions are the specific measures and tools that make protection work in practice. If services are the expertise and support, solutions are the building blocks they put in place. Together they form a complete system.

These solutions span a wide range. On the technical side, they include controls like encryption, which scrambles data so only authorised people can read it, along with tokenisation, masking, and strict access rules. On the organisational side, they include clear policies, records of what data you hold, and processes for spotting and reporting problems. Many businesses also use data discovery, which finds and maps where personal information lives across their systems.

The point of good Data Protection Solutions is to match the right measures to your actual risks. A small online retailer and a large healthcare provider face very different threats, so their solutions should look different too. Tailoring matters far more than simply buying tools.

Data Protection and Security

Data Protection and Security are two sides of the same coin, and they work best when they move together. Data protection is about handling information lawfully and fairly. Security is about keeping that information safe from threats. You cannot really have one without the other.

Think of it this way. You can write perfect privacy policies, but if your systems are easy to break into, the data is still at risk. On the flip side, you can have strong technical defences, but if you collect data you have no right to, or keep it longer than you should, you are still breaking the rules. Real protection needs both the legal and the security sides working as one.

This is why an integrated approach beats a patchwork every time. When your privacy practices and your security controls are designed together, they reinforce each other. Gaps get closed, duties get met, and your whole setup becomes far harder to knock over. Our guide to essential data protection and security compliance strategies goes deeper on how to join the two up.

What Is Data Protection Security?

Data Protection Security refers to the safeguards that keep protected data safe from unauthorised access, loss, or damage. It is the practical, hands-on side of keeping information secure, and privacy law expects it. The UK GDPR, for example, requires businesses to protect personal data with suitable technical and organisational measures.

In practice, this covers a familiar set of controls. Access management makes sure only the right people can reach sensitive data. Encryption protects it whether it is stored or moving between systems. Regular monitoring watches for unusual activity so problems get caught early. Backups and recovery plans mean you can bounce back if something goes wrong.

The aim is not to lock everything away so tightly that no one can work. It is to strike the right balance, keeping data safe while letting your team use it to do their jobs. Good security is protection that stays out of the way until it is needed.

Data Protection Cyber Security

Data protection and cyber security are closely linked, and neither works well alone. Cyber security defends your systems and networks from attack. Data protection makes sure the information inside those systems is handled properly. When they work together, they cover both the threat and the duty.

The link matters because most data breaches start as cyber incidents. A phishing email, a stolen password, or an unpatched system gives an attacker a way in, and once inside, personal data is often the prize. Phishing has been the most common way into a breach for four years running, and AI-driven attacks jumped 56 percent in the past year, so the threats keep getting sharper. Strong data security closes those gaps before they can be used.

Treating the two as separate jobs leaves dangerous gaps between them. A business that joins up its data protection and its cyber security, with both teams and tools pulling the same way, is far better placed to prevent breaches and to respond fast when one happens.

The Importance of Customer Data Protection

Customer Data Protection is about handling the information your customers trust you with in a careful, respectful way. When someone shares their details with your business, they are trusting you to look after them. Live up to that, and you build loyalty. Break it, and you can lose a customer for good.

The stakes are high because customer data is often the most sensitive information a business holds. Names, addresses, payment details, and buying habits all deserve real care. Mishandling them does not just risk a fine. It risks the relationship itself, and word of a breach travels fast.

Responsible handling comes down to a few habits. Collect only what you need. Be honest about how you use it. Keep it secure. And make it easy for customers to see, correct, or delete their information when they ask. These simple practices show customers you respect them, and that respect pays back in trust.

Privacy Data Protection for Businesses

Privacy Data Protection is the broader discipline of making sure personal data is used in ways that respect people’s privacy rights. It goes beyond just keeping data secure. It is about using it fairly, openly, and only for the reasons you should.

Good practice here rests on a handful of principles that run through every major privacy law. Have a clear reason for collecting data. Only gather what you actually need. Keep it accurate and up to date. Do not hold it longer than necessary. And respect the rights people have over their own information, such as the right to access it or ask for it to be removed. Handling requests like these well depends on a reliable data subject access request process.

Building these habits into how your business works, rather than bolting them on later, is what separates real privacy protection from a box-ticking exercise. It also makes life far easier when a regulator or a big client comes asking questions.

Choosing the Right Data Protection Services

Not every provider is the same, so it helps to know what to look for. A few things separate a genuine partner from one that just hands you a report:

• Real expertise: Choose a team that knows the laws that apply to you, whether that is UK GDPR, EU GDPR, or industry rules, and that understands your sector.
• Practical solutions: You want workable steps you can actually follow, not a thick document that gathers dust.
• Strong security focus: Make sure the provider treats data protection and security as one joined-up job, not two separate ones.
• Ongoing support: Pick a partner who stays with you as your business and the rules change, rather than one who disappears after the first project.

The right choice is a partner who tailors their support to your risks, keeps your protection current, and gives you real confidence that your data is in safe hands. Good data governance sits at the centre of all of it.

Conclusion

Data protection is not just a legal box to tick. It protects your customers, your reputation, and your ability to grow with confidence. With breaches growing more common and more costly, and with privacy rules tightening, strong Data Protection Services have become one of the smartest investments a business can make.

KEWDATA helps businesses turn that challenge into a clear, managed process. Our team brings deep expertise across data protection and security, builds practical solutions that fit how you actually work, and stays with you as your needs change. If you want to know where you stand and how to strengthen your protection, our data protection services are a strong place to start.

Book your free consultation: https://kewdata.ai/contact-us/

The post Data Protection Services: How Businesses Can Strengthen Data Protection and Security appeared first on KEWDATA.