Can a Data Processor Cause a Breach and are you Still Liable?
You can outsource processing, but not responsibility. Here’s what to do if your vendor causes a breach.
-
-
Futureproofing Breach Defences in 2025 and Beyond
GDPR is evolving. Here’s how to keep your breach response fit for the future.
-
Who Needs to Be Told? Notifying Data Subjects After a Breach
Should you notify individuals after a breach? UK GDPR requires it if their risk is high. Here’s how to assess that. If a data breach is likely to result in a high risk to the rights and freedoms of individuals, you must inform them without undue delay. High-risk examples: Your message should: Clear and timely…
-
Who Owns Data Retention in Your Organisation?
Is it IT? Legal? HR? Retention needs ownership — or it becomes a shared blind spot. Here’s how to assign responsibility. Without a clear owner, data retention becomes everyone’s responsibility — and no one’s priority. Ownership models that work: Either model can work — but only if: Assigning ownership turns policy into practice. Without it,…
-
Backups Aren’t Exempt From GDPR – Here’s Why That Matters
Think your backup server doesn’t count? Think again. GDPR applies to all personal data, including archives. Retention policies often focus on live systems, but forget one major risk: backups. Backups containing outdated or deleted personal data can still put you in breach of UK GDPR, especially if: What to do: GDPR applies whether data is…
