GDPR & Data Protection Act 2018

Under Article 37, a DPO is mandatory for public authorities, organisations whose core activities involve large-scale systematic monitoring of individuals, and organisations whose core activities involve large-scale processing of special category data. For most private-sector organisations, a DPO is not legally required — but the ICO recommends appointing one if you process significant volumes of personal data. Where a DPO is required, the individual must have expert knowledge of data protection law and be provided with the resources to perform their tasks independently. We offer DPO-as-a-service for organisations that require or wish to appoint a DPO without creating a permanent internal role.

A Subject Access Request (SAR) is a request from an individual for a copy of all personal data you hold about them, along with information about how it’s used. Under UK GDPR Article 15, you must respond within one calendar month (extendable to three months for complex or numerous requests). The response must be provided free of charge in most circumstances. Common SAR failure points include: failing to respond within the deadline, providing incomplete information, and failing to identify all locations where personal data is held. We implement SAR-handling procedures, including intake logging, response tracking, and escalation paths, to ensure compliance.

Under UK GDPR Article 33, you must notify the ICO within 72 hours of becoming aware of a personal data breach — if the breach is likely to result in a risk to the rights and freedoms of individuals. The 72-hour clock starts from the moment you become aware of the breach, not from when it occurred. If the risk to individuals is high, you must also notify the affected individuals directly without undue delay under Article 34. The notification must include the nature of the breach, the categories of individuals and records affected, the likely consequences, and the measures taken. We implement breach response procedures that enable rapid assessment and ICO notification within the statutory window.

A Data Protection Impact Assessment (DPIA) is required under Article 35 before undertaking processing that is likely to result in a high risk to individuals’ rights and freedoms. Mandatory triggers include: large-scale processing of special category data, systematic monitoring of publicly accessible areas, automated decision-making with legal or significant effects, and other high-risk processing types. The ICO has published a list of processing types that always require a DPIA. We implement a DPIA process and provide templates that enable your organisation to conduct DPIAs consistently and document the outcome for regulatory evidence purposes.

Personal data transfers outside the UK require an appropriate safeguard under UK GDPR Chapter V. For transfers to the United States, the UK-US Data Bridge (the UK extension of the EU-US Data Privacy Framework) provides a mechanism for transfers to US organisations certified under the programme. Where the Data Bridge is not available, you can rely on the UK’s International Data Transfer Agreement (IDTA) — the UK equivalent of EU Standard Contractual Clauses. We assess all international data transfers, identify the appropriate transfer mechanism for each, and implement the required documentation and safeguards.