Blog

The ICO has fined Scottish charity Birthlink £18,000 for the destruction of approximately 4,800 personal records, some of which were irreplaceable. These weren’t just files. They were handwritten letters, photographs, and birth certificates; fragments of identity, belonging, and memory. The loss was not just operational, it was deeply human.

The Data (Use and Access) Act 2025 (DUAA 2025) (1) has officially passed and with it comes a shift in how charities can communicate with their supporters. One of the most talked about changes? Charities can now send certain marketing emails without needing explicit consent from individuals. But before you hit “send,” let’s unpack what is actually allowed.

The Data (Use and Access) Act 2025 (DUAA 2025) has officially landed, bringing with it a series of targeted amendments to the UK’s data protection framework. While the UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018 (DPA 2018), and Privacy and Electronic Communications Regulations 2003 (PECR) remain the bedrock of UK data protection legislation, the DUAA 2025 introduces some meaningful updates, particularly around the use of cookies and similar track

Top tips for handling data protection complaints as introduced by Data (Use and Access) Act 2025

The Data (Use and Access) Bill officially received Royal Assent on 19th June 2025, marking a significant shift in the UK’s data protection landscape. Now known as the Data (Use and Access) Act 2025 (DUAA 2025), this new legislation brings both exciting opportunities and important responsibilities for organisations handling personal data.

In today’s digital world, data is one of our most valuable assets. From names and addresses to passwords, financial details or confidential business data, we trust organisations to keep our information safe. But there’s a growing threat that doesn’t rely on breaking through digital defences such as hacking or coding, rather on human interaction and exploiting human vulnerabilities. It’s called social engineering and it’s one of the easiest ways for cybercriminals to get hold

Data Protection Impact Assessments (DPIAs) are more than a compliance checkbox—they’re a strategic tool for driving measurable benefits. When aligned with the Benefits Realisation methodology, DPIAs can transform organisational changes into success stories.

Personal data breaches remain one of the most perplexing and impactful threats. Breaches don’t just stem from technical vulnerabilities...