Blog

Plain-English data protection

Short, practical guides for UK small businesses. No jargon, no scare tactics, and useful whatever tools you use.

04/08/2026 · 5 min read

PECR fines just got 35 times bigger: what it means for your marketing list

The Data (Use and Access) Act raised the maximum PECR fine from £500,000 to £17.5 million, and the ICO has named direct marketing a renewed priority. Here is what changed and what to check.

20/07/2026 · 5 min read

What actually counts as anonymised data? The EU's new guidelines, explained

The EDPB's draft anonymisation guidelines set a clearer, stricter test for when data truly stops being personal data, and when it is just pseudonymised and still fully in scope.

02/07/2026 · 6 min read

The Appropriate Policy Document: the short policy most employers are missing

What an Appropriate Policy Document (APD) is, why the Data Protection Act 2018 requires one, who needs it, when it must be in place, and how to write one.

29/06/2026 · 5 min read

Cookie consent in 2026: what the Data (Use and Access) Act changed

The DUAA relaxed consent for low-risk cookies and raised the fines. Here is what changed and what to do about your cookie banner.

23/06/2026 · 6 min read

Which lawful basis do you need? A plain-English guide

The six lawful bases under UK GDPR, the new recognised legitimate interests basis, and how to choose the right one for each activity.

16/06/2026 · 5 min read

Data breach? The first 72 hours, explained

What counts as a personal data breach, when you have to tell the ICO, and the practical steps to take in the first three days.

09/06/2026 · 6 min read

How to handle a subject access request (DSAR), step by step

A calm, practical walkthrough of responding to a data subject access request under UK GDPR, including the new stop-the-clock rule.

02/06/2026 · 6 min read

7 GDPR mistakes small businesses make (and how to fix them)

The avoidable data protection mistakes we see most often in UK small businesses, and the simple fix for each.