Data protection

Turn the rules into everyday checks on the information your organisation uses.

A useful course helps people handle real situations and shows where they still need help.

Connect the risks to people with the safeguards and checks your organisation uses.

Recognise the request, work out the deadline and organise a clear, secure response.

A UK address does not settle which data protection law covers every part of your business.

Explain what happens to people’s information at the point they need to know.

Start with the personal data you hold, then check your duties, fee and need for a DPO separately.

Follow the decisions about the data, rather than the label on the contract.

Use this checklist to see what the supplier will do with personal data, including when the work ends.

The law has changed, but your old data protection duties have not disappeared.

Check what a system decides, who reviews it and how someone can challenge the result.

Check the exemption first, then the right fee band, before paying a letter or invoice.

Ask this before you hire anyone, because the answer changes what you need to buy.

The job title is not the test, but the decisions that come with it matter.

Start with the person doing the job, the cover you need and the way they will work with your team.

Look at the person’s authority, access and independence as well as their job title.

Compare the appointment options for schools in England and the checks that help you choose someone who can do the job.

The lowest monthly fee we found published for an outsourced DPO is £350 plus VAT, for two hours a month.

Compare the work, access and limits in the proposal before comparing the headline fee.

Check what the licence covers, how the bill grows and which costs sit outside the subscription.

Your organisation stays responsible for complying with UK GDPR whoever you hire, so it helps to know exactly what an adviser will do.

Knowing who pays, and what insurance covers, helps you ask the right questions before you sign.

A job title says little, so it helps to know what to ask for and what each certificate shows.

Ask who owns the product, how the adviser is paid and what happens if you choose a different tool.

Choose the people and work you need, with clear terms for legal advice, practical help and ongoing support.

Get the right people involved, contain the breach and keep the reporting decisions clear.

Separate the complaint, the request for payment and any court action before deciding what help you need.

Check the risk to people, then use the right reporting route and deadline.

Most letters from the regulator have a clear next step, and a calm first week makes the rest easier.

The legal maximum is a ceiling, not a prediction of what a business will pay.