Blog

GDPR compliance guides, vendor analysis, and regulatory updates for UK small businesses. Written in plain English by people who have done this before.

Google Analytics 4 and UK GDPR: Is It Actually Compliant?

GA4 is not compliant by default. Here's what UK GDPR requires on consent, data transfers, SCCs, the UK Extension to the DPF, and Consent Mode v2.

HubSpot and UK GDPR: Controller, Processor, or Both?

HubSpot is your processor for CRM data but acts as its own controller for analytics. Here's what that means for your UK GDPR compliance and what to do about it.

Stripe and UK GDPR: What the Data Processing Agreement Actually Says

Stripe auto-applies a DPA when you sign up. Here's what it covers, what it doesn't, and what you still need to do as a UK business.

Why Rowpa has no cookie banner (and when you don't need one either)

Most cookie banners are theatre. What the law actually requires, what the DUAA changed in February 2026, and a two-minute check for your own site.

Mailchimp and UK GDPR: Data transfers, DPA requirements, and what you need to do

Complete guide to using Mailchimp compliantly under UK GDPR. Covers DPA status, transfer mechanisms, and practical compliance steps for UK businesses.

GDPR Agency UK: Why Digital Marketing Agencies Face Joint Controller Risk in 2026

Most UK marketing agencies unknowingly become joint controllers under GDPR, sharing full liability with clients. New 2026 changes increase risk.

Shopify GDPR UK: What Store Owners Need to Know

Complete guide to UK GDPR compliance for Shopify stores. DPA requirements, third-party apps, and ICO enforcement explained.

What counts as personal data under UK GDPR? It is more than you think.

Names, emails, IP addresses, CCTV footage, even cookie IDs. The legal definition of personal data is wider than most small businesses realise. Here is what counts and what to do about it.

How to prepare your business for the June 2026 DUAA complaints deadline

Every UK business that processes personal data has until 19 June 2026 to set up a formal complaints procedure for data protection issues. That is less than three months away.

Meta Pixel and UK GDPR: what UK businesses need to know

If you have a Meta Pixel on your website, you are a joint controller with Meta for the personal data it collects. Most UK small businesses running Meta ads have no idea.

GDPR compliance for UK ecommerce businesses: the complete guide

If your compliance strategy is a Cookiebot banner and a privacy policy template you found on Google, you are still exposed. This guide covers everything.