Blog

Using Notion or Airtable to store client data? Here's what UK GDPR actually requires, what your DPA covers, and how to answer when a customer asks.

Running Hotjar on your UK website? Session recording requires consent under PECR and UK GDPR. Here's what you actually need to have in place.

"Please send your data protection documentation" comes with no list. Here is the list: the nine things a procurement reviewer expects from a small supplier, and where your record already holds the answer.

The document a customer reads most carefully. What goes in each column, twelve common entries with the legal entity behind each, how to notify changes under Article 28, and a template.

Using TikTok Pixel? You may be a joint controller under UK GDPR and transferring data to China without realising. Here's what that means and what to do.

GA4 is not compliant by default. Here's what UK GDPR requires on consent, data transfers, SCCs, the UK Extension to the DPF, and Consent Mode v2.

HubSpot is your processor for CRM data but acts as its own controller for analytics. Here's what that means for your UK GDPR compliance and what to do about it.

Stripe auto-applies a DPA when you sign up. Here's what it covers, what it doesn't, and what you still need to do as a UK business.

Most cookie banners are theatre. What the law actually requires, what the DUAA changed in February 2026, and a two-minute check for your own site.

Yes, if three things are in place: the DPA accepted, the US transfer recorded, and your audience told. What each is and where to find it in Mailchimp.

Running Meta or Google campaigns on client data usually makes a UK agency a joint controller, with the liability. How to tell, and the agreement that fixes it.

Shopify's DPA, the apps you installed, cookie consent that actually blocks, and what the ICO has enforced against online shops. A checklist, not a lecture.

Names, emails, IP addresses, CCTV footage, even cookie IDs. The legal definition of personal data is wider than most small businesses realise. Here is what counts and what to do about it.

Every UK business that processes personal data has until 19 June 2026 to set up a formal complaints procedure for data protection issues. That is less than three months away.

If you have a Meta Pixel on your website, you are a joint controller with Meta for the personal data it collects. Most UK small businesses running Meta ads have no idea.

If your compliance strategy is a Cookiebot banner and a privacy policy template you found on Google, you are still exposed. This guide covers everything.