Subscribe to our blog posts

Agentic AI is becoming a much bigger part of the conversation around artificial intelligence. Unlike more traditional AI tools that respond to individual prompts, agentic AI can be given a goal and then take a series of actions to achieve it. This could include accessing information, interacting with other systems and making decisions with much less human involvement along the way. That level of autonomy could make AI much more useful, but it also creates some difficult quest

Information Governance offers a varied and rewarding career for people interested in data protection, privacy, information rights and responsible information management. It is also a career that can be entered from a number of different directions. You may already work with personal data in healthcare, local government, HR, compliance, records management, legal services or IT without necessarily considering yourself an Information Governance professional. So, if you are consi

Imagine driving down the road, doing absolutely nothing wrong, but an AI-powered camera flags you as potentially breaking the law. Your image is captured, processed and potentially reviewed by someone you've never met. But what happens to that image once it's determined you've done nothing wrong? It's an important question as AI-powered road safety cameras are being trialled across the West Midlands, with approximately 19,000 potential driving offences reportedly detected in

For many smaller businesses, data protection tends to sit somewhere between "important" and "we'll deal with it when we have time". It's rarely at the top of the priority list. Sales, recruitment, operations and growth usually come first, and that's understandable. The difficulty is that every business now handles a significant amount of personal information, whether that's employee records, customer databases, CRM systems, website enquiries or marketing lists. At some point

Misunderstanding personal data is one of the fastest ways for an organisation to fall short of UK GDPR requirements. If a record, message, image, spreadsheet, system log, or note can identify a living person, it may bring legal responsibilities with it. That matters for every organisation, not only large companies. A small business holding customer email addresses, an HR team managing absence records, a charity supporting service users, or an NHS provider handling patient inf

The Information Governance profession has evolved significantly over the last decade. Data protection, records management, information security, AI governance, data ethics, transparency, and accountability are no longer isolated disciplines. Organisations increasingly rely on skilled professionals who can navigate complex regulatory requirements while enabling innovation and operational effectiveness. As expectations continue to grow, so too does the importance of recognised

Starting as a new data protection officer can feel like being handed a map with half the landmarks missing. There are policies to review, risks to understand, people to advise, records to maintain, and decisions that may carry legal weight. The good news is that the role becomes far more manageable when the early priorities are clear. A new DPO does not need to know every answer on day one. The real skill is knowing where to look, what to ask, and how to build good habits acr

This blog is slightly different from our usual content. It is more people-focused, which is important because, at its core, data protection is about protecting people. Policies, procedures, systems and controls all play an essential role in managing personal data. They provide structure, set expectations and help organisations demonstrate accountability, but on their own they are not enough. Effective data protection depends on the people applying those policies and making th

Information Governance practitioners are often called upon when the answer is not obvious. A new system is being introduced. Information needs to be shared. A subject access request has become complicated. A data breach has occurred, and the organisation needs to decide what happens next. In these moments, knowing the legislation is essential, but knowledge alone is not enough. The real value of an effective IG practitioner lies in how they interpret a situation, ask the righ

People often assume the hardest part of data protection is understanding the legislation or dealing with complicated systems. In our experience, it usually isn't. Often, the biggest challenge is getting leadership to make it a priority. We've worked with organisations that know exactly what needs doing. The risks have been identified, recommendations have been made and everyone agrees on the next steps. Then progress stalls because the people responsible for delivering the ch

If your organisation works with the NHS, chances are the Data Security and Protection Toolkit (DSPT) is something you look forward to about as much as a trip to the dentist. Every year, as the submission deadline approaches, we speak to organisations that are convinced it's going to be stressful and take up far more time than they have available. We recently worked with a client who felt exactly the same. They'd built the DSPT up in their minds into this huge project and were

If your organisation handles Subject Access Requests, you may have noticed something changing. Over recent months, we've seen an increase in requests that appear to have been drafted using AI. They are often well-written, professionally structured, and reference everything from audit trails and metadata to system logs, legal holds, digital footprints, and details of every person who has accessed a record. At first glance, they can look intimidating. Many of these requests are

Most small and medium-sized businesses are handling personal data every day — customer details, employee records, marketing lists, CCTV, booking forms, invoices. It's rarely one big system. It's dozens of small touchpoints that quietly accumulate over time. UK GDPR compliance can feel like it belongs in a different world — one with in-house legal teams and dedicated compliance departments. But most of the fundamentals are straightforward once you know what to look for. That's

As AI becomes part of our everyday workflows, a new security risk is emerging—one that doesn’t rely on malware or technical hacking. It relies on language . Adversarial prompt injection hides instructions inside content that looks completely harmless: Emails. Documents. Chat messages. Even URLs. When an AI assistant reads that content, it may follow the attacker’s hidden instructions without the user ever noticing. Because language models treat every part of an input as m

We are all familiar with the infamous phrase "death by PowerPoint" but let's shine a spotlight on another critical issue that often flies under the radar: "Death by DPIA"

We’re all familiar with the infamous phrase “death by PowerPoint,” but it's time to shine a spotlight on another critical issue that...

Many parents share photos and personal details about their children online. This is known as sharenting. While it often stems from love...

The consequences of Cyber-attacks on small businesses: Cyber-attacks don’t just affect large corporations. Small and medium-sized...

According to the UK government's Cyber Security Breaches Survey 2025 , around 1% of all UK businesses experienced a ransomware crime in...

Intro to IoT Over 50% of Internet of Things (IoT) devices have critical vulnerabilities that hackers can exploit right now. Even more...