Necessarily needing personal data for a process or a product isn’t always the same as “needing” it in data protection law. Understand the difference here.

DPOs have a lot on their plate, ranging from straightforward compliance to wearing different hats. Find out why this can become too much for one person to hold and how to manage it.

If you’re reaching for consent as the lawful basis because you don’t know what else to do, it probably isn’t right. Read why consent is often the default and how to check if it should be.

Only because you can, does it mean you should? Read more about the challenges a DPO faces when the law says yes but policy or ethical considerations say otherwise.

We need to talk about catfishing as it harms more than one person and anyone can be catfished. Learn why you should care abut the data points you create online.

I’ve been shortlisted for the PICCASO Author/Creator of the Year award with the Sofia Privacy blog as my entry. Read more about the nomination.

Read about three formative privacy experiences that were my first lessons in data protection, long before I knew what being a DPO meant. Let’s talk about forums, MySpace and catfishing.

This blog explores why mission-driven platforms built on sensitive data mistake their good intentions for "good enough" data protection compliance. Inspired by a true story. Read more.

Whoever gives data protection advice or signs it off needs to be confident that it is sound. Read this post to find out how to ensure recommendations are well thought-through.

Baby sleep consultant have a serious and responsible job – they work with infants and vulnerable new parents. As such, they are responsible for the wellbeing of both, which is caught by the UK GDPR.

“Consent or pay” is not adequate consent under the GDPR. I have shared a personal story that is not just mine to show people, advertisers and practitioners why it fails.

Read a Data Protection Officer’s legitimate interest assessment of workplace keystroke capture for AI training, with Meta as the worked example.

Read more to learn what AI support vs AI decision means in practice and how to improve your AI hiring tools compliance with the UK GDPR.

Understand data protection impact assessments and how to complete them without the jargon, in simple terms, with practical tips you can use today.

This is a practical guide for organisations choosing an outsourced DPO, written by someone who’s been on all sides. Learn what to look for and key questions to ask providers.

Find out what roles and structure my dream data protection team would have, and how you could improve yours.

Find out what “AI skills” are for people working in legal, compliance, privacy, consulting and advisory roles, including hard knowledge and soft skills.

An honest account of how I passed the IAPP CIPM exam while working (almost) full-time, including study methods, revision tips, and the realities of fitting study around life.

I’ve handled requests that stretched resources, tested judgment, and looked like candidates for refusal. Read why they weren’t.

Read why nobody really owns personal data even though controllership under the GDPR and ownership under intellectual property law may overlap sometimes.