The Data (Use and Access) Act 2025 has now come into effect, see here
Whether you are a sole trader or partnership, company, charity or public organisation, if you process personal data in the United Kingdom, or offer goods or services to individuals in the United Kingdom, then you must comply with:
If you are a public authority in the United Kingdom, including Housing Associations in Scotland, then you must also consider the below legislation, depending on jurisdiction:
Your appointed DPO will guide you on the path to compliance with data protection laws, including UK GDPR and the Data Protection Act 2018. We will advise on all aspects relating to the lawful processing of personal data. Regular meetings with us as your appointed DPO will provide you with expert advice and support to help your organisation meet and maintain its data protection obligations, ensuring compliance with the law.
UK GDPR provides people in the UK with rights in relation to their personal data processed by any data controller. For an organisation, this can sometimes be a strain on your resources. We can provide advice and assistance in responding to requests from individuals to exercise their rights; for example, if you receive a subject access request we can guide and assist you through the process of gathering, collating and if necessary, applying exemptions, so that you can reply to the requester within the legal time limits.
We will provide procedures and training for your team to firstly prevent a personal data breach from happening. However, if a breach does occur, we will help you work through the process, including any reporting obligations such as the individuals involved in the breach and/or the Information Commissioner’s Office.
A DPIA is a risk assessment relating to risks associated with the processing of personal data. In some circumstances, there is a statutory obligation to undertake a DPIA. RGDP will help you to identify the need for a DPIA and assist you undertaking one where required. Where we act as your Data Protection Officer, we will sign these off with advice as necessary.
If you don’t need our full DPO services, we can support and advise you relating to individual projects, such as management of data breaches, responding to subject access requests, auditing your existing data protection levels compliance, and helping you with a contract tender that asks you to provide data protection documentation.
If you have any special projects you are planning, for example, marketing strategies, building a new App, or installing new IT software, we can help you. Whatever you are doing, you need to consider data protection implications at the start, to ensure you are meeting the ‘Data Protection by Design’ requirement of the UK GDPR. We can provide advice and assistance on how to ensure any personal data involved in the project is handled in compliance with data protection law.
For most organisations, this will normally entail an initial discovery process, where we will identify what you already have in place and what work remains outstanding. We can then generate a tailored plan, based on priorities and risk, which will set out the steps that you need to take in order to comply with the legislation.
If you are sending marketing media directly to individuals, or placing a Cookie or other tracking technology on a user’s electronic device, it is likely you will have to comply with PECR (the Privacy and Electronic Communications Regulations). Get in touch with us for advice on this.
If you are designated as a Public Authority, you are required to have a Publication Scheme and Guide to Information that tells people what information you hold and where to find it. This needs to be approved by the relevant Information Commissioner for your jurisdiction (ICO for England and Wales or OSIC for Scotland). We can advise and assist with setting this up. We also have a suite of policies and templates to help you manage your freedom of information responsibilities.
In the UK, under both FOI for England and Wales, and FOISA for Scotland, anyone who asks for information held by a Public Authority is entitled to request it. RGDP can help you deal with the, sometimes complex, process of managing such a request, from acknowledgment, through to applying exemptions if applicable, redacting, and finally sending it to the requester. We can also help with reviews and, if the requester makes an appeal, we can be your point of contact with the Regulator.
EIR/EIRs apply to requests for information made to a Public Authority that relate to the environment. The definition of this is wide (see our Legislation page). You are required under the legislation to publish the information you hold in relation to this. Usually, this will be included in your Publication Scheme which is also required under freedom of information legislation. RGDP will help to make sure you have everything covered to comply with the law.
As with freedom of information, if you are designated as a Public Authority, you are required to reply to any request received in relation to environment-related information you hold. RGDP have policies and templates to help you do this. In addition, we will help you through the process of responding to requests.
We are a team of expert professionals with considerable experience of data protection / freedom of information, and other related legislation. Feel free to contact us, we are here to help!
