What we check
The whole law, in plain English
You don’t need to know the legal terms to know whether your business does these things. This is what the law actually asks for.
Telling people what you collect
Before you collect someone's data, tell them what you are collecting and why, clearly and in a language they can read.
Asking permission properly
Consent must be freely given and just as easy to withdraw. Many sign-up forms get this wrong.
Letting people see and delete their data
People can ask what you hold about them, correct it or have it deleted. You must be able to do all three, and show that you did.
Answering complaints
You have a time limit to reply to a complaint, and people can take it further if you don't.
Keeping data safe
The largest penalty in the law is here. It covers your suppliers' failures as well as your own.
Children
Data about anyone under 18 has extra rules. A tick-box asking for someone's age is not enough.
When something goes wrong
A breach starts more than one deadline. Planning only for the longest one is a common and costly mistake.
Not keeping data forever
Delete data once you no longer need it, unless another law says you must keep it. Both can apply at once.
The companies you share data with
You remain responsible for what your suppliers do with the data you give them. A contract cannot change that.
Scope
Not all of it will apply to you
Some duties only apply to certain kinds of business, certain kinds of data or organisations above a certain size. A small shop and a large bank are not asked the same things.
Working out what really applies is the first thing we do. It is also where most compliance projects waste effort: fixing something that was never your duty still costs money.
Find out what applies to you
In a short session we narrow the law down to the parts that matter for your organisation.