Philippa Donn, Author at Data Protection Network

Philippa (CIPP/E, CIPM) a Partner with DPN Associates advises clients across a variety of sectors. She particularly enjoys supporting organisations with their approach to marketing compliance. As DPN Editor she’s authored and edited numerous data protection guides. Driven by finding pragmatic solutions to mitigate risk, Philippa previously worked in data compliance for Acxiom.

Data Protection Officers: Myth Buster

Does your business currently need a DPO? What impact under data reform plans could removing this mandatory requirement have?

Plans to extend marketing ‘soft opt-in’ to charities

UK data reform could be a game changer for charities, with plans to extend the use of the soft opt-in for electronic marketing.

UK data reform plans revealed: a snapshot

The Government has published the detail of its plans to reform data protection law in the UK. We've picked up some highlights...

UK Data Reform – Quick Update

What's on the cards for UK data reform? With no detail yet, a parliamentary committee meeting gives us a few nuggets...

Suppliers – why your contracts and security are important

Why suppliers need to check their contracts and security. Processors and controllers are both accountable....

Is your Privacy Notice complete?

Do you regularly review your privacy notice? Are you confident it covers what it needs to? A recent fine reminds us of their importance...

GDPR Legitimate Interests: When it isn’t legit

A recent GDPR fine reminds us to be sure we've balanced our legitimate interests. Are we meeting the core GDPR conditions?

Ransomware attack leads to £98k ICO fine

What lessons can we learn following a ransomware attack which led to the ICO issuing a firm with a substantial fine?

Data Protection and the KISS principle

Why privacy notices & internal data protection policies shouldn't be complicated. How to keep it simple and straight-forward...

Creating meaningful DPIAs

How to improve your approach to Data Protection Impact Assessments. We share tips on the end-to-end process from getting buy-in to review...

The Golden Rules of Telemarketing

Predators prey on the vulnerable, but sometimes legitimate businesses get things wrong - how do you avoid breaking the telemarketing rules?

Managing Erasure Requests or DSARs via Third-Party Portals

A number of online portals offer to help consumers exercise their privacy rights, but how should organisations handle such requests?

Are Data Subject Access Requests driving you crazy?

A fundamental right, but could the process be tinkered with to ease the burden on small to medium-sized organisations?

Data breaches: when to notify Regulators and affected individuals

To notify, or not to notify? Some helpful examples to help organisations assess whether a data beach should be reported...

Cabinet Office data breach fine – 6 key takeaways

What can we all learn from the Cabinet Office data breach? What went wrong and how to businesses avoid making the same mistakes?

Personal Data Breaches: Can ‘over-reporting’ be curtailed?

Organisations are said to be 'over-reporting' data breaches. How can this be avoided and does the threshold for reporting need to be higher?

Privacy Management Programme – what does one look like?

What is a Privacy Management Programme? What core elements would it cover? What would you be required to do if you had to implement a PMP?

UK data reform: Direct Marketing

Some direct marketing rules could be amended under Government proposals to change the UK data regime. What is being suggested?

Direct marketing: household names fined for breaking the rules

As household names are fined for contravening direct marketing rules, we take a look at what they got wrong and potential risks for others...

ICO says most public sector messages are not direct marketing

The ICO issues controversial new guidance on public sector communications - what does it mean, what is direct marketing and what isn't?

Will the new Information Commissioner be able to fend off the critics?

A New Zealander is tipped for the top job at the ICO. Was home-grown talent put off the role and what challenges lie ahead?

Are we controller, or are we processor?

Sometimes its clear cut your business is a controller or processor, but it's not always so easy. Why it's important to get it right...

Children’s Code: deadline for complying looms

Are your online services 'likely' to be accessed by under 18s? Should you be concerned about the looming deadline for UK's Children's Code?

Marketing and the ‘soft opt-in’ – are you getting it right?

As the ICO fines a pizza company for its marketing messages, we look the rules when relying on the exemption to consent...

Data Protection Impact Assessments: 10 Tips

Struggling to get the message across about DPIAs? 10 steps to get your process for Data Protection Impact Assessments on track..

Covid Contact Tracing – Quick 7 Privacy Steps Reminder

Are you getting your contact tracing right from a privacy perspective? Read our quick 7 step checklist to make sure you have things in order.

Are your service messages actually direct marketing?

When does a service email become a marketing message? Where do you draw the line? We look at how one company fell foul of the rules...

Data breaches: Why humans are our weakest link

Sent an attachment to the wrong person? Left a laptop on a train? Human error is a major cause of data breaches. What can we do?

Consent: Getting it right!

Are you suffering from consent confusion? We dispel the myths about consent under GDPR, share some tips and handy checklist...

Right to Erasure: 10 Tips

Erasure requests proving a challenge? Get some top tips on how to get your Right to Erasure process on track.

European Commission publishes draft UK adequacy decision

International data transfers: A draft adequacy decision has been published which would allow for the free flow of data from EEA to UK.

Understanding email marketing rules

UK email marketing rules - when do you need consent? what's the soft opt-in and when can you lawfully use an opt-out?

Data sharing: 10 point checklist

As the ICO publishes Data Sharing Code of Practice, what are the 10 key points you need to think about before you share personal data?

Brexit: Do you need an EU Representative?

UK organisations may need to appoint a EU representative, find out if your organisation falls under this GDPR requirement...

Fantasy GDPR – Your new data protection regime

130 people, battle-scarred data professionals all, chose to cry havoc and unleash the Dogs of Data by taking part in our Fantasy GDPR quiz.

The data breach that cost Marriott £18.4 million – what went wrong?

As the ICO slams a £18 million data breach fine on Marriott, we take a look at what went wrong and what other businesess can learn ...

ICO Subject Access Request Guidance: help or hindrance?

Subject Access Requests: As the ICO published detailed guidance we take a look at the higlights and whether it's a help or hindrance

10 DSAR tips from 10 DPOs

Data Subject Access Requests can be a challenge to handle. Get 10 great tips from experts who routinely handle the right of access,

COVID-19 Data Protection Guide

Covid-19 has meant employers have, by necessity, made risk-based data decisions. Do these need revisiting now?

Data Protection by Design: Part 3 – Data Protection Impact Assessments

How to get your Data Protection Impact Asssessment process on track - when should you do one, what should you process look like? Get some useful tips...

Data Protection by Design: Part 1 – The Basics

What does ‘Data Protection by Design’ really mean (and why is it also called ‘Privacy by Design’)? Do you need to be concerned about it? And how do you approach it in practice?

Data breaches: 10-point checklist for risk assessments

How do you assess the actual risk to people of a data breach? 10 questions you need to ask when carrying out an risk assessment.

Why personalisation is a good thing, when done well

“Hi, you haven’t finished watching Jeffrey Epstein: Filthy Rich”, said an email my husband received .It annoyed him......

Subject Access Requests & Proof of ID

Subject Access Requests & Proof of ID When responding to a Right of Access request (commonly known as a Data Subject Access Request), we might be required to ask a person to prove their identity. With that in mind, what constitutes a reasonable request for further information for verifying identity? And do you need to […]

GDPR: The Right of Access

GDPR: The Right of Access The right of access is nothing new, but there are some changes ushered in by the EU General Data Protection Regulation (GDPR). There’s also the anticipation that increased awareness (and the removal of the fee) will see the number of requests received rise. It’s crucial that employees are aware of […]