Philippa Donn, Author at Data Protection Network

Philippa Donn (CIPP/E, CIPM) a Partner with DPN Associates advises clients on data protection and ePrivacy across a variety of sectors. She particularly enjoys tackling marketing activities, tricky Data Subject Access Requests, developing straight-forward policies/procedures and solving problems. Phil has authored and edited numerous data protection guides. Driven by finding pragmatic solutions to mitigate risk, she previously worked in data compliance for Acxiom.

phil@dpnetwork.org.uk

Connect on LinkedIn

Labour’s plans for data protection, cyber security and AI

Get the low down on the Labour Government's proposals for the digital economy, data protection, cyber security and AI

Data Protection and what the Labour Government should do

Industry insiders share their thoughts on how a Labour Government should tackle data protection, eprivacy and AI.

Understanding and handling Special Category Data

How to make sure your collection and use of special category data, a special subset of personal data, is compliant with data protection law

Why the Tory app data breach could happen to anyone

How a built-in data protection by design approach can help organisations to prevent avoidable data breaches

DSAR ruling and other people’s data

How organisations should apply the third party exemption when handling responses to Data Subject Access Requests.

Data Sharing Checklist

Make sure your organisation's data sharing is compliant with data protection law with this handy data sharing checklist.

How to manage employees WhatsApp use

This risks and how to mitigate the them when employees use messaging apps like WhatsApp in the workplace. Personal or professional?

6 Steps to Manage International Data Transfers from the UK

How organisations can manage international data transfers; cross-border transfers from the UK in six simple steps.

UK Data Protection and Digital Information Bill Summary

UK Data Protection and Digital Information Bill Summary Could the DPDI Bill pass into law before a general election? It’s been confirmed the Data Protection and Digital Information Bill (DPDI) will not be passed before the UK General Election on 4th July. The Bill could potentially be resurrected under a new Government, or it may […]

DPDI Bill: DPO vs Senior Responsible Individual

What's the difference between a DPO and an SRI? What changes could the UK DPDI Bill mean for data protection roles?

Yet more CC email data breaches

People making mistakes when using the BCC field in emails is causing multiple data breaches. How to mitigate the risk?

Data Protection Officers Myth Buster

Does your business currently need a DPO? What impact under data reform plans could removing this mandatory requirement have?

EU AI Act adopted, and UK approach

How are the UK and the EU responding to rapid advances in AI? Balancing innovation with a need to avoid societal harms and misuse.

Data Subject Access Requests and Proof of ID

Data Subject Access Requests - what's reasonable to request to verify someone's identity? What different approaches can you take?

Cookies – Consent or Pay?

Is 'consent or pay' fair? Pay for ad-free online content or services. Cookie compliance has repercussions beyond the world of data protection

International Data Transfers Guide

This short guide provides an overview of international data transfers and the safeguard measures for restricted transfers from the UK and the EU

Workplace use of facial recognition and fingerprint scanning

Key considerations when considering using biometric data in the workplace and key learnings from regulatory enforcement action.

More UK companies to be targeted for non-compliant cookies

As the UK regulatory targets non-compliant websites, the five key steps to take to get your cookies and similar technologies in order.

Quick Guide to UK GDPR, Marketing and Cookies

How UK GDPR and PECR work together and apply to direct marketing, and use of cookies and similar technologies

PECR fine for invalid marketing consent

When is consent not consent? What can we learn from an ICO fine for invalid consent which failed to meet necessary criteria?

Our data, tech and the app-ocalypse

Relentless demands to download apps and populate online forms. Tech is a wonderful thing, but are we over-reliant and how safe is our data?

Managing the right to erasure

To delete or not delete, and how to delete - the right to erasure can be challenging to fulfil. Tips on managing erasure requests

UK telemarketing rules

Avoid falling foul of the UK telemarketing rules with this six-point guide to making compliant marketing calls

Seven top information security tips

Cyber attacks are plaguing businesses both big and small - 7 information security tips to help your business mitigate the risk

3 steps to decide your data retention periods

Data protection law tells organisations they must not keep personal data longer than necessary, but how to decide how long is okay?

Legitimate interests: is it legit?

Legitimate interests may be the most flexible lawful basis under GDPR but is what you're doing really legit?

Workplace monitoring – justified or intrusive?

How to make sure workplace monitoring is fair, justified and proportionate, and doesn't unduly impact on employees' rights and freedoms

DSARs – what are people entitled to receive

What information do organisations need to provide to individuals when they receive a Data Subject Access Request?

International Data Transfers and UK-US Data Bridge

As the US-UK 'data bridge' gets the green light what does this mean for UK businesses who transfer personal data across the Atlantic?

EU Representative and Swiss Representative for data protection

Does your business meet the criteria to appoint an EU Representative for data protection, and/or a Swiss Representative?

Marketing messages and service messages

What's the difference between a service message and a marketing message? How the content of our communications can get us in hot water

UK email marketing rules

The UK regulator frequently issues fines to businesses for contravening the email marketing rules. Find out how to avoid making a mistake

Data breaches – human or a catalogue of errors?

Human error? Or are data breaches caused by a failure to implement appropriate technical and organisational measures to protect personal data

Dossiers, profiles and the data protection conundrum

Can businesses create dossiers or profiles on individuals and still remain compliant with data protection law?

Data Protection Impact Assessments Guide

What's a DPIA? When must we do one? How do we manage the process? All this and more, plus helpful tips in our quick guide to DPIAs

Five Data Protection Essentials

Privacy survival kit - what are the data protection essentials for all businesses? Check out our top five 'must haves'.

Cookie compensation demands

Everyone's a potential target for the cookie compensation demand - any size of business, any sector. Do we ignore or pay out?

Data Protection Impact Assessments: 10 Tips

Struggling to teams across the business engaged with Data Protection Impact Assessments? Get top tips for getting your DPIA process on track.

Privacy Notices Quick Guide

Do we need a privacy notice (privacy policy)? What does a privacy notice need to cover? Our quick guide covers the key points you need to know

ICO issues fine for invalid marketing consent

Invalid consent for marketing emails leads to ICO fine. How do we make sure we get consent right and meet necessary requirements?

What could the marketing ‘soft opt-in’ mean for charities?

UK data reform could be a game changer for charities, with plans to extend the use of the soft opt-in for electronic marketing.

Overcoming DSAR and FOI challenges

Tips and insight on how to effectively handle data subject access requests, and requests under the Freedom of Information Act.

Efficiently handling Data Subject Access Requests (DSARs)

DSARs can be costly, time-consuming and challenging to fulfil. A 5-point checklist for efficiently handling requests.

DPOs and conflict of interests

DPOs can other business roles, but they must be able carry out their DPO duties independently. When does a conflict of interest arise?

EU AI Act – Quick Factsheet

The EU has agreed the world's first framework for regulating the use of Artificial Intelligence. Quick EU AI Act factsheet.

Data Governance Quick Guide

A quick guide to data governance - how taking control of our data helps to meet organisational aims and reduce risk

Data Protection Basics: The 6 lawful bases

What are the lawful bases for processing personal data? There are six to choose from and we need to pick the most appropriate.

Controller or processor? What are we?

Why its important to establish whether you're acting as a controller or processor, and set this out clearly in contractual terms.

What keeps a DPO awake at night?

What makes a Data Protection Officer wake in a cold sweat in the early hours of the morning? What's the stuff of privacy nightmares?

ICO direct marketing guidance for email and other electronic mail

Key highlights of ICO guidance on direct marketing using email or other electronic mail. Core rules, definitions and regulatory stance

Is your marketing profiling lawful, fair and transparent?

Why the ICO has dished out a substantial fine to a catalogue retailer for unlawful profiling and key takeaways from the ruling...

Data Subject Access Requests – 10 Quick Tips

Handling DSARs - Data Subject Access Request - can be straight-forward or more tricky. Check out our 10 tips for fulfilling them effectively

Data Breach Reporting: Speedy 8-point checklist

Suffered a data breach? Assessed it needs to be reported? What questions do you need to quickly get the answers to?

Suppliers – why your contracts and security are important

Why suppliers need to check their contracts and security. Processors and controllers are both accountable....

Is your Privacy Notice complete?

Do you regularly review your privacy notice? Are you confident it covers what it needs to? A recent fine reminds us of their importance...

Ransomware attack leads to £98k ICO fine

What lessons can we learn following a ransomware attack which led to the ICO issuing a firm with a substantial fine?

Managing Erasure Requests or DSARs via Third-Party Portals

A number of online portals offer to help consumers exercise their privacy rights, but how should organisations handle such requests?

Are Data Subject Access Requests driving you crazy?

A fundamental right, but could the process be tinkered with to ease the burden on small to medium-sized organisations?

Data breaches: when to notify Regulators and affected individuals

To notify, or not to notify? Some helpful examples to help organisations assess whether a data beach should be reported...

Cabinet Office data breach fine – 6 key takeaways

What can we all learn from the Cabinet Office data breach? What went wrong and how to businesses avoid making the same mistakes?

Personal Data Breaches: Can ‘over-reporting’ be curtailed?

Organisations are said to be 'over-reporting' data breaches. How can this be avoided and does the threshold for reporting need to be higher?

Privacy Management Programme – what does one look like?

What is a Privacy Management Programme? What core elements would it cover? What would you be required to do if you had to implement a PMP?

UK data reform: Direct Marketing

Some direct marketing rules could be amended under Government proposals to change the UK data regime. What is being suggested?

Direct marketing: household names fined for breaking the rules

As household names are fined for contravening direct marketing rules, we take a look at what they got wrong and potential risks for others...

ICO says most public sector messages are not direct marketing

The ICO issues controversial new guidance on public sector communications - what does it mean, what is direct marketing and what isn't?

Marketing and the ‘soft opt-in’ – are you getting it right?

As the ICO fines a pizza company for its marketing messages, we look the rules when relying on the exemption to consent...

Data breaches: Why humans are our weakest link

Sent an attachment to the wrong person? Left a laptop on a train? Human error is a major cause of data breaches. What can we do?

Consent: Getting it right!

Are you suffering from consent confusion? We dispel the myths about consent under GDPR, share some tips and handy checklist...

The data breach that cost Marriott £18.4 million – what went wrong?

As the ICO slams a £18 million data breach fine on Marriott, we take a look at what went wrong and what other businesess can learn ...

Data Protection by Design: Part 3 – Data Protection Impact Assessments

How to get your Data Protection Impact Asssessment process on track - when should you do one, what should you process look like? Get some useful tips...

Data Protection by Design: Part 1 – The Basics

What does ‘Data Protection by Design’ really mean (and why is it also called ‘Privacy by Design’)? Do you need to be concerned about it? And how do you approach it in practice?

Data breaches: 10-point checklist for risk assessments

How do you assess the actual risk to people of a data breach? 10 questions you need to ask when carrying out an risk assessment.

GDPR: The Right of Access

GDPR: The Right of Access The right of access is nothing new, but there are some changes ushered in by the EU General Data Protection Regulation (GDPR). There’s also the anticipation that increased awareness (and the removal of the fee) will see the number of requests received rise. It’s crucial that employees are aware of […]