Philippa Donn, Author at Data Protection Network

Philippa (CIPP/E, CIPM) a Partner with DPN Associates advises clients across a variety of sectors. She particularly enjoys supporting organisations with their approach to marketing compliance and helping out with tricky Data Subject Access Requests. Phil has authored and edited numerous data protection guides. Driven by finding pragmatic solutions to mitigate risk, she previously worked in data compliance for Acxiom.

phil@dpnetwork.org.uk

Connect on LinkedIn

Managing the right to erasure

To delete or not delete, and how to delete - the right to erasure can be challenging to fulfil. Tips on managing erasure requests

Cookie action and five steps to cookie compliance

As the UK regulatory targets non-compliant websites, the five key steps to take to get your cookies and similar technologies in order.

UK data reform – key proposals

What does UK data reform mean for UK businesses? Key changes if the Data Protection and Digital Information Bill becomes law

UK telemarketing rules

Avoid falling foul of the UK telemarketing rules with this six-point guide to making compliant marketing calls

Seven top information security tips

Cyber attacks are plaguing businesses both big and small - 7 information security tips to help your business mitigate the risk

3 steps to decide your data retention periods

Data protection law tells organisations they must not keep personal data longer than necessary, but how to decide how long is okay?

Legitimate interests: is it legit?

Legitimate interests may be the most flexible lawful basis under GDPR but is what you're doing really legit?

Workplace monitoring – justified or intrusive?

How to make sure workplace monitoring is fair, justified and proportionate, and doesn't unduly impact on employees' rights and freedoms

DSARs – what are people entitled to receive

What information do organisations need to provide to individuals when they receive a Data Subject Access Request?

International Data Transfers and UK-US Data Bridge

As the US-UK 'data bridge' gets the green light what does this mean for UK businesses who transfer personal data across the Atlantic?

EU Representative and Swiss Representative for data protection

Does your business meet the criteria to appoint an EU Representative for data protection, and/or a Swiss Representative?

International Data Transfers Guide

This short guide provides an overview of international data transfers and the safeguard measures for restricted transfers from the UK and the EU

Marketing messages and service messages

What's the difference between a service message and a marketing message? How the content of our communications can get us in hot water

UK email marketing rules

The UK regulator frequently issues fines to businesses for contravening the email marketing rules. Find out how to avoid making a mistake

Data breaches – human or a catalogue of errors?

Human error? Or are data breaches caused by a failure to implement appropriate technical and organisational measures to protect personal data

Dossiers, profiles and the data protection conundrum

Can businesses create dossiers or profiles on individuals and still remain compliant with data protection law?

Data Protection Impact Assessments Guide

What's a DPIA? When must we do one? How do we manage the process? All this and more, plus helpful tips in our quick guide to DPIAs

Five Data Protection Essentials

Privacy survival kit - what are the data protection essentials for all businesses? Check out our top five 'must haves'.

Cookie compensation demands

Everyone's a potential target for the cookie compensation demand - any size of business, any sector. Do we ignore or pay out?

GDPR 5 years on

The pros, cons and myths of GDPR. Data protection professionals share their thoughts and what the future for data protection holds

Data Protection Impact Assessments: 10 Tips

Struggling to teams across the business engaged with Data Protection Impact Assessments? Get top tips for getting your DPIA process on track.

Privacy Notices Quick Guide

Do we need a privacy notice (privacy policy)? What does a privacy notice need to cover? Our quick guide covers the key points you need to know

ICO issues fine for invalid marketing consent

Invalid consent for marketing emails leads to ICO fine. How do we make sure we get consent right and meet necessary requirements?

What could the marketing ‘soft opt-in’ mean for charities?

UK data reform could be a game changer for charities, with plans to extend the use of the soft opt-in for electronic marketing.

Overcoming DSAR and FOI challenges

Tips and insight on how to effectively handle data subject access requests, and requests under the Freedom of Information Act.

Efficiently handling Data Subject Access Requests (DSARs)

DSARs can be costly, time-consuming and challenging to fulfil. A 5-point checklist for efficiently handling requests.

DPOs and conflict of interests

DPOs can other business roles, but they must be able carry out their DPO duties independently. When does a conflict of interest arise?

Data sharing: 10 point checklist

What steps do we need to take when sharing personal data with other organisations. This checklist covers the core points to consider.

Data Governance Quick Guide

A quick guide to data governance - how taking control of our data helps to meet organisational aims and reduce risk

Data Protection Basics: The 6 lawful bases

What are the lawful bases for processing personal data? There are six to choose from and we need to pick the most appropriate.

Controller or processor? What are we?

Why its important to establish whether you're acting as a controller or processor, and set this out clearly in contractual terms.

What keeps a DPO awake at night?

What makes a Data Protection Officer wake in a cold sweat in the early hours of the morning? What's the stuff of privacy nightmares?

ICO direct marketing guidance for email and other electronic mail

Key highlights of ICO guidance on direct marketing using email or other electronic mail. Core rules, definitions and regulatory stance

Is your marketing profiling lawful, fair and transparent?

Why the ICO has dished out a substantial fine to a catalogue retailer for unlawful profiling and key takeaways from the ruling...

Data Protection Officers: Myth Buster

Does your business currently need a DPO? What impact under data reform plans could removing this mandatory requirement have?

Data Subject Access Requests – 10 Quick Tips

Handling DSARs - Data Subject Access Request - can be straight-forward or more tricky. Check out our 10 tips for fulfilling them effectively

GDPR and PECR go hand in hand

In focusing on GDPR we risk forgetting PECR - this sits alongside GDPR and gives us rules for direct marketing and cookies

Privacy notices – the 8 deadly sins

Privacy notices are important and should be clear and concise. Here's our quick guide to what not to do when creating or updating yours

Data Breach Reporting: Speedy 8-point checklist

Suffered a data breach? Assessed it needs to be reported? What questions do you need to quickly get the answers to?

UK data reform plans revealed: a snapshot

The Government has published the detail of its plans to reform data protection law in the UK. We've picked up some highlights...

Suppliers – why your contracts and security are important

Why suppliers need to check their contracts and security. Processors and controllers are both accountable....

Is your Privacy Notice complete?

Do you regularly review your privacy notice? Are you confident it covers what it needs to? A recent fine reminds us of their importance...

Ransomware attack leads to £98k ICO fine

What lessons can we learn following a ransomware attack which led to the ICO issuing a firm with a substantial fine?

Creating meaningful DPIAs

How to improve your approach to Data Protection Impact Assessments. We share tips on the end-to-end process from getting buy-in to review...

Managing Erasure Requests or DSARs via Third-Party Portals

A number of online portals offer to help consumers exercise their privacy rights, but how should organisations handle such requests?

Are Data Subject Access Requests driving you crazy?

A fundamental right, but could the process be tinkered with to ease the burden on small to medium-sized organisations?

Data breaches: when to notify Regulators and affected individuals

To notify, or not to notify? Some helpful examples to help organisations assess whether a data beach should be reported...

Cabinet Office data breach fine – 6 key takeaways

What can we all learn from the Cabinet Office data breach? What went wrong and how to businesses avoid making the same mistakes?

Personal Data Breaches: Can ‘over-reporting’ be curtailed?

Organisations are said to be 'over-reporting' data breaches. How can this be avoided and does the threshold for reporting need to be higher?

Privacy Management Programme – what does one look like?

What is a Privacy Management Programme? What core elements would it cover? What would you be required to do if you had to implement a PMP?

UK data reform: Direct Marketing

Some direct marketing rules could be amended under Government proposals to change the UK data regime. What is being suggested?

Direct marketing: household names fined for breaking the rules

As household names are fined for contravening direct marketing rules, we take a look at what they got wrong and potential risks for others...

ICO says most public sector messages are not direct marketing

The ICO issues controversial new guidance on public sector communications - what does it mean, what is direct marketing and what isn't?

Marketing and the ‘soft opt-in’ – are you getting it right?

As the ICO fines a pizza company for its marketing messages, we look the rules when relying on the exemption to consent...

Data breaches: Why humans are our weakest link

Sent an attachment to the wrong person? Left a laptop on a train? Human error is a major cause of data breaches. What can we do?

Consent: Getting it right!

Are you suffering from consent confusion? We dispel the myths about consent under GDPR, share some tips and handy checklist...

European Commission publishes draft UK adequacy decision

International data transfers: A draft adequacy decision has been published which would allow for the free flow of data from EEA to UK.

The data breach that cost Marriott £18.4 million – what went wrong?

As the ICO slams a £18 million data breach fine on Marriott, we take a look at what went wrong and what other businesess can learn ...

Data Protection by Design: Part 3 – Data Protection Impact Assessments

How to get your Data Protection Impact Asssessment process on track - when should you do one, what should you process look like? Get some useful tips...

Data Protection by Design: Part 1 – The Basics

What does ‘Data Protection by Design’ really mean (and why is it also called ‘Privacy by Design’)? Do you need to be concerned about it? And how do you approach it in practice?

Why personalisation is a good thing, when done well

“Hi, you haven’t finished watching Jeffrey Epstein: Filthy Rich”, said an email my husband received .It annoyed him......

Subject Access Requests & Proof of ID

Subject Access Requests & Proof of ID When responding to a Right of Access request (commonly known as a Data Subject Access Request), we might be required to ask a person to prove their identity. With that in mind, what constitutes a reasonable request for further information for verifying identity? And do you need to […]

GDPR: The Right of Access

GDPR: The Right of Access The right of access is nothing new, but there are some changes ushered in by the EU General Data Protection Regulation (GDPR). There’s also the anticipation that increased awareness (and the removal of the fee) will see the number of requests received rise. It’s crucial that employees are aware of […]