Philippa Donn, Author at Data Protection Network

Philippa (CIPP/E, CIPM) a Partner with DPN Associates advises clients across a variety of sectors. She particularly enjoys supporting organisations with their approach to marketing compliance. As DPN Editor she’s authored and edited numerous data protection guides. Driven by finding pragmatic solutions to mitigate risk, Philippa previously worked in data compliance for Acxiom.

Are Data Subject Access Requests driving you crazy?

A fundamental right, but could the process be tinkered with to ease the burden on small to medium-sized organisations?

Data breaches: when to notify Regulators and affected individuals

To notify, or not to notify? Some helpful examples to help organisations assess whether a data beach should be reported...

Cabinet Office data breach fine – 6 key takeaways

What can we all learn from the Cabinet Office data breach? What went wrong and how to businesses avoid making the same mistakes?

Personal Data Breaches: Can ‘over-reporting’ be curtailed?

Organisations are said to be 'over-reporting' data breaches. How can this be avoided and does the threshold for reporting need to be higher?

Privacy Management Programme – what does one look like?

What is a Privacy Management Programme? What core elements would it cover? What would you be required to do if you had to implement a PMP?

UK data reform: Direct Marketing

Some direct marketing rules could be amended under Government proposals to change the UK data regime. What is being suggested?

Direct marketing: household names fined for breaking the rules

As household names are fined for contravening direct marketing rules, we take a look at what they got wrong and potential risks for others...

ICO says most public sector messages are not direct marketing

The ICO issues controversial new guidance on public sector communications - what does it mean, what is direct marketing and what isn't?

Will the new Information Commissioner be able to fend off the critics?

A New Zealander is tipped for the top job at the ICO. Was home-grown talent put off the role and what challenges lie ahead?

Are we controller, or are we processor?

Sometimes its clear cut your business is a controller or processor, but it's not always so easy. Why it's important to get it right...

Children’s Code: deadline for complying looms

Are your online services 'likely' to be accessed by under 18s? Should you be concerned about the looming deadline for UK's Children's Code?

Marketing and the ‘soft opt-in’ – are you getting it right?

As the ICO fines a pizza company for its marketing messages, we look the rules when relying on the exemption to consent...

Data Protection Impact Assessments: 10 Tips

Struggling to get the message across about DPIAs? 10 steps to get your process for Data Protection Impact Assessments on track..

Covid Contact Tracing – Quick 7 Privacy Steps Reminder

Are you getting your contact tracing right from a privacy perspective? Read our quick 7 step checklist to make sure you have things in order.

Are your service messages actually direct marketing?

When does a service email become a marketing message? Where do you draw the line? We look at how one company fell foul of the rules...

Data breaches: Why humans are our weakest link

Sent an attachment to the wrong person? Left a laptop on a train? Human error is a major cause of data breaches. What can we do?

Consent: Getting it right!

Are you suffering from consent confusion? We dispel the myths about consent under GDPR, share some tips and handy checklist...

Right to Erasure: 10 Tips

Erasure requests proving a challenge? Get some top tips on how to get your Right to Erasure process on track.

European Commission publishes draft UK adequacy decision

International data transfers: A draft adequacy decision has been published which would allow for the free flow of data from EEA to UK.

EU ePrivacy Regulation: a significant step forward?

Is the proposed EU ePrivacy Regulation, which will give us new rules for cookies and electronic communications, a step closer?

Understanding email marketing rules

UK email marketing rules - when do you need consent? what's the soft opt-in and when can you lawfully use an opt-out?

UK Data protection and ePrivacy law post Brexit: Q&A

What data protection and ePrivacy law applies in the UK post Brexit? Our handy Q&A answers key considerations for your business.

Data sharing: 10 point checklist

As the ICO publishes Data Sharing Code of Practice, what are the 10 key points you need to think about before you share personal data?

Brexit: Do you need an EU Representative?

UK organisations may need to appoint a EU representative, find out if your organisation falls under this GDPR requirement...

Fantasy GDPR – Your new data protection regime

130 people, battle-scarred data professionals all, chose to cry havoc and unleash the Dogs of Data by taking part in our Fantasy GDPR quiz.

The data breach that cost Marriott £18.4 million – what went wrong?

As the ICO slams a £18 million data breach fine on Marriott, we take a look at what went wrong and what other businesess can learn ...

ICO Subject Access Request Guidance: help or hindrance?

Subject Access Requests: As the ICO published detailed guidance we take a look at the higlights and whether it's a help or hindrance

10 DSAR tips from 10 DPOs

Data Subject Access Requests can be a challenge to handle. Get 10 great tips from experts who routinely handle the right of access,

COVID-19 Data Protection Guide

Covid-19 has meant employers have, by necessity, made risk-based data decisions. Do these need revisiting now?

Data Protection by Design: Part 3 – Data Protection Impact Assessments

How to get your Data Protection Impact Asssessment process on track - when should you do one, what should you process look like? Get some useful tips...

Data Protection by Design: Part 1 – The Basics

What does ‘Data Protection by Design’ really mean (and why is it also called ‘Privacy by Design’)? Do you need to be concerned about it? And how do you approach it in practice?

Data breaches: 10-point checklist for risk assessments

How do you assess the actual risk to people of a data breach? 10 questions you need to ask when carrying out an risk assessment.

Why personalisation is a good thing, when done well

“Hi, you haven’t finished watching Jeffrey Epstein: Filthy Rich”, said an email my husband received .It annoyed him......

Subject Access Requests & Proof of ID

When responding to a Right of Access request (commonly known as a Data Subject Access Request), we might be required to ask a person to prove their identity. With that in mind, what constitutes a reasonable request for further information for verifying identity? And do you need to ask for additional information in all circumstances? […]

GDPR: The Right of Access

The right of access is nothing new, but there are some changes ushered in by the EU General Data Protection Regulation (GDPR). There’s also the anticipation that increased awareness (and the removal of the fee) will see the number of requests received rise. It’s crucial that employees are aware of what a Data Subject Access […]