A dental practice contacted us recently with a question that comes up more often than you'd think. A man rang, said he was the separated father of one of their young patients, and asked for a copy of his child's records. Nobody at the practice had ever met him.

The message from regulators is clear,  it's not enough to handle data correctly behind the scenes, you need to communicate it properly too.

When a member of staff leaves your organisation, there is a lot to think about, handovers, access permissions, and farewells. But one thing that often gets overlooked is the departing employee's email account.

The EU AI Act does create a registration duty, but it applies to providers of high-risk AI systems, not to businesses that simply use everyday AI tools. High-risk means things like CV-screening software, credit-scoring tools, or biometric identification systems, AI that makes or heavily influences decisions with serious consequences for people.

So, if a client has settled on a specific retention period, the question isn’t whether the number is right, it’s whether they can show their decision making that arrived at the number. 

A recent conversation I had with a colleague has inspired this week’s blog about a specific use of AI. AI tools that scan, rank, and filter job applications are everywhere now. They save time, and nobody's arguing otherwise.

Do you know which AI tools are being used across your business right now, including the ones nobody formally signed off on? If personal data is flowing into any of them, that's a GDPR question as much as a technology one.

"Legitimate interests" is one of six lawful bases for processing personal data under GDPR, and the most flexible. Used well, it lets businesses process personal data confidently - not just as a fallback.

You're not expected to produce data you no longer hold. But you are expected to tell people, upfront, how long you keep their data.

An independent publisher turned down a data access request, arguing it was too small a company to carry out the review involved and that the request was, in its view, excessive.

A practical, plain-English guide for Irish and UK business owners.

We were recently asked by a new client to evaluate their US-based agentic AI.

The short answer: yes, GDPR applies. But no, that doesn't mean event organisers need a signed form from every person in a room.

The answer lies in how Word documents are converted to PDF without first being cleaned.

Many business owners assume these devices are covered by a personal exemption.

Before employees work from home with access to personal data, carry out a risk assessment.

EU-US data transfers are open — for now. But the history of this area tells us that "for now" can change quickly.