A visual map of factors to consider when planning to introduce workplace monitoring of employees

A visual map of data protection risk factors, indicators and impacts, to assist with DPIAs, DP strategy and planning

A visual guide to potential impacts to rights, freedoms, welfare and interests of living natural persons. For assistance with DPIAs, DP risk management decisions and LIAs.

A quick-reference guide to ascertaining how 'fair' your processing of personal data is likely to be - helpful for doing LIAs, DPIAs, planning new processing and practicing DPbD2

A mind-map of 'Legitimate Interests' as a lawful basis for processing. For reference when carrying out LIAs, DPIAs, handling objections and planning new processing activities

A visual map of the processes involved in responding to a Data Subject Access Request. Useful for handling requests, planning processing activities, or making your own request.

Unless you're a data protection geek, you've probably never given much thought to the differences between 'special category personal data', 'sensitive' and 'confidential' information. I am a data protection geek, so this is the sort of thing I think about often.

In my time, I have encountered a number of boggles which have originated from confusion between 'special', 'sensitive' and 'confidential'. It's common for these terms to be used interchangeably, and in casual conversation there's nothing wrong with that (she says through gritted teeth).

However, when setting policy, writing procedures, designing or configuring systems, it's important to be accurate and precise about this sort of thing. Muddling up these three terms can cause problems later down the line - whether that's not having appropriate controls in place, or spending time/money/effort that wasn't actually necessary at all.

Not sure what the differences are? Well, you've come to the right place - here's a PDF with side-by-side comparison and a few examples for you to print and hang on the wall

Figure out whether you need to ask for consent or not before dropping that cookie on site visitors/app users

A decision support tool for deciding whether to buy that shiny AI machine learning thingummybob

A step-by-step guide to preparing your organisation for implementing GDPR Article 22.2 objections (to processing for direct marketing purposes)

Flow chart for working through GDPR and PECR questions to determine whether it's safe to send that unsolicited direct marketing email