IG & Data Protection Blog

Latest articles on information governance, UK GDPR, NHS DSPT, and data protection from Infinitic Consultancy.

Who is the Data Controller in Primary Care? A UK GDPR Guide 6 August 2026
A clear guide to understanding the distinct roles of GP practices and federations under UK GDPR. Learn who the data controller in primary ca…
How a Data Sharing Framework Simplifies UK GDPR Compliance 28 July 2026
Move beyond slow, one-off data sharing agreements. Discover how a structured data sharing framework provides a robust and efficient model fo…
A Better NHS Data Sharing Framework: Moving Beyond One-Off Agreements 28 July 2026
The traditional one-off data sharing agreement is slow and creates significant governance risk. Discover how a structured NHS data sharing f…
Processing AI Special Category Data in the UK: A Practical Guide 25 July 2026
A guide for UK organisations on managing AI special category data under UK GDPR. Learn how to handle inferred sensitive data, establish a la…
Applying a UK GDPR Risk-Based Approach for Small Businesses 25 July 2026
Learn how to apply a practical UK GDPR risk-based approach. Our guide helps small businesses manage data protection proportionately and with…
Handling a Child Subject Access Request: A UK GDPR Guide 24 July 2026
A practical guide for UK organisations on handling a child Subject Access Request (SAR). Learn to navigate UK GDPR, confidentiality, and exe…
AI Systems & Individual Rights UK: Navigating GDPR Compliance 4 April 2026
A recent ICO survey revealed 60% of UK adults are concerned about AI's use of their personal data. This guide helps UK businesses design AI …
7 Essential Steps for Effective ICO Audit Preparation 4 April 2026
Prepare for an ICO audit with confidence. This guide provides 7 essential steps, from documentation review to readiness drills, ensuring you…
3 Ways to Manage UK GDPR Processor Risk Effectively 31 March 2026
Discover three practical and proportionate ways to manage UK GDPR processor risk, safeguarding personal data and maintaining compliance in y…
How to Write Your DSPT Information Security Policy in 6 Steps 21 March 2026
Many organisations dread policy writing, but an effective Information Security Policy is crucial for DSPT compliance. This guide breaks down…
How to Get Your Organisation Cyber Essentials Certified: An IG Perspective 21 March 2026
Discover how to achieve Cyber Essentials certification UK, linking its five controls to robust information governance and UK GDPR compliance…
How to Conduct a Data Breach Risk Assessment in 5 Steps 15 March 2026
Demystify data breach risk assessment under UK GDPR with our practical, step-by-step guide, focusing on likelihood, impact, and actionable m…
How to Conduct a Data Protection Impact Assessment (DPIA) for NHS Organisations in 5 Steps 15 March 2026
Navigating DPIA NHS requirements can feel daunting. This practical guide outlines 5 clear steps for healthcare organisations to conduct a Da…
Nuisance Calls and the High Price of Complacency: What the £225,000 ICO Fines Mean for Your Business 12 March 2026
Recent ICO fines highlight a critical business risk: treating the Data Protection Impact Assessment (DPIA) as a mere formality. This guide e…
How to Map Your Organisation's Data Flows in 4 Simple Steps 9 March 2026
Feeling overwhelmed by UK GDPR? Discover how data flow mapping clarifies where personal data goes, helping you protect individuals and demon…
5 Critical Questions for Patient Data Sharing UK Compliance 9 March 2026
Navigating patient data sharing in the UK requires careful consideration. This guide outlines five essential questions to ensure your practi…
Why Your DSPT Evidence Checklist Isn't Your Improvement Plan 8 March 2026
Many organisations mistake a DSPT evidence checklist for a strategic improvement plan, but true compliance requires more than just ticking b…
How to Write a UK GDPR Privacy Notice People Actually Read 7 March 2026
Discover practical steps to create a UK GDPR-compliant privacy notice that is clear, accessible, and builds trust with your audience, moving…
How to Implement a Clear Desk and Clean Screen Policy That Staff Follow in 5 Steps 7 March 2026
Discover practical steps to implement an effective clear desk and clean screen policy, ensuring staff adherence, protecting sensitive data, …
3 Ways to Boost Staff Compliance with UK IG Policies 7 March 2026
Discover three practical, risk-based ways to genuinely improve staff adherence to Information Governance (IG) policies in your UK organisati…
How to Effectively Update Your Information Asset Register for UK GDPR Compliance 7 March 2026
Discover how to regularly update your Information Asset Register (IAR) in 6 practical steps, ensuring robust UK GDPR compliance and proactiv…
How to Handle a UK GDPR Subject Access Request in 7 Steps 7 March 2026
Many organisations mistakenly view a Subject Access Request (SAR) as a bureaucratic hurdle. This guide provides a practical, step-by-step ap…
Designing Effective UK Privacy Notices: Beyond Tick-Box Compliance 7 March 2026
Discover how to design UK GDPR privacy notices that truly inform and build trust, moving past generic templates to reflect your real-world d…
The DSPT submission deadline: Why Starting Your DSPT in May is a Risk 2 March 2026
Discover why leaving your DSPT submission to the last minute is a critical business risk, not just an administrative lapse. Learn how to avo…
3 Reasons Support Organisations Struggle to Complete the NHS DSPT (And How to Fix Them) 2 March 2026
Discover the three most common reasons support organisations struggle with the NHS DSPT and learn practical, risk-based steps to achieve com…
Reddit ICO Fine: Why ‘Self-Declaration’ of Age is no Longer Enough 28 February 2026
A landmark £14.47m ICO fine against Reddit has confirmed that relying on users to self-declare their age is no longer a defensible strategy …
UK GDPR Data Minimisation: Your Essential Risk Control Strategy 28 February 2026
Discover how the principle of UK GDPR data minimisation serves as a crucial risk control strategy, helping you protect individuals, build tr…
AI Automated Decisions UK GDPR: Essential Governance Before Deployment 28 February 2026
A practical guide for UK businesses on establishing robust governance for AI automated decisions under UK GDPR, focusing on risk management,…
Mastering AI Data Protection: Your Guide to the ICO Risk Toolkit 28 February 2026
Discover how the ICO's AI and Data Protection Risk Toolkit empowers UK businesses to responsibly develop and deploy AI, mitigating risks to …
UK GDPR Accountability in Practice: Demonstrating Compliance to the ICO 23 February 2026
Discover how to move beyond tick-box exercises and genuinely demonstrate your UK GDPR accountability to the ICO, focusing on evidence of rea…
Governance Leadership: Cultivating a Responsible UK GDPR Leadership Culture 23 February 2026
Discover how effective governance leadership is crucial for fostering a responsible UK GDPR culture, moving beyond mere compliance to genuin…
UK GDPR Privacy Notices: What Healthcare Providers Must Tell You 23 February 2026
With the increasing digitisation of health services, understanding and implementing robust UK GDPR privacy notices is paramount for healthca…
Navigating UK GDPR Email Marketing: A Risk-Based Framework for Marketers 23 February 2026
With recent ICO scrutiny on digital marketing, understanding UK GDPR and PECR for email campaigns is more vital than ever. This guide offers…
Planning Your DSPT Compliance Timeline: Deadlines & Mandatory Audits for UK Organisations 22 February 2026
Navigating the Data Security and Protection Toolkit (DSPT) is crucial for UK organisations working with health and social care data. Discove…
DSP Toolkit Compliance: A Guide for Non-NHS Suppliers & Start-ups 20 February 2026
A clear, practical guide for non-NHS suppliers and digital health start-ups on achieving DSP Toolkit compliance to work with the NHS.
Building Resilient Information Governance UK Frameworks: Beyond Tick-Box Compliance 17 February 2026
Discover how to build a truly resilient Information Governance (IG) framework in the UK, moving beyond superficial compliance to protect ind…
The Critical Role of Robust Information Governance for UK GP Federations 16 February 2026
Navigating the complexities of patient data while fostering collaboration is a major challenge for UK GP Federations. Discover why robust in…
Ensuring AI Fairness: Navigating UK GDPR Requirements for Your Business 16 February 2026
The UK government is pushing for AI regulation. Understand AI fairness UK GDPR compliance, algorithmic bias, and ICO requirements to build e…
Sharing Health Data for Research: A UK GDPR Compliance Guide 15 February 2026
A practical UK guide to sharing health data for research and innovation. Understand UK GDPR, consent, and legal frameworks to unlock medical…
UK GDPR & Care Home Data Sharing: A Practical Guide for Providers 14 February 2026
A practical guide to UK GDPR compliance for care home data sharing. Learn how to share residents' medical records safely with GPs, using law…
AI System Accuracy: A UK GDPR Guide to Building Trust and Compliance 14 February 2026
Discover how to ensure AI system accuracy under UK GDPR. Our guide explains the risks of AI 'hallucinations' and provides a practical checkl…
Why an External Data Protection Officer Makes Sense for Healthcare SMEs 13 February 2026
Discover the strategic advantages of appointing an external Data Protection Officer. A guide for UK healthcare SMEs on ensuring UK GDPR comp…
Which DSPT Category Are You? A Guide for IT Suppliers and Other UK Organisations 12 February 2026
Confused about your DSPT category? Our guide demystifies the key differences between IT Suppliers and Other Organisations to ensure you meet…
UK GDPR: A Landlord's Guide to Tenant Data Sharing 12 February 2026
Navigating landlord tenant data sharing under UK GDPR can be complex. Our guide explains your duties, lawful bases, and how to handle reques…
DSP Toolkit Compliance: An Essential Guide for Non-NHS Suppliers and Digital Health Start-ups 12 February 2026
A clear, practical guide for non-NHS organisations and start-ups on achieving DSP Toolkit compliance to partner with the NHS and handle pati…
Which DPIA Package Is Right for You? A UK GDPR Guide 11 February 2026
A clear guide to choosing the right DPIA package for your UK business. We compare Standard, Comprehensive, and Enterprise options to help yo…
NCSC Cyber Action Toolkit: A Practical UK GDPR Guide for Small Businesses 11 February 2026
The NCSC has launched a free Cyber Action Toolkit to help UK small businesses improve their security. Discover what it is and why it's essen…
Building Robust GDPR Policies for Healthcare: Your Essential Guide 11 February 2026
A practical guide for UK healthcare organisations on creating the essential policies and procedures needed for UK GDPR and DSPT compliance.
ICO Introduces DPA Part 3 Codes: A Guide to Law Enforcement Data Protection for UK Businesses 11 February 2026
The ICO has opened the door for new codes of conduct governing law enforcement data. Discover what these DPA Part 3 codes mean for your UK b…
IG Helpdesk: On-Call Data Protection Expertise When You Need It 11 February 2026
Discover how our IG Helpdesk provides unlimited, expert answers to your UK GDPR and data protection questions, with guaranteed 24-hour respo…
Tailoring Policy Packages for UK GDPR: A Practical Guide for Your Business 10 February 2026
Confused by UK GDPR policies? Our guide explains how tailoring policy packages (Starter, Professional, Enterprise) ensures compliance for yo…
Your On-Call IG Helpdesk: Unlimited UK GDPR Expertise for Healthcare 10 February 2026
Discover how our IG Helpdesk provides UK healthcare organisations with unlimited, expert Information Governance support for a fixed monthly …
The Power of DPIAs: Protecting Your Projects with a Comprehensive Data Protection Impact Assessment 10 February 2026
A Data Protection Impact Assessment (DPIA) is a crucial tool for UK GDPR compliance. Discover when you need one and how to conduct it effect…
Impact of the GDPR to Companies: Data Breach Notification 9 February 2026
Understand your obligations under UK GDPR for data breach notification. Our guide demystifies the 72-hour rule and provides a clear, step-by…
ICO Publishes Guide For GDPR Compliance 9 February 2026
A clear, practical breakdown of the ICO's guidance on UK GDPR. Our guide helps small businesses and freelancers understand their data protec…
Impact of the GDPR to Companies: The Mandatory DP Officer 9 February 2026
A clear guide to the UK GDPR DPO requirement. Understand if your UK business needs a Data Protection Officer, their key responsibilities, an…
UK GDPR Data Sharing: A Guide for Working with Voluntary and Private Sector Partners 8 February 2026
A practical guide to UK GDPR data sharing for voluntary and private sector organisations. Learn how to build trust, use data sharing agreeme…
UK GDPR Data Sharing: Lessons from Social Care for Your Business 8 February 2026
Discover how lawful UK GDPR data sharing transformed support for vulnerable families and what practical lessons your small business can lear…
Where Most Providers Struggle with the DSP Toolkit – And How to Fix It 8 February 2026
Overwhelmed by the DSPT? Our guide breaks down the most common DSP Toolkit struggles for UK care providers and suppliers, offering clear, ac…
Why the DSP Toolkit is Mandatory for Non-NHS Suppliers: A UK GDPR Guide 8 February 2026
If you're a non-NHS supplier handling health data, the DSP Toolkit isn't optional. Discover why compliance is crucial for contracts, UK GDPR…
Choosing a Lawful Basis for AI Processing: A UK GDPR Guide 6 February 2026
A practical guide for UK businesses on selecting the correct lawful basis for AI processing under UK GDPR. Demystify consent, legitimate int…
Impact of the UK GDPR to Companies: Consent Requirements 6 February 2026
A clear guide to UK GDPR consent requirements for UK businesses. Understand what valid consent looks like, how to prove it, and avoid common…
The Policies You Need for DSP Toolkit Success (Without Starting From Scratch) 6 February 2026
Feeling overwhelmed by the documentation for the Data Security and Protection Toolkit (DSPT)? Our expert guide breaks down the essential DSP…
Common Struggles with the DSP Toolkit and how to Fix Them 6 February 2026
Feeling overwhelmed by the DSPT? Our expert guide breaks down common DSP Toolkit struggles and provides clear, actionable solutions for your…
The CAF DSPT Toolkit - Why Meeting the Objectives Matter 6 February 2026
Discover why the Cyber Assessment Framework (CAF) within the DSPT is more than a compliance task. Learn how meeting its objectives protects …
What Is the DSP Toolkit – and Why It Matters for Your Organisation 6 February 2026
A plain English guide to the Data Security and Protection Toolkit (DSPT). Discover if you need to complete it and how it helps demonstrate U…
Cloud Adoption for GP Practices and Care Providers: Meeting DSPT and UK GDPR Obligations 6 February 2026
Moving to the cloud can strengthen DSPT compliance and simplify UK GDPR obligations for GP practices, care providers and NHS suppliers — if …
How to Train Your Team on IG – Without Overloading Them 6 February 2026
A practical guide for UK organisations on delivering effective Information Governance (IG) training that meets DSPT requirements without ove…
NHS England Issues Warning on Non-Compliant AI Scribes – Crucial Lessons for All UK Businesses 6 February 2026
NHS England issues warning on non-compliant AI scribes. UK businesses must understand data protection and liability for AI-enabled AVT.
Explaining AI Decisions: A UK GDPR Guide to Transparency 6 February 2026
Learn how to comply with UK GDPR when using AI. Our guide simplifies the ICO's advice on explaining AI decisions to build trust and ensure f…
AI Governance UK GDPR: A Practical Guide to Accountability 6 February 2026
A clear, practical guide for UK businesses on implementing AI governance under UK GDPR. Learn about accountability, DPIAs, and building trus…
Safeguarding Patient Data: A Guide to the Secure Use of AI in Health Care 5 February 2026
Discover essential strategies for integrating artificial intelligence into healthcare settings while maintaining robust data security and pa…
Lessons from the 23andMe Data Breach: A UK GDPR Guide for Small Businesses 5 February 2026
UK GDPR lessons from the ICO's report on the 23andMe Data Breach. A guide for UK small businesses on compliance and protecting data.
NHS Supply Chain Security: A New Era of Direct Engagement for UK Suppliers 24 January 2026
NHS England is moving beyond voluntary charters to a new phase of direct engagement on cyber security. Our guide explains what this means fo…
NHS Backs AI Notetaking: A Guide to UK GDPR and Patient Privacy 21 January 2026
NHS England is championing AI notetaking to free up clinicians. Our guide breaks down what this means for UK GDPR, patient data, and the res…
UK's Data Reform Becomes Law: What the New Data (Use and Access) Act Means for Your Business 19 June 2025
The Data (Use and Access) Act is now UK law. Our expert guide explains the key changes to UK GDPR, from DSARs to marketing fines, for your s…
UK GDPR Compliance Checklist: Your First Steps to Peace of Mind 18 June 2025
Our simple UK GDPR compliance checklist helps UK small businesses and freelancers understand data protection. Follow our actionable steps fo…
The UK GDPR Health Check: A 10-Point Self-Assessment for Small Businesses 17 June 2025
Simple UK GDPR health check for your small business. This 10-point self-assessment guides small businesses on data protection compliance.
Smart Living, Private Lives: Understanding the ICO's New IoT Guidance for UK Businesses 17 June 2025
A clear guide to the ICO IoT guidance for UK businesses. Understand your UK GDPR duties for smart devices, data protection, and building cus…
Are Marketers Data Controllers or Processors Under UK GDPR? 16 June 2025
Are marketers data controllers or processors under UK GDPR? Our clear, practical guide demystifies your role and responsibilities, offering …
ICO Seeks Input on New UK GDPR Rules for Smart Devices: What Businesses Need to Know 16 June 2025
The ICO has launched a crucial consultation on its new draft guidance for smart devices. Discover what the proposed UK GDPR rules mean for y…
A Guide to the DSPT for Small Businesses and Freelancers in the UK 15 June 2025
Discover if the Data Security and Protection Toolkit (DSPT) applies to your small UK business. Learn how its principles can strengthen your …
Understanding Your UK GDPR Compliance Checklist 14 June 2025
Demystify data protection with our practical UK GDPR compliance checklist. A plain English guide for small businesses on policies, privacy n…
UK Data (Use & Access) Bill Passes, Signalling Shifts for UK GDPR 12 June 2025
The Data (Use & Access) Bill awaits Royal Assent. Understand the implications for UK international data transfers and new compliance require…