An end of year message from the DPAS team…

An end of year message from the dpas team

As we come to the end of the year, I wanted to take a moment to thank you for the trust you’ve placed in us over the past twelve months. It has been a genuinely rewarding year for our team, and we could not have achieved what we have without the support and collaboration of our clients.

This year has been an exciting one for DPAS in lots of ways. We’ve had the privilege of working with organisations across a wide range of sectors, supporting them in navigating data protection challenges with confidence and clarity, which only strengthens our mission to engage, educate, and empower.

Over the course of the year, the Consultancy Team at DPAS, currently lead by Lauren Durham-Hutchins, has onboarded 14 new Outsourced DPO clients, adding to an extensive portfolio of organisations trusting DPAS to advise and support on integral compliance activities. Whilst delivering those services the team has responded to nearly 2000 support requests, and delivered countless additional one-off projects. Including compliance audits for international organisations, charities, and local government, actively supporting the responsible development and deployment of AI through DPIA’s, and drafting entire policy suites, auditing DSPT/CAF submissions, building entire Records of Processing Activities, and more. 

Alongside that our SAR team, lead by Zack Bellekom, has redacted over 120,000 pages of subject access requests: including complex HR cases, and handwritten social care records. As well as supporting clients with search criteria/requirements, de-duplicating data sets, and drafting data subject response letters. A service that offers our clients a trusted partner in some of the most high pressure circumstances.

We have also delivered over 60 training courses, made up of our publicly available courses which include half day training sessions to extensive accredited courses spanning 5 days learning, not to mention the countless bespoke training sessions that have helped organisations to feel confident in specific activities, legislation, and more.  All made possible by our Training Manager, Megan Black. 

This year also saw two of our team nominated, and shortlisted, for awards at PICASSO, one graduate university, one enroll on a post-graduate information rights law course, and numerous members of the team taking opportunities for professional development across a variety of related training. Not to mention our wonderful CEO, Melanie Garnett, welcomed a baby girl – Arabella, in November.

So, it has been a busy year at DPAS! 

On behalf of the entire team I want to say a sincere thank you for your continued partnership. Your trust, engagement, and commitment make our work meaningful and impactful.

As we look ahead to the new year, we’re excited about what’s to come. We remain committed to providing clear, practical, and trusted data protection consultancy, and we’re very much looking forward to continuing to work alongside you in the year ahead.

Thank you once again for being part of our journey this year. From all of us, we wish you a relaxing end to the year and every success in the year ahead.

 

Picture of Nat Bennett

Nat Bennett

Nat is our Head of Consultancy. She leads our internal and external consultants, supporting with project delivery, mentoring, and development. Nat also delivers some of our BCS and CPD accredited training courses, bringing her experience in teaching to the DPAS training programme.

related posts

Halloween-themed illustration for a blog about GDPR audits and data protection risks
Melanie Garnett

Skeletons in the Server Room

The scariest data protection risks are the ones you can’t see. From zombie data to ghost suppliers, here’s how an independent GDPR audit helps you find what’s lurking and deal with it with confidence.
These documents may have been reviewed, and oftentimes approved at Board level. You might even require employees to sign that they have understood their responsibilities in them, but the question still remains. Are your data protection policies actually working?

Policy vs practice
Having policies in place and having effective data protection compliance processes are two very different things, and having policies is not indicative that you are meeting your obligations. Even the best policy does little to protect personal data or ensure compliance if staff don’t understand it, internal processes don’t reflect it, and no one checks if it’s followed.

Read More »
Melanie Garnett

Your data protection policies are written. Are they actually working?

While most organisations recognise internal policies such as a Data Protection, Data Breach, Retention, or Subject Access Request Policy, as vital components of the data protection compliance framework, simply having them written is only part of the equation.

These documents may have been reviewed, and oftentimes approved at Board level. You might even require employees to sign that they have understood their responsibilities in them, but the question still remains. Are your data protection policies actually working?

Policy vs practice
Having policies in place and having effective data protection compliance processes are two very different things, and having policies is not indicative that you are meeting your obligations. Even the best policy does little to protect personal data or ensure compliance if staff don’t understand it, internal processes don’t reflect it, and no one checks if it’s followed.

Read More »
Alex Haslam

DPAS Data Protection Bulletin – September 2026

Welcome back to our monthly DPAS bulletin, where we cover the latest data protection news and developments from around the world.

Ever wondered how a routine government spreadsheet leak turns into a two-year covert court order? How about why the police might feel your mother-in-law’s contact details were key to national security? Have you ever pondered how many working weeks it takes to read a cookie banner? Whether Wall Street knows about your last GP visit? Or if you’re in Australia (g’day) why an AI is sending notes on your worst rashes to faraway cloud servers?

Read about all this and more in our latest DPAS Data Protection Bulletin.

Read More »
Bethany Meredith

Navigating SAR Chaos: Why PDF Conversion and Deduplication Are Your Secret Weapons

When a Subject Access Request lands in your inbox, the one-month clock starts ticking immediately, and the real bottleneck usually isn’t finding the data, it’s wading through duplicate files and endless email threads. Discover why deduplication and PDF conversion aren’t just nice-to-haves but non-negotiable steps in your SAR pipeline: cutting review volume by up to 60%, closing redaction loopholes, and delivering a secure, universally accessible disclosure , all while keeping your compliance team sane and your deadline intact.

Read More »

Get a Free Consultation