Looking back on 2022

As we enter a new year and are inundated with chants of  ‘New year new you’, we’d like to pause, take a breath, and reflect on everything that happened for us in  2022.

Spring 2022: DPAS EVENTS

We started the year off with an all-out celebration for Data Protection Week (a practitioners’ paradise). Joining the international effort to encourage everyone to embrace their data privacy responsibilities, we posted a week’s worth of tricks and tips on a range of subjects, from handling SARs, to understanding cookies. 

As spring sprung we assembled our entire team for a staff training weekend in beautiful mid Devon. We delivered presentations and brainstormed new ideas to develop both new and existing branches of our business. We were also joined by Oliver from Monkey’s Paw Consultancy Ltd, who collaborated with our team on a more intuitive, agile sales approach. Most importantly, we indulged in a game of rounders with our sponsored Exeter Chiefs player Abby Middlebrook. 

In the wonderful world of data protection, we celebrated the 4th anniversary of GDPR by releasing our very own Nigel Gooding’s dissertation, discussing the historical context and political climate which led to the passage of the GDPR and the UK’s Data Protection Act. 

ICO25

The ICO were certainly busy this summer with their launch of ICO25, a report which outlines the “strategic enduring objectives” for the next three years. In it, they highlighted their focus on clamping down on illegal marketing practices, as well as working together with public authorities to improve their compliance. They also provided several new guidance documents, including a new journalism code of practice and a brand-new international transfers risks assessment tool (which we covered in detail on our December bullettin HERE ). They even had a spare moment to throw their annual Data Protection Practitioners conference on the 19th of July. 

The Children’s Code

September meant the anniversary of the Children’s Code, a crucial code of practice (with design guidance), outlining how any online services–which children may access–should protect them in digital spaces. Although it’s not a law and is thus not-binding in a legal sense, compliance (or lack thereof) with it will be a factor the ICO will consider in the event of any breaches or other events that lead to children being put at risk by an organisation’s products or services. 

Autumn/Winter 2022

It’s no secret that we’re all big rugby fans at DPAS. In October we had a training session with our sponsored athletes, Exeter Chiefs players Abby Middleton and Jack Yeandle. We recently met up to score a try or two and discuss tactics on field and in the boardroom. We even had time for a cartwheel or two.

In support of the ICO’s warning that internal complacency can lead to data breaches (not to mention the hefty fine they handed to company Interserve), we launched our data breach blog series, covering everything from identifying a breach to reporting and responding to them. You can find them here: Identifying data breaches and Responding to data breaches 

DPAS Conference 2023

In November we took the plunge to Engage, Educate and Empower, starting preparations for our first conference; the DPAS South West Data Protection and Information Governance event. Working in partnership with Responsum, we’re bringing together world renowned privacy and data strategy experts to discuss hot topics within the industry to help you within your role. We’ve got some very exciting speakers and guests that will train, inform, and educate you and your team. Interested in reserving a spot? We’ve got you covered, click here! 

We wound down for December with our 12 days of Data Protection Christmas. As the festive season rolled in, we rolled out to Dublin for a two night stay to celebrate everything we’ve achieved this year. 

Phew, what a year! We can’t wait to see what 2023 has in store for us. 

related posts

Halloween-themed illustration for a blog about GDPR audits and data protection risks
Melanie Garnett

Skeletons in the Server Room

The scariest data protection risks are the ones you can’t see. From zombie data to ghost suppliers, here’s how an independent GDPR audit helps you find what’s lurking and deal with it with confidence.
These documents may have been reviewed, and oftentimes approved at Board level. You might even require employees to sign that they have understood their responsibilities in them, but the question still remains. Are your data protection policies actually working?

Policy vs practice
Having policies in place and having effective data protection compliance processes are two very different things, and having policies is not indicative that you are meeting your obligations. Even the best policy does little to protect personal data or ensure compliance if staff don’t understand it, internal processes don’t reflect it, and no one checks if it’s followed.

Read More »
Melanie Garnett

Your data protection policies are written. Are they actually working?

While most organisations recognise internal policies such as a Data Protection, Data Breach, Retention, or Subject Access Request Policy, as vital components of the data protection compliance framework, simply having them written is only part of the equation.

These documents may have been reviewed, and oftentimes approved at Board level. You might even require employees to sign that they have understood their responsibilities in them, but the question still remains. Are your data protection policies actually working?

Policy vs practice
Having policies in place and having effective data protection compliance processes are two very different things, and having policies is not indicative that you are meeting your obligations. Even the best policy does little to protect personal data or ensure compliance if staff don’t understand it, internal processes don’t reflect it, and no one checks if it’s followed.

Read More »
Alex Haslam

DPAS Data Protection Bulletin – September 2026

Welcome back to our monthly DPAS bulletin, where we cover the latest data protection news and developments from around the world.

Ever wondered how a routine government spreadsheet leak turns into a two-year covert court order? How about why the police might feel your mother-in-law’s contact details were key to national security? Have you ever pondered how many working weeks it takes to read a cookie banner? Whether Wall Street knows about your last GP visit? Or if you’re in Australia (g’day) why an AI is sending notes on your worst rashes to faraway cloud servers?

Read about all this and more in our latest DPAS Data Protection Bulletin.

Read More »
Bethany Meredith

Navigating SAR Chaos: Why PDF Conversion and Deduplication Are Your Secret Weapons

When a Subject Access Request lands in your inbox, the one-month clock starts ticking immediately, and the real bottleneck usually isn’t finding the data, it’s wading through duplicate files and endless email threads. Discover why deduplication and PDF conversion aren’t just nice-to-haves but non-negotiable steps in your SAR pipeline: cutting review volume by up to 60%, closing redaction loopholes, and delivering a secure, universally accessible disclosure , all while keeping your compliance team sane and your deadline intact.

Read More »

Get a Free Consultation