GDPR and Data Protection Advice

Alex Goodman writes every article here. He is a data protection consultant with over ten years of practice across financial services, SaaS, healthcare, and the charity sector.

The topics come from the questions UK businesses ask: how to respond to a subject access request, what to do in the first 72 hours of a data breach, whether you need a named DPO, and how to handle UK GDPR without a full-time compliance team.

The answers are in plain English.

Using AI Tools in Your Business: What GDPR Requires

Using AI Tools in Your Business: What GDPR Requiresby: Alex GoodmanPublished on: 25/09/2026

71% of UK employees use AI tools their employer never approved. Here's what UK GDPR requires when your business uses AI: contracts, DPIAs, transparency and the new automated decision rules.

AIGDPRUK GDPRDPIAautomated decision-makingDUAAsmall business
Read more
Using AI Tools in Your Business: What GDPR Requires

What Is Legitimate Interest Under GDPR, and When Can You Use It?

What Is Legitimate Interest Under GDPR, and When Can You Use It?by: Alex GoodmanPublished on: 22/09/2026

A plain-English guide to the legitimate interest lawful basis under UK GDPR: the three-part test, where it fits and where it doesn't, the Experian case, and the new recognised legitimate interests introduced by the Data (Use and Access) Act.

Read more
What Is Legitimate Interest Under GDPR, and When Can You Use It?

Employee Subject Access Requests: What You Have to Hand Over When Staff Ask for Their Data

Employee Subject Access Requests: What You Have to Hand Over When Staff Ask for Their Databy: Alex GoodmanPublished on: 17/09/2026

An employee sends a subject access request in the middle of a grievance, disciplinary or tribunal claim. What you must search, what you can hold back, the 2026 DUAA changes, and the mistake that got a director convicted.

subject access requestemployee SARGDPRemploymentDPOgrievancetribunalData Use and Access Act
Read more
Employee Subject Access Requests: What You Have to Hand Over When Staff Ask for Their Data

Can You Email Your Customers Without Their Permission?

Can You Email Your Customers Without Their Permission?by: Alex GoodmanPublished on: 15/09/2026

Yes, UK businesses can email existing customers without consent, but only under PECR's soft opt-in and only if 4 conditions are met on every send. Here is what the rules say, where businesses fail, and what the ICO now fines.

PECRemail marketingsoft opt-inGDPRICOdirect marketingUK business
Read more
Can You Email Your Customers Without Their Permission?

Driven by expertise and personalised service, we’re here to guide you towards GDPR compliance every step of the way.

© 2026 - GDPR Consultant - All Rights Reserved.

Alex Goodman is an experienced GDPR consultant and outsourced Data Protection Officer working with UK businesses to improve their DPO and GDPR compliance.

© 2026 - GDPR Consultant - All Rights Reserved.