Compliance Documents and Docu-don’ts
Wednesday 30 September 11am-12pm on Microsoft Teams
We invite you – and any colleagues who oversee, manage or support your organisation’s data protection, governance or legal affairs, including senior leaders, trustees, managers, DPOs, privacy leads and employees with responsibility for compliance – to a free online seminar.
This seminar will take a practical “building blocks” approach. We recognise that many organisations will already have a suite of data protection documents in place but the growing increase in data protection complaints and organisations struggling to process subject access requests we are seeing in practice highlights how important it is to check whether those documents still reflect how personal data is handled day to day. For other organisations, data protection compliance can feel difficult to tackle because it is not always obvious where to begin. The session will therefore take a step back and look at the core documents, responsibilities and processes that organisations can build on to demonstrate compliance, as well as some common pitfalls to avoid.
Three factors are prompting this seminar
- Data protection complaint changes: From June 2026, organisations must have a clear process for handling data protection complaints before individuals escalate matters to the ICO. That makes it especially important to ensure complaint-handling procedures, privacy information, and internal responsibilities are up to date.
- Our ongoing work with clients: Personal data often sits across different teams and activities. It is very easy for data protection-related documents to say one thing while day-to-day practice has quietly moved on and now you are falling foul of the law.
- ICO investigations: For the period January to March 2026, the ICO recorded 31,799 completed investigations. Even where matters do not involve major security incidents, regulatory scrutiny can still lead to requests for information, recommendations for improvement, and the need to evidence what steps have been taken.
What you will learn
Jessica Whittick, Associate & Solicitor, will be discussing the core documents you should have in place, including how to spot gaps between written policies and real-world practice. She will also cover practical steps senior leaders, trustees, managers and employees with compliance responsibilities can take to reduce data protection risks.
After the seminar
After the seminar you will receive an email containing:
- Sample audit questions from our DIY Data Protection Audit designed to challenge and assess basic understanding/your systems across your organisation.
As Jessica will discuss, a DIY Data Protection Audit helps organisations start identifying potential gaps and areas for discussion across areas such as training, records of processing, policies and procedures, complaint handling, international transfers, third-party arrangements, transparency, individual rights, risk and security.
- A list of key data protection documents that organisations commonly need to keep under review, with an indication of where further tailored support may be useful.
- The recording of the seminar for internal use.
We look forward to ‘seeing’ you!