
Under the UK GDPR, the majority of organisations processing personal data are required to create and maintain a ROPAs

In this blog, we will outline a step-by-step procedure on how you can create a ROPA.

Let’s face it, there is nothing straightforward or simple about responding to a data subject access request (DSAR).

One of the fundamental rights of an individual (data subject), under the UK GDPR is to be able to access and receive a copy of their personal information.

This blog considers at high-level various possible legal ramifications of using Chatbots, especially ChatGPT, concerned with data protection risks.

For all of us, email can be both a blessing and a curse. On one hand you have the speed and convenience of communication....

When looking to comply with the General Data Protection Regulation (GDPR), it is always a worthwhile exercise....

BS 10012 is a standard which has been developed to enable organisations to implement a personal information management system (PIMS).

We provide some questions which should help you in determining your level of compliance with the GDPR

The GDPR (EU) 2016/679 is an EU regulation which came into effect on 25 May 2018 and set a new benchmark for the processing of personal data.

On 2 February 2022, the Information Commissioner’s Office (ICO) laid before Parliament changes around restricted international personal data transfers.

We are focussing on transfer risk assessments (TRAs), commencing with the background that led to their introduction and then addressing the five questions.

On 16 July 2020, the CJEU issued its judgement on the adequacy of both the Privacy Shield and standard contract clauses (SCCs).

The need for guidance on how organisations should best protect privacy and manage personal information has never been more pertinent.

The EU GDPR and the UK DPA both require organisations to protect and ensure the privacy of any personal data which they process.

This blog takes a look at DPOs and considers when to look in-house and when a virtual, external resource or hybrid resource may be a better option.

We look at the requirement within both the DPA and the GDPR to verify the identity of an individual making a request before acting or releasing information

Is there a catch-all international standard that effectively proves external verification of data protection compliance?

This blog looks at a very specific area of the GDPR - Article 28 and data transfer outside of the EEA.

This blog focuses on an aspect of the GDPR which can be particularly challenging for a number of organisations.

There is some confusion about the difference between personal data and sensitive personal data and even whether sensitive personal data exists as a term!

We have seen an increased focus on the General Data Protection Regulation (GDPR) by certification body (CB) assessors when conducting ISO 27001 audits.

Broadly speaking, information security is held up by three pillars – People, Process and Technology. It is widely accepted that humans are the weakest link

Why can it still be challenging to gain traction on your GDPR compliance project?
Having been involved in over 350 successful ISO 27001 certifications, URM is ideally placed to advise you on the essential activities and tasks you will need to carry out in order to maintain and improve your ISO 27001 auditing function and programme
As a PCI QSA, URM can assist you with a range of services, including conducting gap analyses, helping you reduce your CDE scope, conducting penetration tests an
In order to establish how susceptible your users are to phishing, URM is able to simulate a targeted social engineering attack.