Ask the Ask the DPO
Your UK GDPR, Data Protection Act 2018, PECR or EU GDPR question answered properly. Each answer cites the law, is checked against the latest legislation and is reviewed by a practising DPO before it reaches you.
An answer you can act on and evidence
Every answer follows the same practitioner structure, so you know what the law says, what to do about it and how settled the position is.
Bottom line
The answer in one or two sentences, no hedging.
Exact citation
The article, section, schedule or regulation it rests on.
UK vs EU
Where the two regimes have diverged and it matters to you.
Actions and evidence
What to do next and what to keep to show accountability.
Confidence rating
High, Medium or Verify, so you know where the law is still moving.
Fast because of AI, right because of a DPO
You ask
Describe your scenario in the form below. Leave out names and other personal data, as a description of the situation is enough.
We research
Our research assistant checks the current revised legislation, ICO and EDPB guidance and relevant case law.
A DPO reviews
A qualified practitioner checks and signs off every answer before it is sent to you by email.
What an answer looks like
These are shortened examples. Your answer will be tailored to the facts you give us.
Do we need to appoint a Data Protection Officer?
- Bottom line
- Only if you are a public authority, or your core activities involve large-scale regular and systematic monitoring of individuals, or large-scale processing of special category or criminal offence data. Otherwise appointing one is voluntary.
- Legal basis
- UK GDPR Art 37(1). If you do appoint one, Arts 38–39 apply in full.
- UK vs EU
- EU GDPR Art 37 applies the same test, but Member State law can widen it. Germany, for example, adds a headcount trigger.
- What to do
- Record your assessment and the reasons for it. If you appoint a DPO, publish their contact details and tell the ICO.
- Confidence
- HIGH
How long do we have to respond to a subject access request?
- Bottom line
- One month from receipt, which you can extend by up to two further months for complex or numerous requests if you tell the requester within the first month.
- Legal basis
- UK GDPR Arts 12(3) and 15. The Data (Use and Access) Act 2025 puts the "stop the clock" rule (while you await clarification or ID) and the "reasonable and proportionate search" standard into statute.
- What to do
- Log the date of receipt, verify identity promptly and record any clarification requests and the searches you carried out.
- Confidence
- VERIFY Check the commencement status of the DUAA SAR provisions on the date you respond.
Do we still need consent for analytics cookies?
- Bottom line
- In the UK, possibly not for analytics used purely for statistical purposes, provided users get clear information and a simple way to object. In the EU, yes.
- Legal basis
- PECR reg 6, as amended by the Data (Use and Access) Act 2025. In the EU, ePrivacy Directive Art 5(3) with the EU GDPR consent standard.
- UK vs EU
- This is a real divergence. If your site targets EU users you will still need opt-in consent for them.
- Confidence
- VERIFY Check commencement and the latest ICO storage and access guidance before you change your banner.
Tell us the scenario
We aim to reply by email within three working days. We answer a limited number of questions each week, and the most useful ones may be shared anonymously to help others.
- Covers UK GDPR, the DPA 2018, PECR, EU GDPR and the Data (Use and Access) Act 2025
- Lawful basis, SARs, DPIAs, transfers, processor contracts, cookies, marketing, AI and breaches
- Live breach? Say so in the topic field. The 72-hour clock may already be running
Simon Green, Founder of Sentinel42
Simon has more than 16 years of practitioner experience in GRC and information security across the NHS, financial services, energy and technology. He has taken organisations through ISO 27001 certification and SOC 2 Type 2 attestation, and acts as DPO and fractional CISO for UK businesses.
DPO retainer
A named, DPO-led service with ongoing advice, DPIA and SAR support and breach response, sized to your organisation.
Book a call →Breach response
Priority triage, ICO notification decisions and ready-to-send drafts when the 72-hour clock is running.
Ask about cover →ISMS27001 platform
Run ISO 27001, GDPR and up to 12 other frameworks in one place, with policies, risks, controls and evidence.
Explore the platform →