- Contact The DPO Centre
- +44 (0)203 797 1289
- hello@dpocentre.com
November 9, 2026
Automated credit scoring is not new. Lenders have long used algorithms to assess creditworthiness, relying on pre-defined rules and traditional credit bureau data.
Modern AI credit scoring represents a fundamental shift in approach. Machine learning models can analyse much larger datasets and identify more complex patterns than traditional scoring systems.
October 26, 2026
Unapproved or unmanaged AI use is often referred to as shadow AI. It can include employees deliberately using tools that have not been approved, as well as AI functionality embedded into software already used across the business.
September 14, 2026
Data Protection Representatives (DPRs) and clinical trial Legal Representatives sound similar but they fulfil different legal requirements and have distinct responsibilities. Both roles may be required when a clinical trial sponsor is not established in the UK or EU. If you are planning trials across both jurisdictions, several separate appointments may be needed, alongside considering whether a Data Protection Officer (DPO) is also required.
August 31, 2026
Assigning the Data Protection Officer (DPO) role to a C-suite executive or senior leader can seem like a practical solution. They understand the organisation, have direct access to decision-makers, and are often already responsible for overseeing compliance or governance.
July 6, 2026
The introduction of the charity soft opt-in was widely welcomed across the sector. Brought in through the UK’s Data Use and Access Act 2025 (DUAA) and available to use from February 2026, the change allows charities to send certain electronic marketing communications without obtaining explicit consent, provided specific conditions are met.
June 22, 2026
It’s easy to assume that a Data Protection Officer (DPO) is only necessary for large organisations or those operating in highly regulated sectors. As a result, many organisations rely on support from legal, compliance, or IT teams, rather than appointing a dedicated privacy professional.
That can work for a while, but as businesses grow, so do the data protection responsibilities. For example, introducing new technologies, launching new products and services, or using more third-party suppliers can all create privacy risks that ad hoc support cannot manage.
May 25, 2026
GDPR compliance gaps don’t always come from high-risk data processing and sometimes come from seemingly low-risk activities that no one thinks to question. Organisations can often prioritise their compliance reviews on obvious areas, such as special category data, large-scale profiling, and international data transfers. These activities carry a higher risk of harm to individuals and often trigger additional GDPR obligations. But it can also mean lower-profile processing is reviewed less often, or not at all.
May 11, 2026
Identity verification for DSARs is essential to prevent unauthorised data disclosure and avoid unnecessary delays.
To respond to DSARs in a compliant and effective way, organisations must strike a careful balance between two risks: sharing personal data with the wrong person and delaying or obstructing valid DSAR requests by asking for excessive or unnecessary identification, which could lead to poor user experience and complaints.
April 27, 2026
Data Protection Impact Assessments (DPIAs) help sponsors identify and address risks to participant data before a clinical trial begins. Under the UK and EU General Data Protection Regulation (GDPR), they are a mandatory requirement for high-risk personal data processing, which includes health information used in clinical research. Getting data protection right is not just a regulatory requirement but a critical part of running an effective and trustworthy trial.
April 13, 2026
Clinical research organisations are increasingly asked to demonstrate privacy assurance through recognised frameworks and certifications. For teams already navigating multiple regulatory requirements, this can quickly feel overwhelming.
Whilst compliance with laws such as the EU and UK General Data Protection Regulation (GDPR) or the US Health Insurance Portability and Accountability Act (HIPAA) remains essential, sponsors, partners, and regulators are now also looking for evidence that privacy and security controls operate effectively in practice.