1
Tell us what happened
Explain the organisation, data involved, what happened and any action already taken.
Solicitors DirectTMData Protection & GDPR Help. NOW.
Explain the data protection or privacy issue in plain English. Get clear guidance first, then specialist help if needed.
Type or speak — whichever is easier.
Or choose a topic to get started
How Data Protection & GDPR Enquiries Work
2
Receive free guidance
Get clear initial information about the duties, risks and practical next steps that may matter.
3
Complete your details
Where specialist help may be appropriate, provide only the information needed to match the enquiry.
4
Speak with the right solicitor
We connect suitable enquiries with a participating data protection and privacy solicitor.
What May Matter in a Data Protection Issue?
The key questions often concern the type and sensitivity of the data, the lawful basis for using it, security, reporting duties, individual rights and the risk of harm.
The Personal Data
The categories, sensitivity, volume and source of the information can affect the duties and risks involved.
What Happened
Loss, unauthorised access, disclosure, misuse, cyberattack or human error may require different practical responses.
Lawful Basis & Duties
Consent, contract, legal obligation, legitimate interests, transparency and accountability may all be relevant.
Timing & Urgency
Serious breaches can involve a 72-hour ICO reporting window, while SARs and regulatory notices have their own deadlines.
Evidence You Should Keep
Preserve records showing the data involved, systems, decisions, notifications, contracts and steps taken after the issue arose.
Incident & Decision Logs
System and Security Records
ICO or Individual Correspondence
Policies & Privacy Notices
Processor and Supplier Contracts
Timeline & Key Deadlines
Data Protection & GDPR FAQs
What is a personal data breach?
A personal data breach is a security incident that leads to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.
Do all data breaches have to be reported to the ICO?
No. Reporting generally depends on whether the breach is likely to create a risk to people’s rights and freedoms. Serious cases may also require notification to affected individuals.
How quickly must a breach be reported?
Where notification to the ICO is required, the usual rule is without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
How long do we have to answer a Subject Access Request?
The usual period is one month, although limited extensions may apply for complex or multiple requests. The precise calculation and permitted exemptions can require careful review.
Can an employee make a Subject Access Request?
Yes. Employees, former employees and job applicants can make requests for their personal data, although some information may be withheld or redacted where a lawful exemption applies.
Do we need consent to use personal data?
Not always. Consent is only one lawful basis. Other bases may include contract, legal obligation, vital interests, public task or legitimate interests, depending on the circumstances.
What powers does the ICO have?
The ICO can investigate, request information, issue enforcement notices and impose financial penalties. It may also provide guidance or accept remedial action depending on the matter.
Can I ask a question without instructing a solicitor?
Yes. Solicitors Direct provides free initial guidance. Specialist help is offered only where appropriate and you choose to proceed.
Data Protection Problems. Clear Guidance. Real Help.
We make UK GDPR, privacy, breach and ICO issues easier to understand and connect suitable enquiries with the right specialist solicitor.
