Sound familiar?
- Laptops holding customer data are not encrypted
- Everyone can see every folder on the shared drive, including HR
- Old customer data from years ago is still sitting in mailboxes and file shares
- You received a subject access request and cannot find all the data
- A laptop or phone has been lost and you do not know what was on it
- Ex-staff still have access to cloud storage
Key facts
- UK GDPR Article 32 requires appropriate technical and organisational measures to secure personal data
- Reportable personal data breaches must be reported to the ICO within 72 hours of becoming aware
- Most UK organisations processing personal data must pay the ICO data protection fee; tier 1 is £52 a year
- Encryption, MFA and least-privilege access are core technical measures
- The Data (Use and Access) Act 2025 amended UK data protection law, with changes phased in between June 2025 and June 2026
- We handle the IT; for legal advice you need a data protection specialist or solicitor
Where IT fits into GDPR
UK GDPR is mostly about what you do with personal data and why. But Article 32 also requires "appropriate technical and organisational measures" to keep it secure, and that is where your IT comes in. If your privacy policy says customer data is protected, the laptops need to be encrypted, the accounts need MFA, and access needs to match job roles.
dijitul support does the technical side. We are not lawyers and do not give legal advice on lawful bases, privacy notices or contracts. For those, use a data protection consultant or solicitor. What we do is make sure your systems do what your policies promise.
The technical measures we put in place
- Encryption: BitLocker on Windows, FileVault on Mac, encryption enforced on phones that access company data, with recovery keys stored safely in Microsoft Entra ID or Intune.
- Access control: SharePoint and file share permissions mapped to roles, so HR and finance folders are only visible to the right people. Leavers removed on their last day.
- MFA on every account that can reach personal data. See password and MFA setup.
- Backups: regular, tested, with a copy offline or immutable, so you can restore personal data after an incident. See data backup and recovery.
- Retention: Microsoft 365 retention policies so data is kept as long as you need it and deleted when you do not.
- Remote wipe: lost or stolen devices can be wiped through Intune.
- Secure sending: Microsoft Purview message encryption or sensitivity labels for emails containing personal data.
Breaches: the 72-hour clock
If a personal data breach is likely to result in a risk to people's rights and freedoms, UK GDPR requires you to report it to the ICO within 72 hours of becoming aware of it. That includes a stolen unencrypted laptop, a hacked mailbox with customer correspondence in it, or ransomware that makes records unavailable.
When something happens, we help you work out the technical facts quickly: what data was on the device or in the account, whether it was encrypted, whether an attacker accessed it, and what logs show. That is the information you need to decide whether to report. Encryption matters here: a lost laptop protected by BitLocker is a very different situation from one that is not.
Subject access requests and finding data
People have a right to a copy of the personal data you hold about them, and you normally have one month to respond. If that data is spread across mailboxes, OneDrive, SharePoint and old file shares, finding it is hard. We can run Microsoft Purview content searches across your tenant to locate email and documents mentioning a person, and export them for review. Tidying data into fewer, better-organised places makes the next request far easier.
Data minimisation in practice
The less personal data you keep, the less there is to lose. Common clean-ups include old CVs from recruitment sitting in a director's inbox, scanned ID documents saved to a shared desktop folder, spreadsheet exports from the website left in Downloads, and copies of card details written into emails. We help you find these with content searches, agree what can go, and set retention policies so they do not build up again.
Recent changes and pricing
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and amended UK GDPR and PECR, with changes phased in up to June 2026. Among other things, the ICO can now fine up to £17.5 million or 4% of global turnover for PECR breaches, the same level as UK GDPR, which makes website cookie compliance more important. See cookie consent compliance.
Most organisations processing personal data must also pay the ICO's annual data protection fee. Since 17 February 2025 that is £52 for tier 1 micro organisations and £78 for tier 2.
Our technical GDPR work is charged at £45 an hour + VAT. Ongoing management of encryption, access and leavers fits our Complete plan at £99 a month + VAT.
What it costs
Support plans from £25 a month + VAT, or £45 an hour + VAT for one-off fixes. Pick a plan if you want it looked after every month, or pay by the hour for a one-off job.
Essential
Keep it updated, backed up and watched.
- Website software updates (core, plugins, themes) applied and checked
- Daily backups
- Uptime monitoring
- Security monitoring
Business
Updates plus an hour of fixes every month.
- Everything in Essential
- 1 hour of fixes or changes every month
- Priority support
Complete
Website and your team's IT, covered.
- Everything in Business
- 3 hours of fixes or changes every month
- IT and Microsoft 365 helpdesk for your team
No plan? The first 30 minutes are the minimum charge, then we bill in 15-minute blocks.
Frequently asked questions
Does GDPR require encryption?
UK GDPR does not name encryption as mandatory, but Article 32 lists it as an example of an appropriate security measure, and the ICO expects it where risk justifies it. In practice, laptops and phones holding personal data should be encrypted. dijitul enables BitLocker or FileVault and stores recovery keys centrally.
What should we do if a laptop with customer data is lost?
Tell your IT support immediately. dijitul can remote wipe it if it is managed through Intune, check whether it was encrypted and work out what data it held. If the breach is likely to put people at risk, it must be reported to the ICO within 72 hours of becoming aware of it.
Is dijitul a GDPR consultant?
No. dijitul handles the technical measures: encryption, access control, MFA, backups, retention policies and breach investigation. We do not provide legal advice on privacy notices, lawful bases or contracts. For that, use a data protection specialist or solicitor, and we will make sure the IT matches what they recommend.
How much is the ICO data protection fee?
Since 17 February 2025, the ICO fee is £52 a year for tier 1 micro organisations, £78 for tier 2 small and medium organisations, and £3,763 for tier 3 large organisations. Some organisations are exempt. Check the ICO's fee self-assessment tool to confirm what you owe.
Can you help us respond to a subject access request?
Yes. dijitul can run Microsoft Purview content searches across Exchange, OneDrive, SharePoint and Teams to find emails and files mentioning a person, then export them so you can review and redact. Searches are charged at £45 an hour + VAT.
Related
Get it fixed
One-off fixes are £45 an hour + VAT. You'll know the likely cost before we start.