The cost of getting a breach or an investigation wrong has risen sharply. Fines are fewer but far larger. The Data (Use and Access) Act 2025 also gives the ICO power to require individuals to attend interviews and answer questions. Anyone present when an incident was assessed can now be asked what happened, including after they have left the organisation.
The practical lesson is a simple one. The organisations that fare best are those that assess honestly, record what they did at the time and report early. We help you do exactly that, and we stay alongside you if the regulator comes to call. We have done it before, through investigations lasting years, and we have counsel on hand when it matters.
“Every person present when an incident is assessed is now a potential witness. The true account is the only one that holds.”
What we deliver
- Rapid breach triage and the Article 33 reporting decision
- Notifications to the ICO and to affected individuals
- Management of ICO investigations, correspondence and information notices
- Preparing staff for interviews
- Direct access to counsel through Licensed Access
- Representations on proposed enforcement action
- Remediation and lessons learned, so the same thing does not happen twice