Data protection is now a board-level legal and operational concern. Organisations should maintain clear records of data collection, consent, processing, retention, breach response and vendor obligations.

This note is for general information only. Specific compliance advice depends on the facts, sector, contractual obligations and applicable regulations.