Common data protection mistakes (and how to fix them)

Whether you’re just getting started or you’ve been at this a while, the more you learn about data protection and what you should be doing to comply with the law, the more likely you are to notice when things don’t go to plan.

We’re here to help. That’s why we’ve put together some of the most common data protection mistakes that organisations tell us about on a daily basis – and how to fix them. 

If you need more advice, you can get help and support from our dedicated team.

Sending an email to the wrong person

This is easy to do, especially if more than one person in your address book has the same name.

Tools like Autofill predict who you’re emailing when you start typing someone’s name in the ‘To’ field. It’s a quick way to go through your address book. But the few seconds you save by using Autofill could end up costing you a lot more if you send personal data to the wrong person by mistake.

Putting service messages in the same boat as marketing

Service messages aren’t the same as marketing messages. Service messages aim to keep people informed by providing important factual information, such as a warning about the safety of a product. Marketing messages, on the other hand, aim to promote a service, business or organisation.

Generally speaking, you should consider them separately. While you can’t always legally contact people for marketing purposes, you can contact them to tell them things they need to know as part of the service you’re providing, or that would help keep them safe.

Letting your ICO registration expire

If you have or use information about people, also known as processing, you may have to register with the ICO and pay a fee.

Data protection fees are due to be paid every year. If you need to pay – and don’t – you could be fined. Most small organisations will only need to pay £40 or £60 a year.

Opening unfamiliar web links or attachments

Occasionally, you may get emails from people you don’t know, or receive suspicious-looking links and attachments. Sometimes, these can be phishing emails or attempts at other types of cyber crime which can harm your computer and systems.

Keeping things you don’t need, ‘just in case’

The more personal data you hold, the more storage space and security measures you need to keep it safe – which will cost you time, as well as money. For example, it’ll take you longer to deal with a request for information if you need to search through thousands of old documents, rather than a few hundred current ones. In addition, data protection legislation says that personal information shouldn’t be kept for longer than you need it.

Ignoring a subject access request (SAR) because you don’t know what it is, or it wasn’t emailed to you

In data protection law, people have a ‘right of access’ to their own personal information. This means they can request any personal information that you may hold about them, known as a subject access request (SAR).

SARs can be made verbally or in writing. They don’t have to be directed to a specific contact in your organisation, or made using particular language or with reference to data protection legislation. You can’t require people to make a request in writing or ask them to use a specific form. If you receive a verbal request, you can invite people to follow up in writing, only if they want to. Having a written record of a SAR can be helpful for both parties, particularly if they made their request over the phone and you need to clarify a few points. But whether or not you make a written note of their request or they follow up in writing, their verbal request still stands. For example, an employee could ask for their personal information during a disciplinary meeting – this would count as a SAR.