Frequently asked questions

Because the person you speak to is the person who does the work. Verity Privacy is a boutique consultancy run by me, Jana Beguna, a lawyer and CIPP/E certified privacy professional, so your questions go straight to me, from the first call to the final deliverable. That suits businesses that want advice built around how they actually handle data, rather than a standard package. You get one consistent contact who learns your business and remembers it, and you pay for expert time rather than for a large firm’s overheads. The trade-off is that one person has limited capacity, so I take on a limited number of clients at a time, and if a project needs a large multi-country team, I’ll tell you that at the start instead of overpromising.

Get in touch and tell me what’s going on: a client asking for proof of GDPR compliance, a new website, a missing DPO, a policy to write. After a short conversation, I assess the project and send you an estimated timeline and price before any work begins. You work directly with me from the first call to the final deliverable, whether that means acting as your DPO, drafting documents, reviewing your site or training your team.

Yes. There is no minimum company size: if you handle personal data of customers, employees or website visitors, it applies. What changes with size is how much effort is proportionate. A small business does need the basics: an accurate privacy notice, a lawful reason for what you do, secure handling, a way to deal with requests and breaches, and agreements with suppliers who process data for you. Getting those right is usually quicker than people expect.

Sometimes the law requires it, and sometimes it’s simply a smart move. Under both the EU GDPR and UK GDPR, a DPO is mandatory for public authorities, and for organisations whose core activities involve large-scale, regular monitoring of people or large-scale processing of sensitive data (such as health data). If that isn’t you, a DPO can still be worth having: a DPO advises you on your obligations, monitors compliance, advises on DPIAs, and acts as the contact point for regulators and individuals. It also avoids the conflict of interest that arises when the role goes to someone who already decides how data is used, like your head of IT or marketing. The DPO advises, while responsibility for compliance stays with your organisation. The exact scope is agreed with you upfront.

A Data Protection Impact Assessment is a structured check you carry out before starting processing that is likely to create a high risk for people. It describes what you plan to do, why it’s necessary, what could go wrong for individuals, and how you’ll reduce those risks. It’s a legal requirement in certain cases, such as large-scale use of sensitive data, systematic monitoring or new technologies, and data about children or other vulnerable groups raises the stakes further. Beyond the legal duty, a DPIA catches problems while they’re still cheap to fix, and it’s the document a regulator will ask to see. I can draft one with you or review one you already have.

Yes, and not only on data protection. I deliver GDPR awareness training and information security training covering everyday risks: phishing, passwords, safe handling of devices and files, and how to report an incident. Sessions are adapted to the people in the room, so HR, customer support, marketing and developers each get what matters for their work. Many data incidents start with an ordinary mistake rather than a technical attack, which is why training pays off.

I look at what your website actually does, not just what its policy says. That means checking which cookies and trackers load and when, whether the consent banner really works, what your forms collect and where that data goes, which third-party tools (analytics, ads, chat, payments) receive personal data, and whether your privacy notice matches reality. You get a prioritised list of findings and clear fixes, so you know what to change first. Software and mobile apps can be reviewed the same way.

If your site uses anything beyond strictly necessary cookies or similar technologies, such as analytics or marketing tags, you generally need consent before they run. A compliant banner doesn’t set non-essential cookies before the visitor chooses, makes rejection as easy as accepting, has no pre-ticked boxes, explains what each category does, and lets people change their mind later. A banner that looks right but still fires trackers on page load is one of the most common problems in website reviews.

If you collect personal data in any form (contact forms, orders, newsletter sign-ups, analytics), you must tell people who you are, what you collect and why, on what legal basis, who you share it with, whether it leaves the UK or EEA, how long you keep it, what their rights are and how to complain. A copied template rarely matches what your business really does, and a policy that says something different from your actual practice can be worse than none. I write policies around your real data flows, together with the cookie policy and banner settings.

Possibly. They’re very similar in substance, but they are separate laws with separate regulators. The UK GDPR applies if you’re established in the UK or offer goods and services to people in the UK or monitor their behaviour. The EU GDPR applies the same logic for the EU. If you serve customers in both, you may need to meet both, and some details differ, such as international transfer tools and which authority you answer to. I work with both regimes, so you get one consistent approach instead of two separate projects.