Vulnerable people can come in different forms – a person can be vulnerable because they have cognitive or learning issues, or they may be vulnerable because they are at risk of or are experiencing abuse. The UK GDPR and the Data Protection Act 2018, especially after the amendments in the Data (Use and Access) Act 2025 take effect, contain a number of measures to protect vulnerable people and process data for safeguarding purposes, and it’s important to understand them. After that, I have controversial opinions about what happens when someone makes a subject access request on behalf of someone else.

This is a short, simple session setting out the main provisions that apply to vulnerable people.