GDPR isn't going away — is your IT actually compliant?

Hand on heart — when did you last look at your GDPR setup? If the honest answer is "when we had to in 2018," you're not alone. Most businesses did the work, ticked the box, and quietly moved on. Understandable. It felt like a one-off project at the time. The problem is, GDPR was never a project. It's a framework — one that expects your data practices to stay current as your business changes. And chances are, a lot has changed since 2018.

What IT-related drift actually looks like

Most compliance slip happens gradually and quietly. Here's what we most commonly find:

• Data you didn't know you had. Shared folders that grew unchecked, no retention policy, no access controls — just personal data sitting there.
• Leavers who still have access. Ex-employees whose accounts were never fully offboarded. Not malicious, just forgotten — but still a live risk.
• Unencrypted devices. Laptops or phones holding customer data with no encryption. If one goes missing, you're likely looking at a reportable breach.
• Unapproved cloud apps. Staff using free tools — AI assistants, file-sharing apps, project trackers — that are storing business data outside any agreed system.
• No data retention in practice. Most businesses have personal data going back years with no plan to review or delete it.
• 
  

The 72-hour rule is the one that catches people out

If you have a personal data breach, you have 72 hours to report it to the ICO. That clock starts the moment you become aware of it. Most businesses only discover they're not ready for this when something actually goes wrong — a stolen laptop, a phishing email, a disgruntled ex-employee.

Having your IT in good shape beforehand means you can respond quickly and confidently instead of scrambling to understand what data was involved and what your obligations are.

What "good" actually looks like

• You know where your data is — and have a register that's kept up to date
• Access controls reflect real job roles — people can reach what they need, nothing more
• All devices and storage are encrypted where personal data is involved
• Leavers are removed quickly and completely as standard process
• Data retention is actually applied, not just written down somewhere
• Everyone knows what to do if something goes wrong

None of that is rocket science — but it does require someone to own it and revisit it as your business evolves.

The honest truth

Most businesses aren't wilfully ignoring GDPR — they're just busy, and it's easy for compliance to slide down the list when nothing's obviously broken. The trouble is, you often don't know there's a problem until a breach, a complaint, or a Subject Access Request makes it visible. A bit of proactive work now is a whole lot easier than a reactive scramble later.

Contact AnyIT

AnyIT is a managed IT service provider based in Needham Market, Suffolk, trading since 2005. Call 01449 798088, email info@anyit.com or use our contact page.

Managed IT support is £85 per seat per month with a £400 monthly minimum. We support 200+ Suffolk businesses since 2005, deliver 99.9% uptime and commit to a 30-minute first response for major incidents with 24/7 monitoring.