23/10/2026
Let’s face it. Mention GDPR at a meeting and you’re unlikely to see everyone suddenly sit forward with excitement. But perhaps data protection has a reputation it doesn’t entirely deserve.
Data protection has an image problem.
For many people, the words ‘data protection’ conjure up images of endless policies, complicated privacy notices, mandatory training modules and someone from compliance telling them they can’t do something.
And let’s be fair, we haven’t always helped ourselves.
We’ve created a world of acronyms, lengthy documents and terminology that can make a relatively straightforward concept sound unnecessarily complicated.
DPIAs. ROPAs. DSARs. LIAs.
It’s hardly the stuff of thrilling conversation at a dinner party.
But here’s the thing.
Data protection isn’t actually boring. We’ve just become rather good at making it sound that way.
It’s About People, Not Paperwork
Strip away the legislation, the policies and the compliance checklists, and data protection is fundamentally about people.
It’s about ensuring that someone’s medical information doesn’t end up in the wrong hands.
It’s about protecting an employee’s personal circumstances from becoming office gossip.
It’s about making sure a customer can trust an organisation with their information.
And it’s about recognising that behind every spreadsheet, database and case file is a real person.
When you look at it that way, data protection becomes considerably more interesting.
Because it’s not really about protecting data.
It’s about protecting people from the consequences of what happens to their data.
The Most Interesting Problems Rarely Have Simple Answers
One of the things I find fascinating about working in data protection is that the answer isn’t always a straightforward yes or no.
Can an employer monitor employees’ emails?
Can an organisation use artificial intelligence to process customer information?
Should someone be entitled to see everything written about them?
When does sharing information become an invasion of privacy?
The answer is frequently: it depends.
And I appreciate that this is possibly the most frustrating answer a data protection professional can give!
But these questions involve balancing competing rights, legitimate interests, expectations of privacy and sometimes difficult ethical considerations.
They’re not simply administrative exercises.
They require judgement, proportionality and an understanding of human behaviour.
That, to me, is anything but boring.
Perhaps We Need to Stop Being the Department of ‘No’
Data protection and indeed legal professionals sometimes have a reputation for being the people who prevent things from happening.
Want to introduce a new system? Speak to the DPO.
Want to use AI? Speak to the DPO.
Want to share information with another organisation? Better check with the DPO.
Can we sign this contract? Best check the T&Cs first.
And somewhere along the way, data protection becomes perceived as an obstacle rather than an enabler.
But good data protection advice shouldn’t simply explain why something can’t happen.
It should help organisations understand how something can happen lawfully, fairly and safely.
Sometimes the answer genuinely is no.
But often, it’s about finding a proportionate solution that achieves the organisation’s objectives while protecting individuals.
That’s where data protection professionals can add real value.
Making Data Protection Interesting Is Our Responsibility Too
If we want people to take data protection seriously, we need to make it relevant to their everyday work.
A 40-page policy might satisfy a documentation requirement, but it doesn’t necessarily change behaviour.
Real examples, practical advice and conversations about situations employees actually encounter are far more likely to make an impression.
Rather than simply telling someone to comply with the data minimisation principle, explain why they shouldn’t send an entire customer database when only three records are needed.
Rather than reciting the requirements of Article 32, explain what could happen if a confidential document is emailed to the wrong recipient.
And rather than treating every question as a potential compliance failure, encourage people to ask before something goes wrong.
After all, an organisation where employees feel comfortable raising concerns is likely to be in a much stronger position than one where everyone is afraid of getting GDPR wrong.
So, Is Data Protection Actually Boring?
Well, I won’t pretend that reviewing a Record of Processing Activities is everyone’s idea of a thrilling Friday afternoon.
And yes, some aspects of compliance are inevitably administrative.
But data protection sits at the intersection of law, technology, ethics, human behaviour and organisational decision-making.
It touches almost everything we do.
From artificial intelligence and workplace surveillance to children’s privacy and the information we share online, some of the most important questions facing society today are fundamentally data protection questions.
Perhaps the problem isn’t that data protection is boring.
Perhaps we just need to get better at telling its story.
And if we can do that, maybe the next time someone mentions GDPR in a meeting, we might even get a few people to look interested.
Well, we can dream.
Making Data Protection Practical
At JH Data Protection Ltd, we believe data protection advice should be clear, practical and proportionate.
Whether you need support with compliance, policies, training or a particularly tricky data protection question, we aim to make the complicated understandable.
And hopefully, a little less boring.
Get in touch: dpo@jhdataprotection.com
Leave a Reply