A 45-minute, CPD-assessed course on data protection as it actually bites on a fund manager or advisory firm: the onboarding file, the request hidden in an email, the misdirected attachment and the overseas administrator. Updated for the Data (Use and Access) Act 2025, and scheduled, chased and certified for you.
The Act amended the existing law rather than replacing it, and most of its changes came into force on 05-Feb-26. Much published commentary implies a new regime. It is not one.
Not cookie banners and CCTV. A fund manager's real exposure is the investor onboarding file: passports, source of wealth, adverse media, sometimes a medical note, emailed to an administrator overseas.
The law in one box, the roles of the ICO, the FCA and the firm, and what genuinely changed in 2025 and 2026, set apart from the much larger part that did not.
What counts as personal data, why special category and criminal offence information needs a second decision rather than a forward, where it turns up in an onboarding file, and the one behaviour that matters.
The seven principles, and legitimate interests done properly: the purpose, necessity and balancing tests, the new recognised list that sounds commercial and is not, and reusing what you already hold. Includes a filmed scenario.
What individuals can ask for, and recognising a subject access request when it arrives as a sentence in a cross email rather than on a form. What to do, the clock and what February 2026 did to it, and tactical requests. Includes a filmed scenario.
Two duties pulling in opposite directions: data minimisation against money laundering and regulatory record keeping. How they resolve, what it asks of you, and backups.
Why a breach is not only a hack, the misdirected email, the three steps (say so now, say what you know, leave the rest to the firm), what the firm then has to do, and a breach at the administrator rather than at the firm.
Why a fund manager does this every week, the transfer routes in outline, what February 2026 changed, the group assumption, the overseas support desk, and what you do.
Seven pages of law, four habits: email, sharing with third parties, chat, and the copy on the laptop. Followed by the test and the certificate.
Nobody expects staff to run the legal analysis. They need to recognise the moment and pass it to the right person. By the end, a learner can:
Two short films, shot for Fundsure with the same cast across the catalogue. In one, a colleague is sent an article saying the new law settles whether the firm can send a marketing mailing. In the other, an unhappy investor’s email contains a request for their data that never calls itself one. After each, the learner chooses what to do, and is told why the tempting answers are wrong: accepting that the new law settles it, ringing the investor to see whether the request goes away, or asking them to resubmit it as a formal request.
The test at the end draws 10 questions from a bank of 30, with a pass mark of 80%, and a pass issues a named, CPD-marked certificate that anyone can check online.
UK GDPR requires a firm not only to comply but to be able to demonstrate how. The ICO expects staff to be trained to recognise a rights request and to escalate a breach through an internal route they know, and most incidents in a small firm come down to four habits: email, third parties, chat and the copy on the laptop.
In the Fundsure Portal the course is scheduled for everyone each year, chased before the deadline, and every sitting, score and certificate is kept and carried into the compliance officer’s report to the board.
How the portal runs trainingData Protection plus Cybersecurity Awareness, AML and CTF, Conduct Rules and the rest of the catalogue of 20, with no per-course fees.
Phishing, impersonation and what to do after clicking: where most breaches start.
See the courseThe record-keeping rules that pull against data minimisation.
See the courseKeeping important services running when a supplier or system fails.
See the courseRecognising a complaint the moment it is made, not after it is logged.
See the courseWe will send you a link to take the whole course, filmed scenarios and test included, or walk you through the portal with a demonstration firm.
