One question, one page.
Short, direct answers to the questions small UK firms actually ask about client documents, data protection and admin. The answer is in the first sentence.
- "Nothing has moved" is still an update
Clients cannot tell quiet progress from no progress, so they assume the worse one. Acknowledge the same day, then update on a fixed rhythm — even when nothing has changed.
1 Oct 2026 - Nobody can read your sent items.
Two people chase the same client because the only record of the first request sits in one mailbox. The fix is a record on the client's file, not another stand-up.
29 Sept 2026 - Name the three that landed, ask for the four that didn't
A half-finished request is the strongest signal of cooperation you will get. The reminder that restates the whole list is what ends it.
27 Sept 2026 - Your Zap holds the passport scan for up to 69 days
Zapier's data privacy page puts processing on AWS in the United States and retains Zap content for 29–69 days. Here is how to find which of your automations carry an ID document.
24 Sept 2026 - Is losing access to our own files actually a data breach?
Yes. The UK GDPR definition covers destruction, loss and alteration, not just disclosure — so a ransomware lockout counts even if nothing left the building.
14 Sept 2026 - A client asks you to delete everything. Usually you cannot, and that is allowed
The right to erasure is not absolute, but a refusal only holds up if you can name the legal obligation you are relying on.
13 Sept 2026 - Your subcontractors are in scope from 1 October — but only the new ones
From 1 October 2026 right to work checks extend to workers, individual subcontractors and online matching services, but only for engagements starting on or after that date.
10 Sept 2026 - n8n bills the run. Make bills every module.
The three automation platforms charge by different units — tasks, credits and executions — and a long document workflow prices out very differently on each.
3 Sept 2026 - Separately in time is not separately in channel
The ICO's encryption guidance asks that the decryption key travel over a separate channel — a password sent in the follow-up email fails that test.
30 Aug 2026 - The portal isn't the problem. The password is.
Clients abandon portals at the login screen, not the feature list. Two named UK firms say so on the record — and there's a ten-minute test.
18 Aug 2026 - Onboarding takes eight emails because nobody wrote the list down
The back-and-forth is a preparation failure, not a client failure. Decide the whole list once, give every item a format and a deadline, and send it in one pass.
14 Aug 2026 - Can I just BCC my client list?
No — the ICO says BCC is not enough on its own to protect personal information, and BCC mistakes have been a top-ten breach category since 2019.
10 Aug 2026