Privacy
Last updated 11 August 2026.
Who is responsible
P.K. Sharma is the data controller for this site, operating as an independent consultant from Cambridge, United Kingdom. For anything in this notice, including a request to see or delete your data, the address is contact@pk-sharma.com.
What is collected, and why
Personal data is collected in exactly three places. Nothing is gathered in the background, and there is no data collected from you anywhere else on this site.
| Where | What | Lawful basis |
|---|---|---|
| Newsletter signup | Email address, and the date you consented | Consent. You may withdraw it at any time and every email carries a one-click unsubscribe link. |
| Contact enquiry | Email address, name, company if you give one, and what you wrote | Legitimate interests: replying to somebody who has deliberately written to ask a question, which is the reason the form exists. |
| Template download | Email address, and which template you asked for | Consent, given when you submit the form to receive the file. |
What is done with it
Newsletter addresses receive the briefing, which is analysis of cyber security and AI governance news, roughly weekly and never more often. Enquiry details are used to reply to the enquiry. A template download gives you the file and, because the same form records consent, may also receive the briefing.
Nothing is sold, and nothing is shared with a third party for their own marketing. There is no advertising network, no data broker and no enrichment service anywhere in this.
How long it is kept
- Subscribers: until you unsubscribe. The record of the unsubscribe itself is kept, because the only way to be sure you are not emailed again is to remember that you asked not to be.
- Enquiries: twenty-four months from the last exchange, then deleted. An enquiry that becomes an engagement is kept for as long as the professional and tax obligations of that engagement require, which is six years.
- Template downloads: twenty-four months, on the same footing as an enquiry.
Cookies, and why there is no banner
This site sets no cookies on the pages you are reading. Not fewer than most sites: none. There is no tag manager, no advertising pixel and no third-party script anywhere on the public site, so there is nothing to ask permission for and no banner to dismiss.
There is page analytics, and it is worth being exact about what that means here, because the usual version of this sentence is written to reassure rather than to inform.
Page views are counted first party. The request goes to this domain and to no other, so no third party receives anything and no external script runs in your browser. It sets no cookie and stores no identifier on your device, which is why the paragraph above is still true and why no consent banner is required. It does not follow you between sites, because there is nothing to follow you with. What it produces is a count of how often a page was read.
The free tools are excluded outright. Those pages carry a header that forbids the browser from making any outbound request at all, which is the mechanism behind the promise that nothing you type into them leaves your machine. Nothing is counted there, and nothing could be.
Two things do store something on your device, and each is covered by the exemption in the Privacy and Electronic Communications Regulations for storage that is strictly necessary to provide a service you asked for. That exemption removes the need for consent. It does not remove the need to tell you, which is the purpose of this section.
- A session cookie in the editorial area. Set only when a member of staff signs in at
/admin, and only for that person. Signing in is not possible without it. If you are reading the public site it is never set. - Local storage in two of the free tools. The ISO 42001 readiness assessment and the Annex A browser keep your answers in your own browser so that a half-finished assessment survives a refresh. Nothing is transmitted; the data stays on your machine and clearing your browser storage removes it.
A Google Calendar booking embed used to sit on the contact page, and was removed on 10 August 2026. It loaded only when pressed, but the contact page is now the form alone and Google is not involved in it at any point.
Your rights
Under the UK GDPR you may ask for a copy of the personal data held about you, ask for it to be corrected or deleted, ask for its use to be restricted, object to processing carried out on the basis of legitimate interests, and ask for it in a portable form. Where processing rests on consent, you may withdraw that consent at any time, and doing so does not affect anything done before you withdrew it.
Write to contact@pk-sharma.com and you will get an answer within one month, which is the statutory limit rather than a target. There is no charge.
Complaints
If you are not satisfied with the response, you have the right to complain to the Information Commissioner’s Office, which regulates data protection in the United Kingdom. The ICO can be reached at ico.org.uk/make-a-complaint or on 0303 123 1113. Raising it here first is welcome but is not a condition of complaining to them.
Changes
This notice carries the date it was last changed, at the top. Where a change affects what happens to data already held, subscribers are told by email rather than left to notice a new date.