The new Data Protection Act will come into force on 1 September 2023. The effort required for the implementation should not be underestimated. In our first of a series of newsletters, we show how the implementation can be phased in three manageable steps and provide further details on the first of these three steps.