The Room
Monday 19 January 2027, 09:45. Cerulith HQ — Bishopsgate.
The ICO investigation was formally opened on 5 December 2026 under s.146 DPA 2018 (information notice) and Art 58 assessment powers. Triggers: the May 2026 breach, Pulse AI DPIA, cross-border consultation with the Irish DPC, PECR sweep complaints.
Helena Brandt (Senior Investigator, ICO) arrives in thirteen minutes with a junior colleague and a black bound evidence binder labelled Cerulith Health — Evidence Pack — v1.4. The binder contains every decision you made this year.
- Defended a year's DPO decisions under sequential regulator questioning.
- Applied the Art 83(2) factors to your own controller's file and calibrated expected MPN.
- Chosen the right representation strategy at the Notice of Intent stage.
The Arrival
From the reception desk you watch Helena and Hari walk through security. Helena places the binder on the check-in desk and says, "For reference during the session."
Vikram is beside you. Oren is on a Teams tile in your pocket. Marcus is ten minutes out.
You have prepared. You have indexed every DPO-register entry from the last twelve months. You know which decisions you can defend and which you cannot. The rest is cadence.
The Opening
Helena opens the binder. Tab A: SAR-related correspondence. Tab B: May 2026 breach. Tab C: Pulse AI DPIA and Art 36. Tab D: Sift transfer. Tab E: Operation Pulse Back.
"We're going to work through each tab," she says. "My colleague will take notes. I need your cooperation on the facts; you'll have formal representations after the Notice of Intent."
Question: How do you open?
Hot Seat — The SAR File (Tab A)
Helena asks you questions about Module 1's decisions in sequence. Answer from the record.
Hot Seat — The Breach File (Tab B)
Hot Seat — Pulse AI (Tab C)
Framing the Cerulith Clinic AI Risk
Helena closes Tab C. "Before we move on, I want to hear your position on residual risk. The investigation file includes a near-miss clinical report from December 2026. Your view on the safety envelope now."
Question: How do you frame Cerulith Clinic AI to the Investigator?
Hot Seat — Transfers (Tab D)
Exhibit E-1
Helena slides a single sheet across.
Hot Seat — Operation Pulse Back (Tab E)
The Cascade
Helena asks you to sketch how each prior decision contributed to the current exposure. An animated cascade renders each prior choice as a node. Active (red) nodes are poor choices; dormant (green) nodes are good choices that contribute mitigation.
The Meter
Reputation meter snapshot.
Helena announces an hour for the MPN methodology briefing. "At 15:45 I'll share our current thinking on the Notice of Intent. You'll have 28 days to respond. Today's session informs the starting point; your response shapes the final."
The Starting Point
Helena walks through EDPB 04/2022 and the ICO's Regulatory Action Policy.
EDPB 04/2022 — Five-Step Methodology
The Response Posture
You have 28 days to file representations against the Notice of Intent. Three postures.
Question: What is your representation strategy?
Computing Final MPN…
Aggregating this afternoon's decisions with a year's cumulative record. One moment.
The Reprimand
No MPN. Voluntary commitments accepted. Cerulith ends up in the ICO's 2027 annual report as a DPO-led remediation case study.
The Middle MPN
Accepted, not appealed. Remediation visible. Reputation recovers.
The 4% MPN
The higher tier. Board governance intervention. The DPO register is the reason it isn't worse.
Twelve Months Later
What M6 Teaches — and What the Course Teaches
- Art 83(2) factors are eleven. Cooperation, intent, mitigation, category, prior-infringement, responsibility, cross-border. Your year-long decisions populate every factor.
- EDPB 04/2022 fine methodology is five steps. The starting point is a function of turnover + infringement seriousness; the final is a function of how you handled it.
- The ICO's Regulatory Action Policy is published. Read it before you need to.
- The DPO register is not paperwork. It is the evidence that determines whether the fine is £400k or £18M.
- A year of good decisions is a cumulative regulatory mitigator. A year of poor decisions is a cumulative regulatory trap.
- The lesson of this course: the DPO role is not about knowing the regulation. It is about keeping the register.
Course Complete
The flagship GDPR / UK Data Protection course is complete.
M6 score: —
Cumulative course score: —
Final MPN range: —
This result has been recorded in your LMS and is part of your permanent DPO learning record.