Despite years of data protection law and awareness campaigns, organisations still ask people to send highly sensitive documents via insecure email. This post challenges that norm, shares personal experiences, and empowers consumers with a practical checklist and their rights under UK GDPR.