Data Protection
The GDPR imposed far-reaching obligations on organisations not only to comply with data protection principles, but to be able to demonstrate that compliance.
It marks the most substantial reform to data protection law and practice in the EU and UK (following the UK’s exit from the EU) in over two decades, bringing with it severe penalties for non-compliance and a global reach. Importantly, the GDPR applies not just to UK and EU-based businesses, but also to non-UK and non-EU entities that process the personal data of individuals in the UK or EU, making compliance an essential consideration for international businesses engaging with the UK and the EU markets.
The GDPR is just one part of a broader legal framework. Other legislation, such as the Privacy and Electronic Communications Regulations (PECR) and the Data (Use and Access) Act in the UK regulate and update areas such as electronic marketing, cold-calling and the use of cookies and tracking technologies. These rules must be interpreted alongside the GDPR to ensure a comprehensive and compliant approach to data handling and digital operations.
Services we provide include:
- Advising UK and international businesses on data protection compliance in the UK and EU.
- Drafting data protection policies to support compliance and manage risk, including drafting and reviewing privacy policies, cookie policies, data retention policies and data protection policies.
- Advising on international transfers of personal data outside the UK and EU, assessing the sufficiency of current safeguards in place and advising on the necessity of additional safeguards and measures.
- Advising on data sharing initiatives and strategies and the commercial exploitation of data.
- Carrying out Data Protection Impact Assessments for high-risk data protection processing.
- Drafting and advising on GDPR compliant data processing agreements and data sharing agreements.
- Advising on the use of cookies and tracking technologies.
- Preparing data security due diligence questions and advising on data security breaches.
- Managing Data Subject Access Requests.
- Advising on the use of personal data for direct marketing purposes and compliance with marketing rules.
- Advising on the sale and acquisition of personal data as part of a wider corporate or commercial transaction.
