![](https://www.cripps.co.uk/wp-content/uploads/2022/09/Data-protection.png)
Data protection
Every business uses personal data, and we’re on hand to help you with UK GDPR and data protection compliance issues.
Our data protection and GDPR solicitors are experienced in helping businesses navigate the complex, ever-changing information security landscape. With record fines being handed out for breaches of data security and individuals becoming more concerned about how their data is handled and protected, it is more important than ever that businesses have a clear and robust approach to data protection and compliance.
How we can help
We have significant experience in assisting businesses with their data protection projects and have been praised for our pragmatic and commercial approach.
Whether you need assistance reviewing the data protection and GDPR compliance process for a new project, responding to a subject access request, negotiating a data processing contract with a service provider or responding to a data security breach, we will provide straight-forward and practical advice which is relevant to your business and your circumstances.
Our team of data protection and GDPR compliance lawyers are experts in new technology, as well as all aspects of data security, and can advise on the following:
- UK GDPR compliance
- Privacy notices
- Responding to data security breaches
- Handling subject access requests and other requests from data subjects
- Data processing agreements
- Data sharing agreements
- Marketing and cookies
- International data transfers
- Data Protection Impact Assessments (DPIA)
- When to appoint a Data Protection Officer (DPO)
- Privacy by design
- Data protection due diligence
Talk to us about
Related services
Related sectors
Key contacts
Our data protection experience
How we made a difference
Related thinking
Frequently asked questions
- The UK General Data Protection Regulation (UK GDPR) - The UK’s retained version of the EU GDPR, with some changes to account for Brexit.
- The Data Protection Act 2018 (DPA) – This (among many other things) includes some specific provisions around the role of the ICO, and sets out requirements for certain processing of special category data.
- The Privacy and Electronic Communications Regulations 2003 (PECR) – This places restrictions on electronic marketing to individuals, and usage of non-essential cookies.
- mitigate the effect of the breach (for instance, remotely wiping a lost device)
- reduce the chance of a breach happening again (consider technical measures and staff training)
- all data breaches should be logged in your internal data breach register
- if you are acting as a processor, you will need to notify any relevant controller clients (look at your contracts to see if there is a specific timescale for this)
- if the breach is likely to post a risk to individuals’ rights and freedoms, you must notify it to the ICO (the UK’s data protection authority) within 72 hours.
- If the breach involves personal data for individuals outside of the UK, consider if you need to notify data protection authorities in other countries. While the threshold (and timescale) for data protection authorities in the EU will be the same, other countries will have their own distinct requirements.
- If the breach is likely to result in a high risk to individual’s rights and freedoms, then you will also need to notify them without undue delay. As well as ensuring any notification includes the information required by data protection law, you will also want to consider what additional information or assistance you can offer.
- The level of instructions given to the party processing the data which determines the degree of independence a processor can exercise
- How closely a party monitors the processing activities
- The expertise of the respective parties
- The impression given to data subjects as to who has control over the processing of their personal data
- whether to collect the personal data in the first place, and the legal basis for doing so
- what and whose personal data to collect
- the purpose the data is to be used for
- whether and who to disclose data to
- how an individual can exercise their rights in relation to the data (or whether an exemption is applicable)
- how long to retain the data for or whether to make non-routine amendments to it.
- Notices. You must supply a privacy notice to anyone whose personal data you hold (subject to some exceptions). It’s worth remembering that employees are data subjects too, and you will need a privacy notice to set out how you use their data. You are likely to need a minimum of two privacy notices (an internal one for personnel, and an external one for everyone else).
- Contracts. If you use a “processor”, data protection law requires you to have a written contract with that processor, which must include details of the processing and some specific obligations on that processor
- International Transfers. If you transfer personal data outside of the EU and UK, you may need to have in place “Standard Contractual Clauses” or an “International Data Transfer Agreement” with the recipient, to ensure an equivalent level of protection for the personal data you are transferring.
- Data Controller Register. You must keep a record of your processing activities (and a general description of your security measures). While this obligation is reduced for organisations with fewer than 250 employees, any size organisation will have to keep at least a partial record. Keeping a full record is a matter of best practice and assists your other compliance activities.
- Data Breach Register. You must document any data breaches you suffer (even if they are not serious), the effects of that breach, and the remedial action you have taken.
- Special Category Data Appropriate Policy Document. The Data Protection Act 2018 requires that, if you process special category data (particularly sensitive types of data which includes health information) in certain circumstances (including for instance monitor sick leave or for other employment related reasons) you will need an appropriate policy document setting out how you comply with data protection principles and your retention and erasure policies regarding that data.
- What territory is the recipient in? Recipients in the EU, or certain territories which the EU and UK have deemed to have adequate data protection (such as the Isle of Man, but not including the USA) don’t need any further compliance measures
- Is there an applicable exemption? For certain occasional transfers, you may be able to rely on an exemption, especially where the transfer is for the benefit of the individual. If you get consent from the individual for the transfer, this also validates the transfer, but bear in mind the individual may withdraw consent at any time for future transfers and the consent must be validly obtained.
- Can I use standard contractual clauses (SCCs)? SCCs are issued and approved by the EU and the ICO (there are different versions depending on whether you want to use only the ICO version, or a combination of the ICO and EU versions). SCCs are templates and should not be changed, but certain information will need to be included. If the SCCs are agreed between you and the recipient, you will also need to review what supplementary measures you may need to put in place as well to ensure the data is protected.
- Verify identity. You must ensure that you are responding to the right person, so take reasonable measures to verify the identity of the requestor, otherwise you’ll be at risk of a data breach
- Consider all the systems you actually need to search. This might include email, document management, archives, CCTV, and access logs. You may want to narrow these down by asking a requestor to specify which systems (from a list you provide) they would like you to search.
- Don’t delay. The timescales for responding to DSARs can be tight, especially where large volumes of data are involved. Acknowledge the request, verify the requestor’s identity, and clarify the scope of the request quickly (and potentially start a search process internally even before these steps are completed)
- Involve relevant people. While handling a DSAR should be led by someone who is familiar with data protection requirements and has a suitable level of responsibility, they may need to involve people from other teams, or support staff, to search the organisation’s records and provide context or help as needed
- Consider applicable exemptions. Certain information may also involve personal data of third parties, or legally privileged information, so you should go through a redaction or removal exercise to check what you are not required to provide.
- Providing the response. Ensure that you also provide the required accompanying information about the personal data (not just copies of documents). You should also ensure that you deliver the response in a secure way and don’t risk a data breach.
- Who is on the list? Data protection law treats electronic marketing to individuals differently from marketing to corporates. Selling a list of individuals’ emails for marketing is unlikely to ever be compliant (unless the individuals have given consent to that buyer sending them marketing). Even if your marketing list is for business purposes, you should consider if sole traders or other individuals might be on the list.
- What type of marketing is being conducted? Data protection law treats marketing to individuals by email, phone or text differently from postal marketing.
- What is the context of the sale? If you are selling the entire business (so the marketing will be for the same business, just operated by someone else) this is more likely to mean a sale and onward usage is compliant.
- Can I justify the sale on the basis of legitimate interests? Unless you have suitable consents in place, it is likely that any sale will have to be on the basis of legitimate interests (and those interests must not be overridden by the interests or rights of the individuals). You should record those interests, and your decision-making in this respect, in a “Legitimate Interests Assessment” for future reference.
- What protection is being given? If you are satisfied that your sale is compliant, you should consider what protection you giving you buyer, and what protection your buyer gives you regarding their use of the list.
Awards and accreditations
Contact us
If you have a question or need advice, please let us know how we can help.