Data Protection & Privacy

Our Data Protection Fact Finder acts as a bit of a mini-audit. (We do the big ones, too – see Audits and gap analysis .) You fill in the Fact Finder, answering questions about what personal data you are collecting, where it comes from, what you are doing with it and what measures you have in place to manage it appropriately.

The Fact Finder gets you thinking, and helps us to identify where you need to focus your time and resources. Many clients then ask us to produce a report to set out the key outcomes. That creates a focussed list of actions to drive your data protection compliance programme – whether it’s updated policies and procedures , tailored training or training courses , agreements or specific tricky data protection questions .

Case Study

We can perform a data protection compliance audit or gap analysis of your organisation’s data-processing activities. Whether you want your audit to focus on one or two central business functions, extend across the entire organisation or sit somewhere in between, we can help you.

We can tailor our audit approach to suit your time and budget.

Our typical approach involves two stages:

1. Information gathering . We gather information by using tailored audit questionnaires, interviewing staff and reviewing current policies and procedures . Some clients ask us to carry out the interviews ourselves, which provides more independent scrutiny. Others, however, rely on their internal teams to complete the questionnaires and follow up with questions internally. The path that clients choose often comes down to time and budget.


2. Reporting . After the information-gathering phase is complete, we analyse the material and then compile our report. Here, we set out your organisation’s compliance levels and recommend practical next steps to address areas of risk and best practice.

Often, audits identify that further work is required on an organisation’s compliance programme - rolling out training , drafting or upgrading policies and procedures , and getting contracts in place . We can help here, too, customising our input to suit you.

Case Study

The GDPR is very clear that organisations have a core obligation to show how they are complying with the legislation – this is called the accountability principle. Organisations acting as controllers have this obligation directly, but any processor who wants to do business in the age of data protection will need to be able to show its customer how it will support its data protection compliance.

We can help you with your organisation’s compliance programme at whatever level you choose – it’s up to you. It may be that you know where your gaps are or a data protection audit has identified areas to focus on. Alternatively, you may simply need to make a fresh start.

We tend to find it helpful to collaborate with you to focus on what matters most to you. We often do this by following our Data Protection Fact Finder , or performing a detailed data protection audit. Our expert lawyers can draft new data protection policies, procedures and guidelines – or rework existing ones – to give you a compliance programme that is fit for purpose.

Of course, you’ll know that compiling a compliance programme isn’t a one-hit wonder; it needs regular review to ensure that it keeps pace with the dynamic nature of data protection regulations and guidance, and that it is working well in practice. Should you need it, we can help with these reviews.

The regulator is also very keen to see how you can demonstrate an understanding of your data protection compliance in practice – we can help you to plug any gaps in staff knowledge by offering in-house training tailored to your needs.

Case Study

Whether you’re a microenterprise, corporate giant, charity or public body, policies and procedures are a critical part of your business operations. They also play a crucial role in how organisations can demonstrate their accountability, a key element of the data protection legislation.

We can help by drafting bespoke data protection policies and procedures for you – or simply reviewing your existing ones in light of the changes to the law and guidance. Either way, we ensure that you end up with a suite of workable policies and procedures that reflect best practice and are tailored to your company’s requirements.

We have helped our clients with a huge range of policies and procedures. Some are aimed at individuals, such as privacy notices for websites, or for recruits or staff. Others are focussed on how you operate internally, such as your overall privacy framework, handling DSARs and other individual rights requests , managing personal data breaches , conducting DPIAs or appointing data processors . Click here to see the full range of policies, procedures and guidelines that we can help with.

If you need an extra pair of hands with getting your staff up to speed on the new documentation, we can help with that, too. We have bags of experience in delivering data protection training , which we can design around your current policies and procedures.

Case Study

So, the worst has happened … or at least, you think it might have. There’s been a data security breach and you need to act fast. Even if you already have some data security procedures in place (although if you don’t, we can help with that, too), you might need some extra help. And who better to ask than some calm, expert lawyers whose flexible working pattern means that they can respond quickly?

We can support you through the entire process . We can provide advice on your initial response internally, help you to assess and mitigate any risks, and assist with drafting any data breach reports to the ICO and other regulatory bodies. We can also help you to respond to any regulatory investigations that follow and minimise the risk of enforcement action.

Alternatively, you might not have experienced a data security breach yet, but you’re keen to future-proof your organisation . We have the know-how to help you draft data security procedures for breaches large and small.

Case Study

Organisations must carry out comprehensive data-mapping and ensure that they understand where personal data is collected from, or shared with, those outside the organisation.

One of the outcomes of the GDPR has been an increased focus by data controllers on the arrangements in place with their processors or suppliers, and where they are sharing data with other controllers. Reviewing these arrangements is a critical business requirement.

Are you a data processor faced with reviewing and understanding the specific risks raised by these varying, non-standard terms? Many suppliers are facing a barrage of client demands to sign up to their clients’ data-processing/data-sharing agreements. You’ll want to balance your desire to bring new clients on board smoothly with your need to manage the risk involved.

Alternatively, maybe you’re a controller reviewing your current arrangements for processing/sharing data and trying to ensure that they meet the GDPR requirements.

Either way, we have considerable experience with these types of agreements. We can help you to review yours – or create them from scratch if necessary – and achieve GDPR-compliant agreements that work for your business.

We can also help you to create comprehensive yet efficient tools for completing and maintaining your data protection due diligence records when you are planning to share data with another organisation – or even within your organisation. We often prepare checklists and other recording tools to help with this.

Case Study

From microenterprises to global multinationals and charities, organisations want to connect with potential and existing prospects and shout about their products or services. But who will you contact? How did you get their details? Have they consented to receiving your marketing material? If you can’t show that you have consent, are you sending it under another lawful basis?

If you’re using adtech , AI or machine learning – or other new technologies to reach your customers, or monetise your data – you’ll need to consider which data protection risks are key, and how to mitigate those risks.

We are experts in the field of data protection and direct marketing. We can help you to design marketing strategies and carry out advertising copy clearance to ensure that they comply with both the GDPR and e-privacy legislation such as PECR. We can also advise you on how best to utilise your customer databases without tripping over the hurdles of the complex legislation that governs these activities.

Alternatively, you may simply want a leg up to ensure that your staff know how to create marketing campaigns that comply with data protection law . We can design and deliver marketing-focused data protection training to a brief that we agree together.

Case Study

So, you’ve got a new project coming up and you want to assess the data protection risks involved. Whether you’re performing a DPIA to meet legal requirements, or as a voluntary risk assessment tool, we can help.

Our team of expert lawyers can zero in quickly on whether you have to complete a DPIA, and what it should cover . We can help you to write a DPIA that comprehensively analyses the processing involved and identifies and minimises data protection risks. We can also advise on consulting with the ICO if necessary.

Of course, DPIAs need to be reviewed regularly as a project’s nature, scope, context, purpose or level of risk changes. We can help with that, too.

Case Study

Are you a UK-based business that is subject to the GDPR and exploring how to transfer personal data to or from other countries? Maybe you’re a business operating outside the UK, and planning to engage with UK customers. Or perhaps you’re considering a new cloud IT service provider that will store or process your data outside the UK.

For these and many other scenarios, our specialist lawyers can assess where your business stands in terms of international data transfers . We have considerable expertise in advising on how to achieve compliant international data transfers by using a range of tools. These include standard contractual clauses, binding corporate rules, consent-based transfers, adequacy self-assessment and more.

Case Study

To comply with the GDPR, businesses must be transparent about how they collect, store and process personal data about their customers, or staff. It must also explain their data protection rights, including your process for handling data protection complaints. Providing a privacy notice (or you may call it a privacy policy or statement) that reassures customers about how you use their data and keep it secure is a clear route to achieving this aim.

So, whether you’re looking to update your existing privacy policy or create a brand-new one, we can help. First, we can assist you with identifying your processing activities . Then, we can help you to create a privacy notice that communicates this information to your customers and staff in a GDPR-compliant fashion.

Case Study

Managing data subject access requests (DSARs), data protection complaints, and other individual rights requests can be challenging at the best of times. It is even more so in today’s climate of greater data protection awareness, use of AI , tight internal resourcing and the statutory time limits for your response

If you’re receiving complex or high volumes of requests and you don’t have suitable processes in place to manage them and provide appropriate responses, it can quickly put pressure on your organisation’s internal resources. This is increasingly the case where requests are generated or expanded using AI tools, or where individuals submit repeated or wide-ranging requests using template wording.

At the other end of the scale, if you have never received a request or complaint, or very few, it can be difficult to know what a compliant response looks like. Whether the number is large or small, add in the tight statutory timeframe and the fact that you can’t charge a fee (in most cases), and things can get pretty tense and difficult to manage.

We are often asked to step in where organisations are facing repeated, wide-ranging or technically difficult requests, or where they need support in documenting a reasonable and proportionate, and ultimately defensible approach.

Why not let us share the load? We can help you take a practical and proportionate approach. Our extensive data protection law experience means that we can support you in handling requests efficiently, while keeping an eye on risk, scope and regulatory expectations. This may include helping you to assess the scope of the request, seeking appropriate clarifications, and advising on reasonable and proportionate searches, exemptions and defensible response strategies in light of current law and regulatory guidance.

Likewise, if you’ve received a complaint in relation to your data-processing activities, we can help you to respond with confidence .

Then, when the dust has settled, if you need a hand with designing or reviewing your policies and processes on handling individual rights requests or with training your staff on how to respond, we can work with you to put in place a clear and workable approach, for triage, scoping, escalation and record-keeping.

Don’t forget that DSARs are often made exponentially more complex where the organisation has been hoarding data well beyond its use by date. Getting your house in order before the DSAR lands should be treated as a high priority. For example, make sure you understand what data you process and where, which third parties are involved, what your security measures look like, and what your retention policies are. This will all help greatly, alongside ensuring up-to-date privacy notices are in place to help provide supplemental information required alongside the DSARs and other rights requests.

Case Study