Data Protection Solicitors

We map how personal data flows through your business, identifying where data is collected, stored, accessed, shared and transferred, to assess risk and improve compliance.

We support businesses in responding to DSARs and can draft internal procedures and training materials to ensure efficient and compliant handling.

We draft tailored privacy notices covering employee, customer and online data, ensuring transparency and alignment with your data practices. 

We advise on when DPIAs are required and prepare bespoke assessments for high-risk processing activities. 

We draft and negotiate data sharing and processing agreements, including those involving international transfers, ensuring compliance with UK and EU requirements.

We provide guidance on lawful marketing practices, including consent mechanisms and compliance with PECR.

Many organisations transfer personal data outside the UK, often through cloud-based services or international operations based outside the EU. 

We advise on lawful transfer mechanisms and appropriate safeguards, including Standard Data Protection Clauses, including the ICO’s International Data Transfer Agreement (IDTA) and the International Data Transfer Addendum (the Addendum) 

In the event of a data breach or suspected breach, we provide rapid support to: 

• Investigate and assess risk 
• Contain and manage the incident 
• Prepare reports to the ICO (Information Commissioner’s Office) 
• Manage regulatory engagement and communications 

Client Intro

Our client is an international technology business providing software and systems to customers across multiple jurisdictions, including Australia and New Zealand.

Case Overview

We advised the client on a range of commercial and data protection matters in connection with the rollout of its services in the UK.

This included adapting existing overseas customer terms for use in the UK, preparing data processing documentation, and advising on compliance with UK data protection laws. The work required careful consideration of international data flows between the UK, Australia and New Zealand, particularly given the absence of an adequacy decision for certain transfers.

We also supported the client in establishing its UK presence, including corporate setup and employment documentation, ensuring the business was positioned to operate effectively in a new market.

Working alongside specialist advisers where appropriate, we helped the client implement a compliant and commercially practical framework for its UK operations.

“When supporting international businesses entering the UK market, it’s essential to align legal compliance with how the technology operates in practice. We focused on delivering a framework that achieved both.” – Richard Meehan, Partner

We assisted Reverse Rett with the drafting of App terms and conditions and a Privacy Notice as part of the launch of its new Reverse Rett App aimed at matching clinical trials conducted by the pharmaceutical industry with potential patients. Our instruction consisted of a detailed data protection assessment to cater for the processing and sharing of special category personal data of minors by the App and third-party pharmaceutical companies.

Drafting a suite of documents (including a Data Protection Policy, DPIA, Record of Data Processing Activities, and Data Breach Policy) for a software provider offering banking and peer-to-peer wallet solutions within the international Fintech sector.

We assisted an IT and Tech provider offering social media data collection, harvesting and analysis services with the drafting of, and advising in relation to, their DPIA including  conducting an extensive data mapping exercise.

GDPR Audits for a plethora of our clients prior to the GDPR coming into effect. 

The Information Commissioner’s Office (ICO) has the power to impose significant financial penalties for breaches of UK GDPR and the Data Protection Act 2018. 

The maximum fine is the greater of: 

• £17.5 million (or €20 million), or:
• 4% of a company’s global annual turnover 

In addition to fines, the ICO can take enforcement action such as restricting or suspending data processing activities, which can have serious commercial consequences. 

Our data protection solicitors can advise on responding to ICO investigations, preparing regulatory reports, and protecting your position where enforcement action is threatened. 

A Data Subject Access Request (DSAR) is a request made by an individual to access the personal data your organisation holds about them, along with information about how it is used. 

This may include: 

• Names and contact details 
• IP addresses and online identifiers 
• CCTV footage or images 
• Employee records 
• Customer account or transaction data 

Businesses must respond within strict timeframes and ensure the response is complete and compliant. 

We help organisations manage DSARs efficiently, particularly where requests are complex, high-volume or contentious. 

Under UK GDPR, individuals have a range of rights in relation to their personal data, including: 

• The right to access their data 
• The right to have inaccurate data corrected 
• The right to request erasure (“the right to be forgotten”) 
• The right to restrict or object to processing 
• The right to data portability in certain circumstances 

Organisations must have processes in place to respond to these rights promptly and lawfully.

If your business processes personal data, you are required to provide clear and transparent privacy notices to individuals. 

A compliant privacy notice should include: 

• What data you collect 
• Why you process it and your legal basis 
• How long you retain it 
• Who you share it with 
• The rights available to individuals 

You may need multiple privacy notices depending on your activities, for example: 

• Employee privacy notices 
• Customer privacy notices 
• Website privacy notices 

Well-drafted notices help demonstrate compliance and build trust with your stakeholders.

A website privacy notice explains how your business collects and uses personal data through its website. 

This includes data gathered via: 

• Contact forms 
• Cookies and tracking technologies 
• User accounts or subscriptions 

It ensures compliance with transparency obligations and helps obtain valid consent where required. 

Your privacy notice should be clearly accessible at all points where personal data is collected.

“Big data” refers to extremely large and complex datasets that are generated from multiple sources and processed at high speed. 

It is typically characterised by: 

• Volume – large quantities of data 
• Variety – data from multiple structured and unstructured sources 
• Velocity – rapid processing and analysis 

Where big data includes personal data, it falls within the scope of data protection laws.

Yes, where big data involves personal data, it must comply with UK GDPR and the Data Protection Act 2018. 

Examples include: 

• Health or clinical trial data 
• Location data from mobile devices 
• Consumer behaviour and purchasing data 
• Biometric or wearable technology data 

Organisations must ensure lawful processing, transparency, and appropriate safeguards when using such data.

Businesses using big data must ensure compliance with core data protection principles, including: 

• Processing data fairly, lawfully and transparently 
• Collecting data for specific, legitimate purposes 
• Ensuring data is relevant and not excessive 
• Limiting retention to what is necessary 
• Implementing anonymisation where possible 
• Respecting individuals’ rights 

In many cases, a Data Protection Impact Assessment (DPIA) should be carried out to assess risks. 

Most organisations are required to maintain a Record of Processing Activities (ROPA). 

This record should include: 

• Categories of personal data processed 
• The purpose and legal basis for processing 
• Details of data sharing and transfers 
• Retention periods 
• Security measures in place 

Maintaining accurate records is a key part of demonstrating compliance and is particularly important in the event of a data breach or ICO investigation.