Data Protection Solicitors

Data protection impact assessments

A data protection impact assessment (DPIA) is a process to help you identify and minimise the data protection risks of a specific project. This process must be carried out if an activity is likely to result in a high risk to individuals and their data - but it's good practice to do a DPIA for any project that involves the processing of personal data because it demonstrates accountability and increases the awareness of data protection issues within your organisation.

A DPIA should describe the nature, scope, context and purposes of the processing, as well as identifying measures to mitigate risks. An effective DPIA allows you to identify and fix problems at an early stage, bringing broader benefits for both individuals and your organisation.

We can assist in advising on when you may need a DPIA, and what issues you should consider when producing one.

Data sharing agreements

Whilst not mandatory, we encourage our clients to use data sharing agreements. These arrangements implemented between two controllers describe the purpose of the data sharing and explicitly set out what happens to the data at each stage.

Having a data sharing agreement in place helps you and your business demonstrate that you are mindful of the importance of protecting personal data. It's a way to help all parties involved understand their roles in the sharing of data - and the expected standards.

Data processing agreements

A data processing agreement, or a DPA, is an agreement between a data controller, such as a company, and a data processor, such as a third party service provider. Whenever a controller uses a processor, there must be a written contract in place. Similarly, if a processor uses another organisation (a sub-processor) to help it process personal data for a controller, it needs to have a written contract in place with that sub-processor.

Such contracts ensure that both parties understand their obligations, responsibilities and liabilities. The data protection laws set out mandatory clauses to be included in data processing agreements.

Policy documentation

We can provide invaluable guidance in either evaluating existing data protection policy documentation or drafting new documentation from scratch.

We can help with data protection policies, privacy notices, data retention policies and data breach policies, whether for processing third party client data, or processing employee or worker data.

Data breaches

A data breach occurs when a breach of security leads to the destruction, loss, alteration or unauthorised disclosure of, or access to, personal data. For example, this could include personal data being accessed by an unauthorised third party, data being sent to the wrong person or computers containing personal data being stolen.

Data breaches can lead to not only severe financial penalties, but also significant reputational damage.

When a data breach occurs, you are obliged to notify the ICO of a breach if it is likely to result in a risk to the rights and freedoms of individuals.

We can support and guide businesses through their reporting obligations, dealing with a data breach and taking preventative action to avoid repeated data breaches.

Subject access requests

Individuals have the right to access and receive a copy of their personal data, and other supplementary information. This is known as a subject access request. The request can be made either verbally or in writing and requests are increasingly being made when a dispute has already arisen.

We can advise on how to comply with a Data Subject Access Request, what data falls within the scope of the request, the scope of any search, how best to supply the data and advice on redaction. We can also assist with correspondence to the Data Subject about how the request has been complied with.