Data Protection

UK GDPR is the data protection framework that applies to organisations in the UK. It applies to any organisation that processes personal data, that is, any information relating to an identified or identifiable living individual.

If your business holds personal data about customers, employees, suppliers or anyone else, UK GDPR applies to you. We can advise you on what your specific obligations are and help you put the right processes in place.

A data protection policy sets out how your business collects, uses, stores and protects personal data, and what staff are expected to do when handling it. It should cover your lawful basis for processing, how long you retain data, individuals’ rights and how to respond to requests and incidents.

We draft policies tailored to your business, alongside a privacy notice for individuals to read when you collect their data.

A subject access request (SAR) is a request from an individual asking for a copy of the personal data your business holds about them. You generally have one month to respond. The rules about what to include and what you can withhold can be complex, and getting it wrong can lead to a regulatory complaint. We support you through SAR responses and handle the process on your behalf when needed.

Act quickly. If the breach is likely to result in a risk to individuals’ rights and freedoms, you may be required to notify the Information Commissioner’s Office within 72 hours. You may also need to notify the individuals affected.

We guide you on whether reporting is required, what to report, and how to manage the situation to minimise the risk of regulatory action and reputational damage.

Yes. We act for businesses responding to complaints raised with the Information Commissioner’s Office, whether by a customer, employee or other individual. We help you understand the basis of the complaint, assess your position and respond appropriately to the ICO’s enquiries.