At MSR Solicitors, we recognise the critical importance of data protection in today’s digital age.
Data protection law governs how personal data is collected, processed, stored and shared. We advise businesses and organisations on compliance with UK GDPR and the Data Protection Act 2018.
At MSR Solicitors, we are regularly instructed on data protection matters where clients require practical, cost-effective advice on compliance, documentation and risk management. We understand that data protection is not merely a regulatory burden but a commercial and reputational issue that requires careful attention.
Our work includes advising on data protection compliance, drafting data processing agreements, conducting data protection impact assessments, advising on data breaches and representing clients in disputes with regulators and data subjects.
We take a risk-based approach, focusing on the areas of highest risk and ensuring that clients’ resources are directed towards meaningful compliance rather than box-ticking.
Legislative framework
The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 set out the obligations of organisations that process personal data. Compliance is mandatory, and failure to comply can result in significant fines, regulatory enforcement and reputational damage.
The legislation requires organisations to process personal data lawfully, fairly and transparently, and to implement appropriate technical and organisational measures to protect it. Controllers must also respect the rights of data subjects, including rights of access, rectification, erasure and portability.
For certain types of processing, organisations must register with the Information Commissioner’s Office as data controllers. We advise clients on their registration obligations and assist with the registration process.
Key case law
The decision in Vidal-Hall v Google Inc [2015] was a landmark in UK data protection law. The case established that individuals can claim damages for distress caused by the misuse of their personal data, even in the absence of financial loss. It also confirmed that browser-generated information can constitute personal data under the Data Protection Act.
This authority has significant implications for businesses that process personal data online, and we advise clients on the steps necessary to ensure compliance and minimise exposure to claims.
Data processing agreements and compliance documentation
We draft data processing agreements that comply with UK GDPR requirements and reflect the commercial relationship between controllers and processors. These agreements must include mandatory provisions relating to the scope of processing, security measures, sub-processing, data subject rights and breach notification.
We also advise on and draft privacy notices, data retention policies, data sharing agreements, consent mechanisms and internal policies and procedures.
Data protection impact assessments
Where processing is likely to result in high risk to individuals, UK GDPR requires a data protection impact assessment (DPIA). We assist clients in conducting DPIAs, assessing risks and implementing mitigation measures.
Data breaches and enforcement
In the event of a data breach, we advise on notification obligations, remedial action and communication with the Information Commissioner’s Office and affected data subjects. We also represent clients in regulatory investigations and enforcement proceedings.
Why MSR Solicitors
Clients instruct MSR Solicitors because we provide pragmatic, business-focused advice on data protection compliance. We understand that clients need clear guidance on what is required, what is recommended and what can be deferred, and we tailor our advice accordingly.
Case experience
We recently advised a healthcare provider on data processing arrangements with third-party IT suppliers, drafting compliant data processing agreements and advising on cross-border data transfers. In another matter, we assisted an e-commerce business in formulating a strategic data protection policy, advising on ICO rules and coordinating with the client’s technical advisers.
FAQs
Do I need to register with the ICO?
Most organisations that process personal data must register, but exemptions apply in limited circumstances.
What is the difference between a controller and a processor?
A controller determines the purposes and means of processing; a processor processes data on behalf of the controller.
What should I do if there is a data breach?
Assess the risk, contain the breach, notify the ICO if required and inform affected individuals where appropriate.
Typical process
- Initial consultation to assess the nature and scope of data processing.
- Advice on compliance obligations and any gaps in current practices.
- Drafting of data processing agreements, privacy notices and policies.
- Implementation support and staff training where required.
- Ongoing advisory support on compliance, breaches and regulatory matters.
Contact our commercial team today for a free, no-obligation discussion.
