Employment
GDPR and Data Protection
The UK data protection regime is built on three core legal instruments:
The UK General Data Protection Regulation (UK GDPR)
The Data Protection Act 2018 (DPA 2018)
The Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426)
What is the UK GDPR?
The General Data Protection Regulation (GDPR), which came into force in 2018, is a comprehensive data privacy and security law that sets out strict requirements for how organisations handle personal data. Employers must ensure that employee data is managed and stored securely to remain compliant. Breaches of the regulation can lead to significant fines or legal proceedings. Following the UKs departure from the EU, the GDPR has been retained in domestic law as the UK GDPR.
How We Can Help
Our experienced data protection solicitors are well-versed in navigating this complex and evolving area of law. We advise clients across a broad range of sectors and organisational sizes.
We offer practical, tailored advice on a wide range of data protection matters, including:
Responding to data subject access requests (DSARs)
Conducting data audits to identify and map personal data held about employees
Drafting and updating privacy notices, employment contracts, and staff handbooks
Reviewing commercial contracts, including data protection clauses, indemnities, and warranties
Advising on the appointment and role of a Data Protection Officer (DPO)
Providing strategic guidance on data security and breach notification obligations
Drafting and reviewing internal data protection policies and procedures
Advising on compliance with UK GDPR obligations and best practices
Case study
Telecommunications: Advised an international telecoms company headquartered in Lagos on its UK GDPR obligations, including intra-group data sharing and compliance across its global workforce.
Financial Services: Supported one of London’s leading independent financial advisory firms in updating staff privacy notices to align with GDPR requirements.
Recruitment: Provided practical advice to a national recruitment agency on the retention and management of candidate data, as well as its internal obligations to employees.