Data protection
Clear, pragmatic advice to help companies keep pace with a complex and fast-changing regulatory environment.
(02) — Overview
Data protection touches almost every aspect of a business, from how it manages its people to how it develops products and uses technology. We advise businesses across various industries, including healthcare, technology, financial services, and retail.
Our work spans everyday compliance, regulatory investigations, and higher-risk processing activities. We combine local expertise with a strong understanding of EU data protection law and regulatory practice.
We can help with
Data protection compliance rests on a set of documents and measures that define how personal data is handled, allocate responsibilities, and address risks. Our work includes preparing privacy notices, internal policies, records of processing activities, and data processing and joint controllership agreements.
We advise on appropriate technical and organisational security measures and deliver training to the client's workforce. We carry out comprehensive compliance audits that identify gaps, set out a step-by-step remediation plan, and produce the remedial documents where needed.
In the course of their commercial activities, companies regularly process personal data, share it with third parties, and transfer it internationally.
We work alongside clients as they design and build new products, initiatives, and partnerships, or review and adapt existing ones. Our work includes advising on the lawful processing of personal data, structuring relationships with data recipients, and addressing the legal requirements for international data transfers.
Managing a workforce involves processing personal data at every stage, from a candidate's job application to the end of an engagement, whether involving employees, contractors, or other engaged individuals.
We advise employers on data protection matters arising in recruitment, HR administration, disciplinary processes, and termination, as well as the handling of former employees' data. We help clients meet their legal obligations regarding more intrusive forms of data processing, such as workplace monitoring and background checks.
Certain forms of data processing are subject to stricter legal requirements due to their potential impact on individuals. We advise on whether and how clients may lawfully process special categories of data, such as health, biometric, and religious data, as well as criminal conviction and offence data.
We help clients comply with the rules governing video surveillance, AI, and emerging technologies. Where processing is likely to result in high risk, we conduct data protection impact assessments to assess the risk and recommend measures to mitigate it.
Our support in responding to data breaches includes assessing whether a breach is reportable and handling notifications to supervisory authorities and affected individuals within applicable deadlines.
We represent clients in regulatory investigations and proceedings arising from data subject complaints. As external data protection officers or local data protection representatives, we provide ongoing support on data protection matters.
Related practices
Consumer protection
Advertising
E-commerce
Cybersecurity
Digital regulation
