Privacy Law and Data Protection
Privacy and data protection have become central to the way modern businesses operate. Every organisation now handles personal information about customers, clients, employees or suppliers, and the expectations placed on businesses are higher than ever. The GDPR and the UK Data Protection Act 2018 require active, ongoing compliance. They are not optional, and they apply to almost every business regardless of size.
Many organisations still rely on outdated policies, informal practices or assumptions that “we’re too small for anyone to notice”. The reality is that the Information Commissioner’s Office (ICO) expects businesses to understand their obligations and to demonstrate that they have taken reasonable steps to protect personal information. When something goes wrong, the consequences can be serious, both legally and commercially.
Common Privacy and Data-Protection Issues Faced by Businesses
- Data breaches and security failures. These may arise from human error, technical faults, lost devices, unauthorised access or the actions of employees. A business may need to assess the seriousness of the incident, decide whether it must be reported to the ICO, notify affected individuals, and take steps to contain the problem. These decisions carry legal consequences and must be made carefully.
- Employee misuse of personal information. This includes accessing data without authority, sharing information improperly, retaining data after employment ends, or using personal information for purposes unrelated to their role. These incidents often arise in the context of disciplinary matters, grievances or internal disputes.
- Subject Access Requests (DSARs). DSARs are increasingly used tactically in employment disputes, commercial disagreements and litigation. Responding properly requires time, care and legal judgment. Businesses must balance transparency with confidentiality, privilege and the protection of third-party information.
- Complaints made to the ICO. Individuals may complain to the ICO about how their data has been handled. The ICO may request information, seek explanations or require remedial action. Businesses often need guidance on how to respond proportionately and lawfully, and how to minimise the risk of enforcement.
- Outdated or non-compliant privacy policies. Many organisations rely on privacy policies that were drafted years ago or copied from competitors. Aside from the copyright issues, a generic policy is unlikely to reflect the organisation’s actual practices or satisfy the ICO. A privacy policy should be tailored, accurate and kept up to date.
- Data-processing agreements and contractual obligations. Businesses frequently share data with suppliers, contractors or partner organisations. These relationships must be governed by appropriate contractual terms. Disputes often arise when one party mishandles data or fails to meet its obligations.
- Retention, deletion and storage of personal information. Organisations must ensure that personal data is kept only for as long as necessary and is stored securely. Many businesses have no clear retention schedule or rely on informal practices that expose them to unnecessary risk.
- CCTV, monitoring and workplace privacy. The use of surveillance, monitoring software, tracking systems and recording devices must be justified, proportionate and properly communicated. These issues often arise in employment disputes and can lead to regulatory complaints if handled incorrectly.
How We Assist Businesses
Most of the work we undertake in this area is for business clients. We provide clear, practical advice on compliance, risk management and breach response. When an incident occurs, the first few hours matter. We help businesses assess the situation, decide what action is required, and respond in a way that protects both legal and commercial interests.
We also assist with drafting and updating privacy policies, data-processing agreements, retention schedules and internal procedures. Our aim is to ensure that the organisation’s documentation is accurate, workable and compliant, rather than theoretical or copied from elsewhere.
Assistance for Individuals
Although our focus is on business clients, we do assist individuals in genuine cases where personal data has been misused and real harm has been caused. Many privacy complaints are minor and do not justify litigation, but where a breach is serious, we can advise on the options available and the remedies that may be sought.
Contact Us
If your business is facing a privacy or data-protection issue, or if you need to ensure that your policies and practices are compliant, we offer clear, senior-level advice and practical support. Please contact us to discuss your situation in confidence.
