PRACTICE NOTES
Practical UK GDPR compliance for insolvency office-holders and their legal advisers: lawful bases, controller/processor roles, records, security, data subject rights, special category data, EU transfers and enforcement
What is the UK GDPR?
The Assimilated Regulation (EU) 2016/679, known as the UK GDPR, governs the handling of personal data, aiming both to safeguard individuals and to enable the unhindered flow of such information. Insolvency professionals handle personal data in their roles as partners, employees or consultants within their organisations, and also when acting as appointed office-holders. In each of these roles, they must comply with the UK GDPR. Accordingly, the regulation applies to them in both professional and office-holder capacities alike. This note offers a concise outline of the UK GDPR’s obligations, together with practical points for those working in insolvency. The professionals concerned include insolvency practitioners, legal advisers and other professional advisers (e.g. financial advisers). After IP completion day (at 1 pm (GMT) on 31 December 2020), the General Data Protection Regulation, Regulation (EU) 2016/679 (the EU GDPR), was carried over into domestic UK law as the “UK GDPR”. The UK GDPR is largely based on the EU GDPR and, in general, the terminology and core principles in the UK GDPR mirror those in the EU GDPR, though there are several important, detailed differences between the two frameworks...
Restructuring & Insolvency