Jurisdiction(s):
United Kingdom

Related legal acts

Key definition

Data protection definition

What does Data protection mean? In legal practice, data protection describes the rules governing how organisations collect, use, share, retain and secure personal data, including employees’ information. In the UK this regime is set by the UK GDPR and the Data Protection Act 2018; in Ireland by the EU GDPR and the Data Protection Act 2018 (Ireland). The label is descriptive; core concepts (personal data, controller, processor, special category data) and obligations are defined in legislation. In employment, the employer is typically the controller and must identify a lawful basis (for example, contract, legal obligation or legitimate interests) and, for special category data,...

EU and UK GDPR for Life Sciences: clinical trials, special category data, research, governance, transfers and sanctions; DUAA 2025–26, EHDS, Data Act and EU AI Act

Published by a LexisNexis Life Sciences expert

Practice notes

General Data protection Regulation (EU GDPR) and UK GDPR

The General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR), became enforceable across the EEA (which then included the UK) on 25 May 2018. Life sciences organisations frequently collect and/or process substantial amounts of personal information, including health-related data, about individuals (or ‘data subjects’) such as patients and Clinical trial participants. As a result, the relevance of the EU GDPR and the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR) (which applies after the UK’s withdrawal from the EU) for life sciences companies cannot be underestimated.

Assimilated law is the term used for retained EU law (REUL) that remains operative after the end of 2023. The reclassification of REUL (and related terminology) as assimilated law marks a change in its status and handling under UK law, in that it is generally to be interpreted according to ordinary domestic legal principles. From 1 January 2024, REUL is ‘assimilated’ into domestic law because it is, in most cases, stripped of EU-derived interpretative effects (for example, the supremacy of EU law, directly effective rights, and general principles previously retained under the European Union (Withdrawal) Act 2018). For further information, see Practice...

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

Cristiana Spontoni

Jones Day

Cristiana Spontoni is internationally recognised as a leader in life sciences, including biotechnology, pharmaceuticals, medical devices, food and cosmetics, as well as in general EU product and industries regulation. She is also actively involved in the shaping and interpretation of EU legislation affecting many different regulated industries and has successfully represented clients in legislative challenges based on EU law. Cristiana frequently coordinates large international assignments and provides comprehensive one-stop-shop solutions for cross-border regulatory issues affecting clients' operations. She has coordinated projects in more than 80 countries worldwide.Cristiana advises clients from the pre-market phase, including clinical trials and pre-market authorisations, to post-market issues, including product liability, marketing/advertising, distribution, and compliance (including sector-specific antibribery and data privacy).Cristiana handles safety and compliance issues for a large variety of clients both in the life sciences and consumer products sectors, including in regards to product...

Justine Naessens

Jones Day

Justine Naessens advises clients on EU and national regulatory matters in the life sciences area, including biotechnology, pharmaceuticals, medical devices, and food and cosmetics.Justine assists companies in the entire lifecycle of products from early development stages to manufacturing, marketing, post-marketing, and pricing and reimbursement issues, as well as in M&A and other corporate transactions. Justine often assists clients in connection with regulatory matters involving the use of digital technologies in the health care sector, such as the classification of software as a medical device, the use of artificial intelligence (AI) in product development, and associated privacy (General Data Protection Regulation [GDPR]) requirements....

Lucie Fournier

Jones Day

Lucie Fournier advises clients on European data protection, privacy, and cybersecurity laws. She works closely with multinational organizations in various industry sectors, including the life sciences and health care sector. Lucie assists biotechnology, pharmaceutical and medical devices’ companies on European data protection laws, including the General Data Protection Regulation (GDPR) and UK GDPR. She regularly advises cutting-edge technology clients on global data protection compliance projects, informed consent forms, data processing agreements, international data transfers, data merging and portability schemes and data protection impact assessments. Lucie also advises life sciences and healthcare clients on data protection and cybersecurity issues in cross-border M&A transactions. ...

Web page updated on 21/05/2026

Popular documents

Using the Judicial College Guidelines to assess general damages in personal injury claims

When evaluating a general damages claim, the practitioner ought initially to refer to the Judicial College Guidelines (JCG)...

Tomlin orders in England and Wales: CPR guidance on drafting, confidentiality, approval, variation, enforcement, limitation, CCA issues, court-specific requirements, sample wording and precedents

This Practice Note This Practice Note reviews mechanisms used in settling litigation. A Tomlin order consists of a consent order paired with a schedule. It operates to stay proceedings on terms that have been agreed. The provisions contained in the schedule may remain confidential. This Practice Note describes the scope of confidentiality attaching to the schedule and sets out how it differs from a standard consent order. Sample wording for a Tomlin order is included, alongside links to precedents, as well as guidance on court approval. It also addresses varying, setting aside and enforcing a Tomlin order, including the considerations the court will take into account when handling applications for each. Further guidance is provided on interpreting and applying the relevant provisions of the CPR; however, some courts and divisions impose very specific requirements for both drafting and approval, and for approaching the schedule and confidentiality issues. Accordingly, you must consider the particular rules and court guide provisions in the forum where your claim is proceeding when drawing up the Tomlin order...

Precedent: Deed of Surrender of Lease with Optional Premium, Settlement and Release, Landlord, Mortgagee and Guarantor Consents, Reimbursement and HM Land Registry Provisions (England and Wales)

Date [ date ] Parties [ name of Landlord ] [ of OR incorporated in England and Wales (company registration number [ number ]) with its registered office at ] [ address ] (Landlord) [ name of Tenant ] [ of OR incorporated in England and Wales (company registration number [ number ]) with its registered office at ] [ address ] (Tenant) [ [ name of Guarantor ] [ of OR incorporated in England and Wales (company registration number [ number ]) with its registered office at ] [ address ] (Guarantor) ] [ [ name of Mortgagee ] [ of OR incorporated in England and Wales (company registration number [ number ]) with its registered office at ] [ address ] (Mortgagee) ] Definitions Within this Deed, the terms below shall be interpreted as follows: [ Annual Rent • the annual sum reserved under the Lease; ] [ Insurance Rent • the Tenant’s share of the Landlord’s costs of insuring the Property (as set out in the Lease); ] Lease • the lease of the Property dated [ date ], entered into between (1) [ the Landlord OR [ name ...

Precedent Statutory Declaration: Standard Wording under the Statutory Declarations Act 1835

I, [ name ], of [ address ], solemnly and sincerely state that: [ Matters to be verified, set out in numbered paragraphs ] I make this solemn statement in good conscience, believing it to be true, and pursuant to the provisions of the Statutory Declarations Act 1835. DECLARED at [ details ] this [ day ] day of [ month and year ] Before me ................................................................................ [ signature of the person before whom the declaration is made ] A [ commissioner for oaths OR [ solicitor OR [ insert other qualification ] ] authorised to administer oaths ]...