Legal Practice Notes

Cybercrime is a rapidly shifting, continually changing and unpredictable threat to every commercial organisation and it demands firm management. This Practice Note brings together examples of sound practice for generally lowering the likelihood of cybercrime and cyber security breaches. It is written for compliance practitioners rather than cybercrime specialists. It also excludes niche industries such as telecommunications. Responsibility Treat cyber risk, as with any other business hazard, as a top-tier priority for the in-house compliance or legal function and manage it accordingly. It sits within a wider information risk management and crime-prevention framework, and must not be parked with IT alone. A senior individual should assume overarching responsibility to run a risk assessment and, from that, craft and roll out your policies and procedures. They should receive training and have sufficient resources to keep those policies and procedures up to date. All personnel should know who holds this...

While adopting preventative measures clearly makes sense (see Practice Note: Cybercrime prevention), the possibility of cybercrime or a cyber attack can never be entirely eliminated. A robust approach to cybercrime and wider cyber security risks should pair strong technical and organisational defences with a clear plan for responding to, and mitigating, the impact of any attack that does occur. This Practice Note offers practical guidance on assembling the incident management strand of your Cybercrime prevention strategy and your incident management plan. It also outlines breach notification obligations under the General Data Protection Regulation ( UK GDPR), Assimilated Regulation ( EU) 2016/679, where a cybercrime incident amounts to a personal data breach. The Practice Note is aimed at compliance specialists within general commercial organisations and does not address sector-specific...

This Practice Note distils the principal insights from the National Cyber Security Centre ( NCSC) publication Cyber Threat Report: UK Legal Sector, and also draws on data in the Solicitors Regulation Authority ( SRA) Cyber security thematic review ( September 2020) together with the SRA’s Information security and cybercrime risk outlook. Headline facts and figures The cyber threat facing the UK legal sector is substantial, with reported incidents rising sharply over recent years. The financial and reputational fallout for law firms is likewise considerable. Costs can arise from: the incident itself remediation and recovery restoring damaged reputations The SRA’s thematic review noted that three quarters of the firms it visited stated they had been targeted by a cyber attack. Others reported that cyber criminals had directly approached their clients during live legal transactions. Although not every incident resulted in client financial loss, in 23 of the 30 matters where firms were...

What is cyber insurance? Cyber insurance has rapidly progressed from a narrow form of cover, originally focused on liabilities anticipated following the 2002 Californian Data Security Notification Law, to a sophisticated product delivering a blend of first- and third-party protections, chiefly intended to help insureds manage cyber attacks and to indemnify them for the losses that follow. There is no single, settled definition of cyber risk. For insurance purposes, it is typically viewed as the chance of harm, financial loss, or legal liability resulting from damage to, or unauthorised access to, information systems. Frequent sources of loss include accidental events (e.g. damage to equipment that hosts data or system misconfiguration) and deliberate attacks (e.g. ransomware, business email compromise, distributed denial-of-service attacks). Such events may give rise to a range of significant incident response and remediation costs and expenses; first-party loss;...

Customer due diligence ( CDD) This Practice Note outlines guidance on customer due diligence ( CDD), a key element of the anti-money laundering ( AML) and counter-terrorist financing ( CTF) framework. CDD duties underpin the Money Laundering, Terrorist Financing and Transfer of Funds ( Information on the Payer) Regulations 2017 ( MLR 2017), SI 2017/692, as amended. You should verify whether the MLR 2017 set out any additional or modified obligations for your sector and whether your regulatory body imposes further, sector-specific CDD requirements. Counter-proliferation financing is the latest addition to the long-established AML and CTF regime. Amendments to the MLR 2017 introduced counter-proliferation financing measures relating to systems and controls, risk assessment, etc. No counter-proliferation financing provisions were added specifically to CDD, and the existing CDD rules in the MLR 2017 were not revised to reference proliferation financing....

When turmoil strikes, expect intense pressure—to decide, to respond, and to satisfy internal leaders and, potentially, external stakeholders. You may feel stretched beyond your comfort zone, uncertain about reporting duties, what to disclose, to whom, when, and in what sequence. Your gut reaction might be to jump in and move at others’ pace, or, alternatively, to say little and adopt a strictly legal stance. This Practice Note sets out, at a high level, the essential considerations in any crisis. What is a crisis? a period of acute difficulty or danger a moment when a hard or significant choice must be taken For guidance on specific types of crises, see subtopics: Internal investigations Dawn raids & external investigations Data breaches—compliance Business continuity plan The first 12 hours The opening 12 hours of any crisis are decisive. Events move fast;...

From 30 September 2017, the Criminal Finances Act 2017 ( CFA 2017) created a corporate offence for failing to stop the facilitation of tax evasion. Government guidance outlines what it expects from compliance arrangements. This Practice Note draws on the final form of the legislation and the accompanying guidance. That guidance should be interpreted and implemented proportionately, using a risk-based approach. In doing so, you should reflect the size, profile and complexity of your organisation. A small entity and a large multinational may reasonably apply the principles quite differently: measures that suit a low-risk small business could be wholly inadequate for a large enterprise in a high-risk sector. The Law Society has likewise issued CFA 2017 guidance for law firms, approved by the Chancellor on 21 November 2018. The Law Society states that the Chancellor regards its guidance as aligned with the...

The Criminal Finances Act 2017 ( CFA 2017) brought in a corporate offence for failing to prevent the facilitation of tax evasion, taking effect on 30 September 2017. The government has also published guidance outlining its expectations for compliance arrangements. This Practice Note is informed by the final legislation and the guidance. That guidance should be applied in a proportionate, risk-based manner, reflecting the size, nature and complexity of your organisation. A small entity and a large multinational may adopt the principles in very different ways: what is reasonable for a small business in a low-risk environment may be entirely unreasonable for a large enterprise operating in a high-risk context... The offences There are two possible offences, depending on whether the evaded tax is due in the UK or in another jurisdiction. Each offence involves three essential stages, all of which must be present for...

The Criminal Finances Act 2017 ( CFA 2017) The CFA 2017 created a corporate offence for failing to prevent the facilitation of tax evasion, taking effect on 30 September 2017. The government has published guidance detailing its expectations for compliance systems, and this Practice Note reflects both the legislation and that guidance. The guidance should be applied proportionately and on a risk-led basis, taking into account the size, nature and complexity of your organisation. Smaller organisations in low-risk sectors may reasonably adopt more modest measures. Large multinational businesses operating in high-risk areas may need far more robust controls. The government accepts that a proportionate, risk-based approach cannot deliver a zero-failure regime. Where you can show that reasonable prevention procedures are in place to identify and mitigate risks of facilitating tax evasion, prosecution is unlikely because you will be able to rely on a...

The Criminal Finances Act 2017 ( CFA 2017) created a corporate offence for failing to prevent the facilitation of tax evasion, effective from 30 September 2017. Government guidance sets out what it expects from compliance arrangements. This Practice Note draws on the final legislation and that guidance... That guidance should be applied proportionately and on a risk basis, taking into account the size, nature and complexity of your organisation. A small entity and a large multinational may adopt the principles in very different ways: what is reasonable for a low‑risk small business could be wholly unreasonable for a high‑risk large business... The Law Society has also issued Criminal Finances Act 2017 guidance for law firms, approved by the Chancellor on 21 November 2018. According to the Law Society, the Chancellor considers its guidance consistent with the Government guidance for the corporate offences of failing to...

A privacy risk register is a mechanism for bringing together, documenting, monitoring and administering all data protection, information security and privacy risk information in a single location. This Practice Note walks you through how to create such a register. See Precedent: Privacy risk register. The UK GDPR does not mandate keeping a privacy risk register, though guidance from the Information Commissioner’s Office ( ICO) indicates the regulator views it as good practice. To build one, you must first pinpoint data protection risks within your organisation. This involves reviewing: The personal data you hold How you handle and process it The purposes for processing With whom it is shared Internal data flows Any transfers of personal data outside the UK Measures to keep personal data accurate and current Retention periods and destruction...

Managing risk is never a single task; it is a continual process, as illustrated: This Practice Note sets out how to assess and clearly record risks in practice using a risk register, a tool that gathers all of your risk information in one place by carefully classifying each risk the organisation faces, scoring each entry and then choosing your response to each identified risk accordingly, eg reject or accept and, if the latter, how to control or mitigate the risk—see Precedent: Risk register. What is risk? There is a widely recognised definition of risk, ie: Risk = probability x impact. So, for any given risk faced by your business, two questions arise: how likely is it that the risk will occur, ie what is the probability? if it does occur, how serious will it be, ie what is the impact? A risk register is a means of...

Choices are made constantly, many executed cleanly and delivered well. Yet others emerge muddled, overly complex, or simply fall short. It contrasts sound decision-making with choices that miss the mark, drawing out practical considerations. This Practice Note explores why a decision-making framework matters, what it ought to contain, tools to apply along the way, and how to design and embed one across your organisation. Why do we need a decision-making framework? Decision frameworks give a disciplined approach to choices that strengthen and advance the organisation. The aim of every decision should be to maximise the likelihood of favourable results. Such discipline helps decisions contribute visibly to organisational improvement. It promotes structure, visibility, and ethical, compliant choices. With a framework, you (and your team or organisation) can: keep everyone aligned make decisions visible at every planning tier clarify how options and plans back departmental or...

UPDATE (30/11/21): On 27 November 2021, the Prime Minister outlined new, temporary steps following the identification of Omicron cases in the UK. Travel restrictions now affect arrivals from Southern Africa, with several nations added to the red list. Moreover, from 30 November all international arrivals—regardless of where they have travelled from—must take a Day 2 PCR test and self-isolate until a negative result is received. For further details, see Practice Note: Coronavirus ( COVID-19)—sickness and other absence [ Archived]. Measures to limit the spread within the UK from 30 November include: Face coverings are mandatory in shops and in other venues such as banks, post offices and hairdressers, and on public transport (but not in hospitality), under the Health Protection ( Coronavirus, Wearing of Face Coverings) ( England) Regulations 2021, SI 2021/1340. All contacts of suspected Omicron cases must self-isolate for ten days,...

UPDATE (22/2/22): Following the Prime Minister’s 21 February 2022 announcement, the Cabinet Office has issued the government’s COVID-19 Response: Living with COVID-19, outlining the intention to lift the remaining domestic coronavirus ( COVID-19) legal restrictions in England from 24 February 2022. For details, see: LNB News 22/02/2022 8 and News Analysis: Coronavirus ( COVID-19)— How should employers respond to the scrapping of self-isolation rules? This Practice Note has been archived and is no longer updated. It captures the position under the COVID-19 Response: Autumn and Winter Plan 2021 and Cabinet Office advice on staying safe and limiting transmission between 30 November 2021 and 23 February 2022. For the approach from 24 February 2022, refer to Practice Note: Living with coronavirus ( COVID-19) in the workplace from 24 February 2022 [ Archived]. See also...

An internal investigation is a formal legal exercise carried out by an organisation, with or without external counsel, to examine and determine facts around a particular allegation, concern or misconduct, and to address any potential irregularities... What sort of events may trigger an investigation? A concern raised internally via a whistleblowing hotline or other channel (whistleblower) A response to a demand from a regulatory or criminal authority Part of due diligence ahead of a merger or acquisition A civil litigation claim An internal or external auditor’s report Media reports An external allegation, for example from a customer or counterparty Why conduct an internal investigation? Internal investigations play a vital role in establishing the factual background of an event or sequence of events in a manner that best safeguards the organisation and its board. The primary objective is to...

This Practice Note summarises key UK legislative, regulatory and voluntary best practice resources on corporate social responsibility ( CSR), environmental, social and governance ( ESG), human rights reporting and related company initiatives. It also highlights core EU regimes that require sustainability and ESG disclosures. ESG and sustainability collection We have curated an ESG and sustainability collection to assist practitioners advising organisations on ESG and sustainability, bringing together content from several Lexis+® UK Practice Areas (subscription required). For more details, see: ESG and sustainability collection. Board briefing notes We have additionally prepared briefing notes for the board of a quoted company and for the board of an unquoted company (including an AIM company), summarising the key environmental reporting duties applicable to the business: Board briefing note—environmental reporting—quoted companies Board briefing note—environmental reporting—unquoted companies Defining CSR and ESG Corporate social responsibility ( CSR)—also called corporate...

STOP PRESS: This document is currently being revised to take account of the Data ( Use and Access) Act 2025 ( DUAA 2025), which updates the UK GDPR and the Data Protection Act 2018. For further detail on DUAA 2025 compliance, see Practice Note: Data ( Use and Access) Act 2025—compliance implications. This Practice Note draws on the UK General Data Protection Regulation ( UK GDPR) and the consent guidance issued by the Information Commissioner’s Office ( ICO). Under the UK GDPR, consent is rarely the default lawful basis for handling personal data, and organisations should assess whether another lawful ground is more suitable from both legal and operational viewpoints—see below: Do you need consent? and Practice Note: How to process personal data lawfully. What is consent? Consent means a freely given, specific, informed and unambiguous expression of the data subject’s wishes, whereby they indicate...

Practice Note This Practice Note is designed for in-house counsel and privacy and compliance specialists in private commercial organisations. It sets out why, when and how to carry out a data protection impact assessment ( DPIA) for a new or existing surveillance camera or CCTV initiative or system. It walks you through the essential elements of a DPIA, drawing on the template and guidance issued by the Biometrics and Surveillance Camera Commissioner ( BSCC) and the Information Commissioner’s Office ( ICO), and reflects the obligations in the UK General Data Protection Regulation ( UK GDPR), Assimilated Regulation ( EU) 2016/679. A DPIA does exactly what its title implies—it provides a method for evaluating the data protection implications of a given project or process for affected individuals. Typically, a DPIA is undertaken at the outset of any project that may raise data...

What is the CMA? From 1 April 2014, the Competition and Markets Authority ( CMA) assumed many duties formerly carried out by the Competition Commission and the Office of Fair Trading. As an independent government department, it works to keep markets fair for both businesses and consumers, promoting competition by probing anti-competitive behaviour such as price-fixing and unfair trading practices. Scrutinising mergers that could lessen competition Undertaking market studies and investigations where competition or consumer issues may arise Examining suspected breaches of UK bans on anti-competitive agreements and abuses of dominance Bringing criminal cases against individuals who commit the cartel offence Enforcing consumer protection laws to address practices and market conditions that hinder consumer choice Co-operating with sector regulators and encouraging the use of their competition powers Considering regulatory references and appeals Dealing with digital markets and the...