Legal Precedents

STANDARD CONTRACTUAL CLAUSES SECTION I Clause 1 Purpose and scope The aim of these standard contractual clauses is to secure adherence to Regulation ( EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, concerning the safeguarding of natural persons in relation to the processing of personal data and the free movement of such data, as set out therein ( General Data Protection Regulation) ( 1 ) for the transmission of personal data to a third country. The Parties comprise and include: the natural or legal person(s), public authority/ies, agency/ies, or other body/ies (‘entity/ies’) that transfer the personal data, as set out in Annex I. A (each a ‘data exporter’), and the entity/ies in a third country that obtain the personal data from the data...

International transfers In addition to the Precedents included within this International transfers subtopic, our Risk and Compliance practice area also provides the following Precedents relating to transfer impact assessments: Precedent: Transfer impact assessment—personal data— EU methodology, designed for use under the UK GDPR Precedent: International personal data transfer—data recipient questionnaire, designed for use under the UK GDPR......

STOP PRESS: On 19 June 2025, the Data ( Use and Access) Bill obtained Royal Assent and became the Data ( Use and Access) Act 2025 ( DUAA 2025), with parts commencing that day. Measures that started immediately on 19 June 2025 included those on handling data subject access requests and the grant of powers to make further regulations. Other elements, relating to notices issued by the Information Commissioner and particular aspects of law enforcement processing, began on 19 August 2025, two months after Royal Assent. The bulk of DUAA 2025 will only take effect once additional regulations—issued as statutory instruments—are made to commence them. Parts 5 and 6 of DUAA 2025 introduce amendments to the UK’s data protection and e Privacy regime, including: the United Kingdom General Data Protection Regulation; the assimilated Regulation ( EU) 2016/679 ( UK GDPR); the Data Protection Act 2018; and the Privacy and...

Precedents relating to the rights of data subjects under the United Kingdom General Data Protection Regulation, Assimilated Regulation ( EU) 2016/679 ( UK GDPR) General Responses covering all rights when requesting identity details or confirming authority, charging a fee, and extending time. Right of access DSAR policy and request form; replies seeking clarification, and where access can or cannot be provided. Rectification All-rights (excluding access) request form; response to rectification; third-party notice for rectification, erasure or restriction. Restriction on processing All-rights (excluding access) request form; letter establishing a temporary restriction; responses where restriction can or cannot be honoured; notice lifting a restriction; third-party notice for rectification, erasure or restriction. Erasure All-rights (excluding access) request form; responses where erasure can or cannot be actioned; controller notice for erasure of publicly available data; third-party notice for rectification, erasure or...

Alongside the Precedents set out in the Transparency and privacy policies and notices subtopic, the following Precedents are likewise available in Lexis+® UK Risk & Compliance: Privacy policies/notices Precedent: Policy—data protection Precedent: Policy—criminal records information Precedent: Policy— CCTV Precedent: Privacy policy—law firms and professional services Precedent: Data protection privacy notice (employment) Precedent: Data protection privacy notice (recruitment) Other Precedents Precedent: Privacy notice audit Precedent: Privacy notice register......

Note These provisions are prepared on the basis that the applicable contract is a business-to-business arrangement, with the supplier acting as processor for a customer in the role of controller, in relation to the processing of personal data governed by the United Kingdom General Data Protection Regulation ( UK GDPR), Assimilated Regulation ( EU) 2016/679. The terms ‘supplier’ and ‘customer’ (in place of ‘processor’ and ‘controller’) are used to simplify incorporation into commercial contracts. The drafting also relies on the additional defined terms ‘ Agreement’, ‘ Business Day’, ‘ Customer’, ‘ Data Protection Laws’, ‘ Data Subject’, ‘ GDPR’ and ‘ Supplier’, which are assumed to be defined appropriately elsewhere in the relevant agreement. It is further assumed that ‘ GDPR’ refers to UK GDPR and that ‘ Data Protection Laws’ includes UK GDPR. These provisions can also be adapted for...

This Agreement is dated [ insert date ] Parties [ insert name ] [ of OR a company incorporated in [ England and Wales ] under number [ insert registered number ] whose registered office is at ] [ insert address ] ( Assignor) [ insert name ] [ of OR a company incorporated in [ England and Wales ] under number [ insert registered number ] whose registered office is at ] [ insert address ] ( Assignee) Each of the Assignor and the Assignee is a party; together they are the parties. Background The Assignor owns the copyright and database rights in the Database. The Assignee is [ insert description of the Assignee’s background/background to assignment or relevant transaction ]. The Assignor agrees to assign all such copyright and database rights and to migrate the contents of the Database to the Assignee, and the Assignee agrees to accept that...

This Agreement is entered into on [ insert date ] Parties [ insert name ] [ of OR a company incorporated in [ England and Wales ] under number [ insert registered number ] whose registered office is at ] [ insert address ] ( Assignor); and [ insert name ] [ of OR a company incorporated in [ England and Wales ] under number [ insert registered number ] whose registered office is at ] [ insert address ] ( Assignee) Each of the Assignor and the Assignee is a party and, collectively, the Assignor and the Assignee are the parties. BACKGROUND The Assignor holds all Intellectual Property Rights in the Database. The Assignor acts as Controller of the Personal Data contained in the Database and the Data Protection Documentation. The Assignee is [ insert description of the...

These training resources present an introduction to execution, setting out the principal aspects of completing simple contracts and deeds, plus the key considerations that apply when executing such documents, in the context of the typical work undertaken by commercial contracts lawyers. They comprise template Power Point slides with accompanying notes for a trainer to use when explaining the law on execution of deeds and contracts in practice. Topics covered include: identifying deeds versus simple contracts execution formalities for common entities practical challenges in company execution witnessing requirements counterparts electronic signatures The training materials are customisable. Click the link below to download the Power Point presentation......

Case No. [ insert claim number ] IN THE HIGH COURT OF JUSTICE BUSINESS AND PROPERTY COURTS OF ENGLAND & WALES INTELLECTUAL PROPERTY LIST ( Ch D) [ INTELLECTUAL PROPERTY ENTERPRISE COURT ] BETWEEN: [ insert full name of claimant ] Claimant and [ insert full name of defendant ] Defendant REPLY 1 Save where stated otherwise, paragraph number references in this Reply refer solely to those within the Defence......

Case No. [ insert number ] IN THE HIGH COURT OF JUSTICE BUSINESS AND PROPERTY COURTS OF ENGLAND & WALES INTELLECTUAL PROPERTY LIST ( Ch D) [ INTELLECTUAL PROPERTY ENTERPRISE COURT ] BETWEEN: [ insert full name of claimant ] Claimant and [ insert full name of defendant ] Defendant DEFENCE Unless stated otherwise in this Defence: references to paragraph numbers are to those in the Particulars of Claim; defined expressions carry the meanings given in the Particulars of Claim, without admission; and save where expressly admitted or not admitted below, the Defendant denies each allegation in the Particulars of Claim. Any matter not specifically addressed herein is required to be strictly proved. Any document mentioned in this Defence is to be read at trial for its full...

Case No. [ insert number ] IN THE HIGH COURT OF JUSTICE BUSINESS AND PROPERTY COURTS OF ENGLAND & WALES INTELLECTUAL PROPERTY LIST ( Ch D) [ INTELLECTUAL PROPERTY ENTERPRISE COURT ] Between[ insert full name of claimant ] ( Claimant)and[ insert full name of defendant ] ( Defendant) PARTICULARS OF CLAIM The Claimant The Claimant is, and throughout all relevant periods has been, [ insert details of claimant ]. The Claimant’s core business activity is [ insert type of business carried out ]. In particular, the Claimant [ insert brief description of claimant’s business relating to the database ]. The Claimant’s Database The database comprises a compilation of discrete [ works, data or other materials ], organised in a systematic or methodical manner and with items individually accessible by [ electronic or other means ]. The database contains information relating to [ insert details of relevant...

The purpose of the claim form A claim form is a species of statement of case, and it is the document used to start proceedings. It sets out information relevant to the proceedings, including the following details to guide the court and parties: the court reference number to be used on all subsequent court documents; the parties to the proceedings, identifying claimant and defendant; what is being claimed, that is, the relief sought; particulars of the claim (including any claim for interest); and contact details for the claimant, generally the claimant’s solicitor. The procedural rules on how and where to begin proceedings are contained in CPR Part 7. Broader guidance on the contents of a claim form is available in the Practice Note: Claim form—the contents. This Precedent provides a downloadable Word document containing suggested text for use in relation to a...

Case No. [ insert claim number ] IN THE HIGH COURT OF JUSTICE BUSINESS AND PROPERTY COURTS OF ENGLAND & WALES INTELLECTUAL PROPERTY LIST ( Ch D) [ INTELLECTUAL PROPERTY ENTERPRISE COURT ] Before: Date: BETWEEN: [ insert full name of claimant ] Claimant and [ insert full name of defendant ] Defendant ORDER UPON the hearing of Claim [ insert claim number ], tried before [ Mr OR Mrs OR Miss OR [ insert other ] ] Justice [ insert name ] on [ insert trial date ]; AND UPON the Court having heard [ insert name ], Counsel for the Claimant(s), and [ insert name ], Counsel for the Defendant(s); AND UPON the Court handing down judgment on [ insert date ]; AND UPON the Court determining the Claimant’s claims for infringement of database right in the Claimant’s favour; [ AND UPON the Court rejecting the Defendant’s counterclaim for [ insert details of...

Defined terms This Precedent clause employs the additional defined expressions ‘ Agreement’, ‘ Business Day’, ‘ Disclosing Party’, ‘parties’, ‘person’ and ‘ Receiving Party’. These are not peculiar to data processing and are expected to be separately defined (or adjusted) as suitable within the relevant agreement. It is further taken that any references to ‘ Disclosing Party’ and ‘ Receiving Party’ will be aligned, where appropriate, to mirror the applicable defined term for each party adopted in the agreement in which this clause appears and ultimately utilised accordingly therein......

1 Project overview Project summary [ Provide a concise outline of the project, eg a new IT platform to hold and retrieve personal data, or a plan to pinpoint individuals within a specific group or demographic to anticipate their purchasing requirements ] Processing purposes [ Specify the reasons for the processing, eg enhance the quality and precision of employee personal data and introduce a better procedure for removing data that is no longer needed ] Lawful ground for processing [ State the legal basis. Where the organisation plans to depend on legitimate interests as the basis for processing, set out those legitimate interests and confirm that a legitimate interests assessment has been completed. ] 2 Identify the need for a DPIA 2.1 Project aims and benefits What does the project aim to achieve? [ Describe what the project is intended to accomplish ] What are the anticipated benefits to the...

This Agreement takes effect on [ date ]. Parties 1 [ Insert name of supplier ], a company registered in [ England and Wales ] with company number [ insert registered number ] and having its registered office at [ insert address ] ( Supplier ); and 2 [ Insert name of customer ], a company registered in [ England and Wales ] with company number [ insert registered number ] and having its registered office at [ insert address ] ( Customer ). Each of the Supplier and the Customer is a party and, collectively, the Supplier and the Customer are the parties. Background ( A) The Supplier is a proficient and experienced provider of data processing services, encompassing [ insert description of relevant services ]. ( B) The Customer is [ insert description of the Customer and its business ]. ( C) The...

[ Insert the insurer’s name and address ] [ Insert date ] Dear [ insert organisation name ], Notification under policy number [ insert policy number ] [ We acknowledge that, under our policy terms, we must inform you if a data security incident occurs. ] On [ insert date ], we discovered that [ briefly outline what took place, ie how and when the breach happened ]. [ We have completed an assessment of this event, and the attachment to this letter sets out our findings. OR We are carrying out a comprehensive review of this event and expect to finalise it by [ date ]. The attachment to this letter includes all pertinent details available to us at this time. ] [ We are also liaising closely with [ internal and external ] cyber security specialists, [ any relevant sector body or regulator ], [ major...

FORTHCOMING CHANGE: The Information Commissioner’s Office ( ICO) has issued draft guidance on recruitment and selection, which was open to consultation until 5 March 2024, and has also removed the employment practices code and its supplementary guidance from the employment information page. For further details, see Practice Note: The UK GDPR and DPA 2018: key data protection issues for employment lawyers— Information Commissioner's Office ( ICO) guidance. This Precedent will be updated in due course. [ Insert name of organisation ] This notice sets out what personal data (information) we will hold about you, how we obtain it, and how we will use and may share information about you during the application process. We are required under data protection legislation to provide you with this information. Please ensure you read this notice (also referred to as a ‘privacy notice’) and any similar notice we may give you from time to...

Introduction This records retention schedule supports and forms part of [ insert organisation’s name ]’s records management policy. It outlines how long distinct categories of (employment-related) business records must be kept for operational and legal reasons. It is a comparatively substantial document, clearly setting out the many kinds of employment-related records used by [ insert organisation’s name ] together with the relevant retention periods for each category and record type. The specified durations are informed by business needs and legal requirements, ensuring consistent and compliant record-keeping across the organisation overall. If you hold any records not described in this Schedule, and the appropriate retention period cannot be determined from the existing entries, please contact [ the data protection officer OR [ insert job title or department ] ] for guidance. Any departure from the retention periods in this Schedule must be authorised in advance by [...