Legal Precedents

Precedent presentation This Precedent presentation acts as a resource to upskill your staff in the fundamental principles of data protection and in managing them within the workplace. The Precedent is generally applicable, yet integrates the requirements of the UK General Data Protection Regulation ( UK GDPR) wherever pertinent as and when needed......

We treat your privacy with utmost care. Please review this privacy policy attentively, as it sets out details on the reasons and methods by which we gather, retain, use and disclose your personal information. It further outlines your rights concerning your personal information and how to proceed if you wish to raise a complaint. This privacy policy does not extend to any third party websites that may link to our website. Clients of this firm should consider this policy alongside our general terms and conditions, which include additional guidance on confidentiality. 1 Who are we and what do we do? 1.1 [ Insert firm name ] is a [ insert structure, eg limited liability partnership ] [ , authorised and regulated by the Solicitors Regulation Authority under number [ insert number ] ] . Contact details are provided at section 16. 1.2 We obtain, handle and are...

Why are we undertaking this survey? [ Insert name of organisation ] prepares for unforeseen emergencies through a robust business continuity plan. To [ formulate OR update ] our business continuity plan, we wish to engage with staff so that, if our operations are disrupted: we can account for the safety of our people, clients, and any other parties we work with; and we can restore full operations as swiftly as possible To ensure every business function is addressed and a comprehensive plan is created, we need insights from colleagues across the organisation. Please take a few minutes to complete this survey and submit it to [ insert details of how and to whom the completed survey should be submitted ] by [ insert date ]. Thank you for completing this survey. Survey questions What is the name of your...

[ Insert the insurer’s name and address ] [ Insert date ] Dear [ insert organisation name ], Notification under policy number [ insert policy number ] [ We acknowledge that, under our policy terms, we must inform you if a data security incident occurs. ] On [ insert date ], we discovered that [ briefly outline what took place, ie how and when the breach happened ]. [ We have completed an assessment of this event, and the attachment to this letter sets out our findings. OR We are carrying out a comprehensive review of this event and expect to finalise it by [ date ]. The attachment to this letter includes all pertinent details available to us at this time. ] [ We are also liaising closely with [ internal and external ] cyber security specialists, [ any relevant sector body or regulator ], [ major...

We must know exactly what personal data we possess so we can lawfully put measures in place to safeguard it... Please complete this questionnaire by [ insert date ] and return it to [ insert name or email address ]... The table below clarifies some of the terminology used in the questionnaire; if you have any questions, please contact [ insert name or email address ]... Term — Explanation Personal data – Information relating to an identified or identifiable living individual... Special category personal data – Personal data disclosing racial or ethnic background, political views, religious or philosophical beliefs, or trade union membership; data concerning health, a natural person's sex life or sexual orientation; biometric information processed to uniquely identify a person; genetic information... Data retention schedule – Internal guidelines stating how long data can be kept, which can be found [ state...

1 Data privacy manager details Organisation name [ Insert name of organisation ] Data privacy manager’s name [ Insert name ] Reports to [ Insert name and/or position ] Employment status (full-time/part-time) [ Insert ] Other roles within the organisation [ Insert details of any other roles held ] Date appointed [ Insert date ] 2 Role summary Serve as data privacy manager for [ insert name of organisation ] and to: 2.1 support [ insert name of organisation ] in meeting the UK General Data Protection Regulation ( UK GDPR) and other relevant data protection laws by implementing robust processes and controls, enabling [ insert name of organisation ], its managers and employees, to fulfil their legal duties; 2.2 act as the intermediary for key stakeholders, including the Information Commissioner’s Office ( ICO), data subjects, and business units within [ insert name of organisation ]; 2.3 be [ insert name of...

Legal professional privilege ( LPP) is a core legal protection that permits [ insert organisation’s name ] to resist producing evidence to a third party or the court. It enables the organisation to seek expert legal guidance, setting out all pertinent facts to our legal advisers without concern that they will later be revealed and used against us. This short guide sets out what legal professional privilege ( LPP) is and how we can best preserve it. 1 What is legal professional privilege? LPP is an umbrella term covering: legal advice privilege ( LAP) litigation privilege LPP safeguards the confidentiality of written and verbal communications between lawyers and clients. It is a fundamental entitlement, allowing a party to withhold material from disclosure to any third party or a court. Legal advice privilege Legal advice privilege applies to all confidential...

Litigation privilege This privilege safeguards exchanges (i) between a solicitor and their client, or (ii) between the client and a third party—see Practice Note: Legal professional privilege for in-house lawyers— Litigation privilege. To set up and preserve litigation privilege, you can sidestep the challenge of trying to pin down pertinent information—such as dates and grounds—by capturing the key points in this Precedent. It is supplied in Excel format and therefore cannot be downloaded into Word......

1. Key points on obtaining and safeguarding legal professional privilege are summarised in this paper. For expanded details on these tips, together with extra advice and information, consult our [ insert, eg Legal professional privilege—quick guide for staff ]......

Date: [ insert date ] 1 Introduction As our [ senior management team OR board ], it is vital that you understand how data protection law impacts our business, why it matters, and what we must do to remain compliant. This briefing highlights the key aspects of the UK General Data Protection Regulation ( UK GDPR) and the steps we take to ensure adherence. If any of the terms used here are unclear, please consult our [ insert name of document, eg detailed board briefing ]. 2 Which data protection laws apply to our business? The primary data protection framework is the UK GDPR, complemented by the Data Protection Act 2018 ( DPA 2018). When we conduct direct marketing, the Privacy and Electronic Communications Regulations 2003 ( PECR 2003) also apply. Where we operate within the EU, or provide goods or services to...

FORTHCOMING CHANGE: The Information Commissioner’s Office ( ICO) has issued draft guidance on recruitment and selection, which was open to consultation until 5 March 2024, and has also removed the employment practices code and its supplementary guidance from the employment information page. For further details, see Practice Note: The UK GDPR and DPA 2018: key data protection issues for employment lawyers— Information Commissioner's Office ( ICO) guidance. This Precedent will be updated in due course. [ Insert name of organisation ] This notice sets out what personal data (information) we will hold about you, how we obtain it, and how we will use and may share information about you during the application process. We are required under data protection legislation to provide you with this information. Please ensure you read this notice (also referred to as a ‘privacy notice’) and any similar notice we may give you from time to...

Introduction This records retention schedule supports and forms part of [ insert organisation’s name ]’s records management policy. It outlines how long distinct categories of (employment-related) business records must be kept for operational and legal reasons. It is a comparatively substantial document, clearly setting out the many kinds of employment-related records used by [ insert organisation’s name ] together with the relevant retention periods for each category and record type. The specified durations are informed by business needs and legal requirements, ensuring consistent and compliant record-keeping across the organisation overall. If you hold any records not described in this Schedule, and the appropriate retention period cannot be determined from the existing entries, please contact [ the data protection officer OR [ insert job title or department ] ] for guidance. Any departure from the retention periods in this Schedule must be authorised in advance by [...

[ Include the client's name and address ] Private and confidential Dear [ insert name ] New data protection privacy notices Enclosed is the data protection privacy notice......

[ Insert name of organisation ] This notice outlines the personal data (information) we keep about you, how we obtain it, and the ways in which we use and may share it during your employment and once it has concluded. Data protection legislation requires us to give you this information. Please make sure you read this notice (sometimes called a ‘privacy notice’) and any similar notice we may issue from time to time whenever we collect or handle your personal data... Who collects the data [ Insert name of employer ] [ trading as [ insert trading name, if different ] ] (‘ Company’) is the ‘controller’ of personal data and collects and uses certain information about you. [ This information is also used by our affiliated entities and group companies, namely [ insert details or a link, or otherwise show where details of group...

[ Insert name and address of client ] Private and confidential Dear [ insert name ] New data protection privacy notices Following [ set out details of the action that the employer has already taken in order to effectively launch the new notices, eg information sessions, training etc ], please find enclosed a data protection privacy notice......

STOP PRESS: This document is currently being revised to account for the implementation of the Data ( Use and Access) Act 2025 ( DUAA 2025), which updates the UK GDPR and the Data Protection Act 2018. For further guidance on the compliance impact of DUAA 2025, see Practice Note: Data ( Use and Access) Act 2025—compliance implications. 1 Introduction Date of review [ Insert date ] Person conducting review [ Insert name or job title ] 2 Description of the privacy notice Type/summary of privacy notice [ Insert, e.g. Privacy policy on customer‑facing website ] Wording provided [ Insert or attach wording ] Where and when it is shown/provided [ Insert, e.g. In the ‘ Legal notices’ section in our website footer. Publicly available at all times ] Medium/format used [ Insert, e.g. Electronic written format ] Is this a...

From [ insert name ], [ insert job title ] An essential element of our data protection compliance is the appointment of a data protection officer ( DPO) who will work in close partnership with the business and the [ board OR senior management team ] to make sure we are doing everything required to protect personal data. I am delighted to confirm that [ insert name of DPO ] will assume this significant role with effect from [ insert date ]. Introducing our data protection officer [ Insert name ] is our new DPO. [ Insert brief introductory details of DPO, eg background, experience ].......

1 Documents The Chair presented the following papers: 1.1 [ a memorandum to the board from [ insert name ] making recommendations concerning appointing a data protection officer ( DPO) for [ insert name of organisation ] ] 1.2 [ a draft job description and role profile for the DPO post ] 1.3 [ a draft consultancy agreement for the DPO position ] 1.4 [ a draft message from the [ CEO OR Senior Member OR Senior Partner ] to staff on the DPO’s appointment ] (collectively, the Documents) 2 Consideration of the Documents 2.1......

Date: [ insert date ] Introduction Under the UK General Data Protection Regulation ( UK GDPR), some organisations are required to appoint a named individual as their Data Protection Officer ( DPO). Having considered these duties in the context of [ insert name of organisation ]’s activities, this memorandum presents my conclusions and advice, together with the considerations that shaped them. A short overview of the UK GDPR provisions concerning DPOs is provided in the Appendix. Factors relevant to [ insert name of organisation ]’s appointment of a DPO Core activities [ Describe the organisation’s main functions that entail processing personal data. Reflect, for instance, on whether a private body undertakes any public functions within its work ] Controller or processor [ Explain whether, in relation to the core activities above, the organisation acts as a controller or performs the role of a processor ] Categories of data...

1 DPO details Name of organisation [ Insert name of organisation ] Name of DPO [ Insert name ] Reports to [ Insert name and/or position ] Full time/part time [ Insert ] Details of any other roles held within the organisation [ Insert details of any other roles held ] Date appointed [ Insert date ] 2 Role summary To serve as the data protection officer ( DPO) for [ insert name of organisation ] under the UK General Data Protection Regulation ( UK GDPR) and to: 2.1 enable [ insert name of organisation ]’s compliance with the UK GDPR and other applicable data protection legislation by ensuring effective systems and controls are in place to enable [ insert name of organisation ], including its managers and employees, to comply with their legal obligations 2.2 act as intermediary between relevant stakeholders, including the Information Commissioner’s Office ( ICO), data subjects and...