Case studies

"While we began looking at LexisNexis products primarily for cost saving, it quickly became more about customer service, ease of onboarding, ongoing training and breadth of resources available."

Co-Op

Access all 116 documents on Data Controller

GET ACCESS NOW

GLOSSARY

Data Controller definition

Published by a LexisNexis Commercial expert

What does Data Controller mean?

A data controller is any person, partnership or company who determines how and for what purposes personal data are processed. A third party may carry out processing on the controller’s behalf, although the latter remains responsible for the processing.

Speed up all aspects of your legal work with tools that help you to work faster and smarter. Win cases, close deals and grow your business–all whilst saving time and reducing risk.

Key provisions in a consultancy agreement—checklist

Key provisions in a consultancy agreement—checklist This Checklist sets out the key provisions to consider in a consultancy agreement. This Checklist highlights issues which are relevant to the customer, issues which are relevant to the consultant and issues which are relevant to both parties for inclusion in a consultancy agreement. This Checklist will assist both the consultant and the customer when reviewing and negotiating a consultancy agreement. See also: Taking instructions for a consultancy agreement—checklist. For Precedent consultancy agreements, see: • Consultancy agreement—company and individual—pro-client • Consultancy agreement—company and company—pro-client • Consultancy agreement—individual and company—pro-consultant • Consultancy agreement—company and company—pro-consultancy • Consultancy agreement—company and individual—pro-client (short form) • Side letter to consultancy agreement—company and company—pro-client For further related guidance, see: Consultancy services—overview and Practice Notes: • Managed service companies and the anti-avoidance legislation • Deciding appropriate employment status • Personal service companies—the key benefits and key tax considerations • Securing intellectual property rights from employees and contractors • IR35—the large and public client off-payroll regime—practical considerations for the end client...

Reviewing terms for the purchase of goods or services as a buyer—business to business—checklist

Reviewing terms for the purchase of goods or services as a buyer—business to business—checklist This Checklist sets out the key considerations when reviewing contracts or terms and conditions for the purchase of goods or services between two businesses (ie a B2B contract). It can be used for reviewing standard terms of supply of goods or services and for bespoke supply agreements. It is drafted from a buyer, or the customer/purchaser, perspective. For general guidance on the purchase or supply of goods and services, see: Sale and supply of goods—overview and Supply of services—overview. Reviewing terms for the purchase of goods or services as a buyer—business to business Issue Description Further information Tick Preliminary considerations for a buyer of goods or services Recitals and representations Does the agreement include a preamble which sets out the buyer’s high level objectives and any seller representations in relation to its ability to provide the goods and services? Precedent: Background clausePractice Note: Misrepresentations—excluding and limiting liability for them ☐ Existing restrictions and permissions Have...

Discover our 2 Checklists on Data Controller

Data portability

UK data protection law includes a right to data portability. That right allows individuals to obtain from a controller a copy of their personal data in a structured, machine-readable format. In addition, in some circumstances, individuals have the right to have that data transferred directly by the controller to another controller. This Practice Note addresses the right of data portability. It assumes a degree of knowledge about UK data protection law. For a general introduction to UK data protection law, including guidance on key data protection concepts and terminology, see the Data protection toolkit.Note that there are significant similarities between the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR) and the EU’s General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR) and this Practice Note focuses on the position under the UK GDPR. For information about the background to the UK GDPR and its relationship with the EU GDPR, see Practice Note: The UK General Data Protection Regulation (UK GDPR)—Summary of key legislation. For information about...

Data protection law—application to employee share schemes [Archived]

ARCHIVED: This archived Practice Note provides information on the data protection regime before 25 May 2018 and reflects the position under the Data Protection Act 1998. This Practice Note is for background information only and is not maintained.Under the GDPR, it is even less likely than it was under Data Protection Directive, Directive 95/46/EC that an employer will be able to rely on employee consent as the legal basis for data processing at work and given the serious consequences of failing to comply with obligations under the GDPR, employers should therefore avoid relying on consent as a lawful processing condition.In most cases, it is likely that the employer will instead be able to rely on ‘legitimate interests’ condition, provided:•the processing is necessary for the purposes of the employer’s legitimate interests•those interests are not overridden by the employee’s interests or fundamental rights and freedoms•the processing is proportionate and cannot be achieved by other, less intrusive means•the data being processed are adequate, relevant and not excessive for the legitimate purpose, and•the employee has been properly...

Discover our 23 Practice Notes on Data Controller

Ireland—data protection impact assessment—artificial intelligence

Ireland—data protection impact assessment—artificial intelligence DPIA screening questionnaire The screening questionnaire should be a concise document and not overly burdensome on the business. However, it needs to provide sufficient information to the DPO/Privacy POC to decide if a DPIA needs to be completed. Like the DPIA itself, the screening questionnaire will be drafted by a multidisciplinary team within the business. All completed screening questionnaires should be approved, time stamped and retained by the DPO/Privacy POC. Where a DPIA is required, it should be kept with the screening questionnaire to avoid duplication. The DPIA template is a continuation of the screening questionnaire. While the screening questionnaire and the DPIA detail AI use in accordance with EU GDPR requirements, companies deploying AI systems also need to factor in their obligations under additional relevant legislation, such as the requirement to carry out a fundamental rights impact assessment (FRIA) under the EU AI Act. While outside the scope of this document, information gathered as part of the screening questionnaire / DPIA exercise will be...

Data sharing decision form

Data sharing decision form For use by the organisation taking the decision to share data. 1 Request details Name of organisation receiving request to share data [Insert name of organisation receiving the request for data sharing] Name of organisation requesting data [Insert name of organisation requesting data] Name and position of person requesting data [Insert name and position of person requesting data] Date request received [Insert date you received the request] 2 Description of data sharing Description of data requested [Insert description of the data you are seeking access to] Data controller relationship ☐ Joint☐ Separate Will we have a data sharing agreement in place? ☐ Yes☐ No[If no, explain why not] 3 Lawful processing Purpose of sharing [Insert description of why the data will be shared] Lawful basis of sharing [Insert relevant lawful basis for sharing, eg contractual performance, consent, legitimate interests] Why is sharing necessary? [Insert description of why the data sharing is necessary for the purposes identified above] Are special conditions met for...

Dive into our 15 Precedents related to Data Controller

If a data controller shares personal data with another data controller based outside the EEA, and in doing so exports that personal data outside of the EEA using one of the permitted data export exceptions or adequacy solutions under Schedule 4 of the Data Protection Act 1998 (DPA 1998), does the transferor data controller retain any liability for the processing of that personal data by the transferee controller under the DPA 1998?

If a data controller shares personal data with another data controller based outside the EEA, and in doing so exports that personal data outside of the EEA using one of the permitted data export exceptions or adequacy solutions under Schedule 4 of the Data Protection Act 1998 (DPA 1998), does the transferor data controller retain any liability for the processing of that personal data by the transferee controller under the DPA 1998? For the purposes of this Q&A we have focused solely on the law under the UK’s Data Protection Act 1998 (DPA 1998) as regulated by the Information Commissioner’s Office (ICO). Please note that: • the General Data Protection Regulation (GDPR) will introduce substantial amendments to data protection law and will replace the current DPA 1998 and the current Directive 95/46/EC (the Data Protection Directive). The GDPR will be directly applicable and fully enforceable in all EU Member States from 25 May 2018. For further information, see Practice Note: Introduction to the EU GDPR and...

What is 'personal data' for the purposes of the Data Protection Act 1998?

What is 'personal data' for the purposes of the Data Protection Act 1998? For the purposes of the Data Protection Act 1998 (DPA 1998), 'personal data' is defined as: 'data which relate to a living individual who can be identified— (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual' This definition refers to several key terms which are further defined in DPA 1998. The term 'data' is defined to include information which: '(a) is being processed by means of equipment operating automatically in response to instructions given for that purpose (b) is recorded with the intention that it should be processed by means of such equipment (c) is recorded as part of a "relevant filing system" or...

See the 35 Q&As about Data Controller

Key takeaways from the ICO’s final anonymisation guidance

Information Law analysis: On 28 March 2025 the UK Information Commissioner’s Office (ICO) published its guidance on anonymisation and pseudonymisation under the UK GDPR (the Guidance). A long time coming, with drafts and sector-specific guidance published intermittently since 2021, the Guidance offers a practical response to addressing key concerns around compliant use of pseudonymised and anonymised data, especially in the context of data sharing, advanced analytics and modern technologies available to the ‘motivated intruder’. Written by Alex Jameson & Steph Ong of Bird & Bird

UK Government publishes Code of Practice for the cybersecurity of AI

Information Law analysis: It is common knowledge that a number of AI models were launched in 2023/2024 that have a transformational impact on our daily lives. At the same time, the current geopolitical situation has led to a less publicised, but still crucial, focus on cybersecurity. Recognising this, the UK Government published a call for views on the cybersecurity of AI focusing on the cybersecurity risks to AI, rather than the security risks caused by AI (which are also not insignificant). This led to the publication of the Code of Practice for the Cyber Security of AI on 31 January 2025 (the Code).

Read the latest 43 News articles on Data Controller