Monitoring Definition

View the related checklists about Monitoring

EU operational resilience—timeline

EU operational resilience—timeline This timeline shows key developments relating to EU operational resilience requirements for financial services firms from January 2024 onwards. For earlier developments, see Operational resilience—timeline [Archived] 2025 Date Source Document Description 15 April 2025 FSB FSB finalises the common Format for Incident Reporting Exchange (FIRE) The Financial Stability Board (FSB) has published its finalised format for incident reporting exchange (FIRE), which aims to standardise and streamline cyber and operational incident reporting. Developed with private sector collaboration, FIRE addresses fragmentation in reporting requirements across multiple jurisdictions and supports phased implementation. It is interoperable with existing systems and applicable to a wide range of incidents, including those involving third-party service providers. The initiative promotes convergence in cyber incident reporting, reduces the reporting burden for firms, and improves communication among authorities.See: LNB News 15/04/2025 37. 24 March 2025 European Commission COMMISSION DELEGATED REGULATION (EU) …/... supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the elements that a financial...

Internet and electronic communications—checklist

Internet and electronic communications—checklist Required document or action Compliant? 1 Do you have a written Policy on internet, email and communications describing permitted and prohibited use of:—the internet—your electronic communications system (emails and telephone)? 2 Do you have a Policy on social media? 3 Do you have a separate Policy—data protection covering any data processing activities that may arise from use of the internet and your electronic communications system? 4 Do you intend to monitor how your staff use the internet and/or your electronic communications system? See Practice Note: Monitoring staff, IT and communications systems in the workplace. 5 If so, have you conducted a data protection impact assessment (see subtopic: Data protection impact assessments—DPIAs)? 6 Do any of your monitoring activities amount to intercepting an electronic

View the related flowcharts about Monitoring

DPIA or PIA screening—decision tree

DPIA or PIA screening—decision tree This Flowchart is designed to help you identify whether you must complete a data protection impact assessment (DPIA) when starting a new project involving personal data. It reflects: • three circumstances under which a DPIA is compulsory under Article 35(3) of Assimilated Regulation (EU) 2016/679, UK General Data Protection Regulation (UK GDPR); and • a further ten types of processing for which the Information Commissioner’s Office (ICO) mandates that a DPIA must be conducted In circumstances where a DPIA is not required, you should consider conducting a simpler type of assessment, which we have called a privacy impact assessment (PIA). This Flowchart will help you establish which assessment (DPIA or PIA) is most suitable for your project. For more guidance on DPIAs and PIAs, see Practice Note: How to complete a data protection impact assessment—DPIA. See also Precedents: • Data protection impact assessment—DPIA and Data protection impact assessment—DPIA—short form • Privacy impact assessment Note 1 A DPIA is compulsory in the...

Information security—flowchart

Information security—flowchart Information security has become a business-critical issue. It is not something you can tackle in isolation, as there are obvious overlaps with cyber security and data protection. This Flowchart sets out a logical process for reviewing and addressing your information security requirements. The notes below the Flowchart signpost relevant Precedents. Note 1: identify information See Precedent: Information audit form. Alternatively, you may already hold all relevant data in a Data and information register, in which case there is no point duplicating the exercise. Note 2: assess information risks See Precedent: Data protection risk assessment—short form. Alternatively, you may have already undertaken a detailed Data protection risk assessment, which may be adequate for your purposes. Note 3: secure the information Precedent: Information security review encourages you to conduct a comprehensive review of your procedural and technological arrangements for securing information and

View the related practice notes about Monitoring

Managing conflicts of interest in pensions

Managing conflicts of interest in pensions THIS PRACTICE NOTE APPLIES TO TRUST-BASED OCCUPATIONAL PENSION SCHEMES Legal requirements in relation to conflicts of interest Pension scheme trustees have a duty to act in the best interests of the scheme's beneficiaries. However, trustees may owe duties to other parties or have personal interests which conflict with that duty. It is a general principle of trust law that trustees should not put themselves in a position where their duty to act in the best interests of beneficiaries conflicts with duties that they owe to other parties or with their personal interests. If trustees make decisions while subject to a conflict of interest that has not been appropriately managed, there is a risk that those decisions may be challenged by scheme members or overturned by the courts. It is important that the members of a scheme should perceive a conflict or potential conflict as having been properly managed. The directors of a company that acts as a trustee of a...

Social media and user-generated content

Social media and user-generated content This Practice Note examines some of the key risks associated with a brand’s usage of social media and user-generated content (UGC). Its particular focus is on the potential infringement of third party rights, such as intellectual property (IP). It provides practical guidance on how parties engaged in such activities can mitigate those risks. Social media Social media is an extremely popular means of communicating online. Based on user participation and interaction, social media takes a variety of forms, including: • online social and business networking (eg Facebook, LinkedIn, Snapchat, Instagram) • online blogs (eg Twitter (now X), Blogger.com) • online forums (eg Mumsnet, Reddit) • online shops and auctions (eg eBay, Amazon) • online digital media sharing (eg YouTube, Vimeo, Flickr, TikTok) • online reference texts (eg Wikipedia) • online games and applications (eg World of Warcraft) User-generated content Increasingly, businesses are encouraging consumers to contribute material to social media platforms and are incorporating these contributions into consumer-focused advertising and marketing campaigns. Often, this might...

View the related precedents about Monitoring

Ireland—data protection impact assessment—artificial intelligence

Ireland—data protection impact assessment—artificial intelligence DPIA screening questionnaire The screening questionnaire should be a concise document and not overly burdensome on the business. However, it needs to provide sufficient information to the DPO/Privacy POC to decide if a DPIA needs to be completed. Like the DPIA itself, the screening questionnaire will be drafted by a multidisciplinary team within the business. All completed screening questionnaires should be approved, time stamped and retained by the DPO/Privacy POC. Where a DPIA is required, it should be kept with the screening questionnaire to avoid duplication. The DPIA template is a continuation of the screening questionnaire. While the screening questionnaire and the DPIA detail AI use in accordance with EU GDPR requirements, companies deploying AI systems also need to factor in their obligations under additional relevant legislation, such as the requirement to carry out a fundamental rights impact assessment (FRIA) under the EU AI Act. While outside the scope of this document, information gathered as part of the screening questionnaire / DPIA exercise will be...

Data breach monitoring record

Data breach monitoring record 1 General information Date of monitoring review [insert date] Person conducting monitoring review [insert name and job title] 2 Volume of data breaches identified and reported Review your Data breach register for the past 12 months and complete the information below. Category Over the last 12 months Suspected data security breaches [insert number of suspected data security breaches] Actual data security breaches [insert number of actual data security breaches] [Reports to [insert name of any relevant regulator or trade body]] [[insert number of reports sent to relevant regulator or trade body]] Reports to the ICO (involving actual or suspected data security breaches) [insert number of reports sent to the ICO] Data subjects notified of actual or suspected data security breaches [insert number of data subjects notified of actual or suspected data security breaches] Reports to the police (involving actual or suspected data security breaches) [insert number of reports sent to the police] Insurer notifications (involving actual or suspected data security breaches) [ Professional...

View the related q&as about Monitoring

Company A and Company B are co-investors into ProjectCo. Is Company A required/entitled to carry out KYC checks on ProjectCo's directors nominated by Company B, and if so what information can Company A request?

Company A and Company B are co-investors into ProjectCo. Is Company A required/entitled to carry out KYC checks on ProjectCo's directors nominated by Company B, and if so what information can Company A request? ‘Relevant persons’ for the purpose of the Money Laundering Regulations 2007 (MLRs) The Money Laundering Regulations 2007, SI 2007/2157 (MLRs 2007) apply to the following legal or natural persons acting in the course of business carried on by them in the UK as defined in MLR 2007, SI 2007/2157, reg 3: • credit institutions • financial institutions • auditors, insolvency practitioners, external accountants and tax advisers • independent legal professionals • trust or company service providers • estate agents • high value dealers • casinos MLR 2007, SI 2007/2157, reg 4 outlines exclusions to the rule and discusses a range of persons and activities. It may also be useful to view Practice Note: Introduction to the UK AML/CTF legal and regulatory framework for financial services for further insight. Customer due diligence As required by...

Under the new General Data Protection Regulation, can a law firm (or a solicitor within a law firm) be appointed as data protection officer on behalf of its client/clients if it can satisfy the requirements as to expertise etc?

Under the new General Data Protection Regulation, can a law firm (or a solicitor within a law firm) be appointed as data protection officer on behalf of its client/clients if it can satisfy the requirements as to expertise etc? Article 37(1) of Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), introduces a requirement that businesses must appoint a Data Protection Officer (DPO) where: • the processing is carried out by a public authority or body (except for courts acting in their judicial capacity) • 'the core activities of the controller or the processor consist of processing operations which require regular and systematic monitoring of data subjects on a large scale', which would, for example, include businesses engaging in online profiling or targeting activities, or • the controller's or processor's core activities consist of processing on a large scale of 'special categories of data’ and personal data relating to criminal convictions and offences Businesses to whom the above criteria do not apply may still decide to...

View the related News about Monitoring

Environment Agency releases scoping review to inform future airborne PFAS regulation

The Environment Agency’s recent scoping review, published on 27 May 2025, provides important insights into the behaviour of airborne polyfluoroalkyl substances (PFAS)—including perfluorooctanoic acid (PFOA), 6:2 Fluorotelomer alcohol, and Perfluoro(2-ethoxy-2-fluoroethoxy)-acetic acid ammonium salt—released from various industrial sources. Drawing from 15 studies, the report emphasises significant challenges in monitoring these substances due to their occurrence in both gaseous and particulate states. UK data from Hazelrigg reveal that high PFOA levels recorded during 2005–06 substantially declined by 2021, with improved emission controls attributed as the primary cause. The review further notes that PFAS deposition occurs mainly via precipitation, with dispersion patterns influenced by weather conditions and chemical transformations in the air. The review also identifies critical knowledge gaps, such as the need for standardised analytical methods and increased UK-based monitoring, which are essential for guiding future regulatory measures and mitigation strategies in the water sector.

Independent Water Commission publishes interim report on water sector regulatory reform

The Independent Water Commission (IWC) has published an interim report outlining its preliminary conclusions on reforming the regulatory system for the water sector in England and Wales. The report, which follows the IWC’s February 2025 call for evidence, identifies five key areas requiring substantial reform: (1) strategic direction and planning; (2) the legislative framework; (3) regulatory reform; (4) company structures, ownership, governance, and management; and (5) infrastructure and asset health. The IWC is expected to submit its final report to the UK and Welsh governments in summer 2025.