Disclosure—data protection and GDPR obligations
Produced in partnership with Linda Bazant of LRB Consult Ltd
Disclosure—data protection and GDPR obligations

The following Dispute Resolution guidance note Produced in partnership with Linda Bazant of LRB Consult Ltd provides comprehensive and up to date legal information covering:

  • Disclosure—data protection and GDPR obligations
  • Role of the CPR and GDPR during disclosure
  • Controllers and processors in the disclosure process
  • Personal data
  • Data protection principles
  • Disclosure of personal data in litigation
  • Data mapping
  • Data protection impact assessment (DPIA)
  • Legal professional privilege
  • Data subject access requests (DSARs)

Brexit: The UK's departure from the EU on exit day, ie Friday 31 January 2020, has implications for practitioners considering disclosure, data protection and GDPR. For guidance, see: Brexit—implications for data protection, No deal Brexit—CPR changes—Part 31—Disclosure and inspection and No deal Brexit—CPR changes—Part 78—European procedures.

This Practice Note considers the General Data Protection Regulation, Regulation (EU) 2016/679, (GDPR), the Data Protection Act 2018 (DPA 2018) and other data protection issues that should or may be considered during disclosure in civil proceedings. It looks at the collection and handling of personal data and special category data; data mapping including what controllers and processors should document, data protection impact assessments (DPIAs); the disclosure of personal data in litigation which covers the identification of documents, the position in relation to documents subject to legal professional privilege and data subject access requests (DSARs).

This Practice Note should be read in conjunction with Practice Notes:

  1. Dispute resolution—data protection and GDPR considerations—which considers the GDPR, DPA 2018 and other data protection issues that should or may be considered during dispute resolution proceedings

  2. Dispute Resolution—data protection and GDPR resources—for a guide to materials dealing with the GDPR in the dispute resolution context, the Practice Notes, Precedents, News Analyses and Legal Updates currently available

The GDPR became directly applicable on 25 May 2018 and introduced substantial amendments to EU and