Get a good background to data protection law and view practical guidance focused on data protection matters for commercial transactions. See also our UK GDPR compliant pro-party clauses for use in commercial agreements.
Protect trade secrets and know-how using the law of confidentiality. Get information and a set of pro-party confidentiality agreements here.
View a range of trackers to enable horizon scanning and monitoring of key developments. The trackers are maintained - making them useful for keeping up-to-date and for business development.
It’s our online practical guidance product for contentious and non-contentious lawyers dealing with Data Protection, Confidential Information, Privacy, Cybersecurity and Freedom of Information issues.
The Information Commissioner's Office (ICO) has launched a call for evidence to inform its approach to applying data protection law to the distinctive...
This week’s edition of Information Law weekly highlights includes a hand-picked summary of news analysis, updates and new content related to laws...
MLex: The Roman Catholic Diocese of the Belgian city of Ghent must justify retaining baptismal data after an objection, a senior adviser to the EU’s...
Law360, London: Around 80 actors, performers and public figures backed the ‘Save Our Voices Now’ campaign, launched on 8 August 2026, calling for...
MLex: AI smart glasses from companies such as Meta and Snap are testing the reach of UK privacy rules. Existing laws can address many issues arising...
This Practice Note considers the implications of the Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA) being within the...
This Practice Note is intended for private-sector commercial organisations in the UK. It sets out expectations of the Information Commission’s Office...
What is BYOD?Bring your own device (BYOD) refers to arrangements where an organisation allows employees to connect to its corporate IT network using...
Organisations often overlook data protection by design and default (DPbDD) when they are considering their UK GDPR compliance obligations. This is...
This Practice Note explains the scope for relying on legitimate interests as a lawful ground for processing personal data under the UK General Data...
We take your privacy very seriously. Please read this privacy policy carefully as it contains important information on who we are and how and why we...
Definitions—to be integrated into relevant parts of the agreementAdequacy Regulation•means any valid adequacy regulation as referred to in Article 45A...
This Agreement is made on [date]Parties1[Insert name of supplier], a company incorporated in [England and Wales] under number [insert registered...
In briefChapter V (Transfers of personal data to third countries or international organisations) of the United Kingdom General Data Protection...
This Agreement is made on [insert date]Parties1[insert name] [of OR a company incorporated in [England and Wales] under number [insert registered...
The UK General Data Protection Regulation (UK GDPR)—NavigatorThis Practice Note serves as a reference guide to the Retained Regulation (EU) 2016/679...
Privacy law—misuse of private informationThe tort of misuse of private information is focused on ‘the protection of human autonomy and dignity—the...
Confidentiality agreement—mutualThis Agreement is made on [date]Parties1[insert name of party] [of [insert details ] OR a company incorporated in...
The Information Commissioner’s Office (ICO)The Information Commissioner’s Office (ICO) is the UK’s independent regulator designed to uphold...
The UK General Data Protection Regulation (UK GDPR)This Practice Note provides a summary of the UK GDPR regime. For a higher-level introduction to UK...
Letter of claim—breach of confidence[Insert name and address of recipient]Dear [insert organisation name],[Name of client] and confidential...
Trade secrets and confidential information—protection and enforcementThis Practice Note sets out the protection available for trade secrets and...
Introduction to the EU GDPR and UK GDPRThis Practice Note provides a high-level introduction to the EU’s General Data Protection Regulation,...
Data protection, privacy and confidential information case law trackerThis Practice Note tracks noteworthy High Court, Court of Appeal and Supreme...
Commercial use of photographs—data protection and privacy issuesThis Practice Note addresses issues affecting professional photographers taking...
Letter of claim—breach of data protection law[Insert name and address of recipient]Dear [insert organisation name],[Name of client] and breach of data...
What does IP completion day mean for Information Law? [Archived]ARCHIVED: This Practice Note has been archived and is not maintained.11 pm (GMT) on 31...
Confidential information, privacy and injunctionsThis Practice Note deals with the general principles of obtaining an injunction relating to...
The Data Protection Act 2018This Practice Note introduces the UK’s Data Protection Act 2018 (DPA 2018).For higher-level introductions to data...
There must be a clear and affirmative action by the user. Deeming that consent has been provided, for example by a user continuing to use a website (regardless of whether they been warned of the presence of cookies), is not sufficient. Pre-ticked boxes, sliders that are set to ‘on’, or any equivalent mechanism that is intended to provide consent by default is not adequate.
Public authorities and public bodies often carry out activities involving personal data. The terms ‘public authority’ and ‘public body’ are used throughout the GDPR regimes, including within several of the definitions, but are not expressly defined. The EDPB considers that under the EU GDPR: • these notions are broad enough to include both public bodies in third countries and ‘international organisations’ (ie an organisation and its subordinate bodies governed by public international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries) • with respect to public bodies in third countries, the notion is to be determined under domestic law • public bodies include government authorities at different levels (eg national, regional and local authorities) and also other bodies governed by public law (eg executive agencies, universities, hospitals and so on)
Tracking pixels (also known as single-pixel gifs, web beacons and web bugs) are small-graphics files incorporated into a website or an email. They display an image, usually the size of a single pixel, that is invisible to the user. When a user’s browser reads the code of the website it communicates with the operator’s server in order to display the image and, through this process, the operator is able to acquire information such as technical specifications of the device, operating systems and settings being used. It can also track a user’s activities during a session. Tracking pixels can be particularly useful for analysing direct marketing campaigns by email by providing data on how recipients opened an email. For the same reason, they can also be used by spammers to ascertain whether an email address is valid.