Data protection essentials

Data protection laws in both the UK and EEA (the EU plus Iceland, Norway, and Liechtenstein) are intended to ensure information about living individuals (within the definition of ‘personal data’) is used fairly and responsibly.

To help ensure that, both the UK and data protection laws impose a large number of obligations on those ‘processing’ personal data (and on controllers of such processing) and grant rights to those whose personal data is processed (the ‘data subjects’). In summary, ‘processing’ includes doing almost anything with personal data, including storing, sharing, deleting or using it.

UK data protection law is largely derived from EEA data protection laws and is therefore generally based on similar principles, although there are some detailed differences.

This subtopic provides certain core resources commonly required by commercial lawyers when addressing UK and EEA data protection laws under:

•
the EU’s General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR) regime, which applies under the laws of

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

TAKE A FREE TRIAL

Latest Life Sciences News

MedTech Europe warns European Commission about risks of medical import tariffs

MedTech Europe and various medical associations have issued an open letter to the European Commission President, Ursula von der Leyen, expressing concerns over potential new trade tariffs on medical technology imports. The letter requests exclusion of medical technology from any new trade defence measures, citing risks to European healthcare systems' supply chains and costs. The association emphasises the need to protect the EU medical technology sector's competitiveness while maintaining access to essential healthcare products.

Main challenges of EU AI Act-GDPR interplay identified by Member States

MLex: Potentially conflicting legal requirements, national governance approaches to ensure regulatory consistency, as well as clear legal advice to minimise the compliance burden, are the main issues seen by EU Member States in the interplay between the EU AI Act and the EU’s General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR). European governments have pointed out that the two laws' diverging regulatory approaches might lead to conflicting outcomes, which should be avoided with systematic cooperation between the responsible authorities.

Where there's no waiver, there's no way (Barclays Bank plc v VEB.RF)

Commercial analysis: The English High Court has provided further guidance on the interpretation of ‘no waiver’ clauses in a recent decision. The backdrop to this decision was a sanctions related dispute about the termination of a currency swap agreement between two banks, one of which was Russian, the other English. The agreement had a dispute resolution clause where the forum was arbitration unless the English bank gave notice that a dispute should be heard by the English courts. Pamela Vassil, lawyer at A&O Shearman, examines the court’s decision.

HRA publishes updated health and social care research model agreements

The Health Research Authority (HRA) has published updates to its Model Commercial Chief Investigator Agreement (mCCIA) and Model Confidential Disclosure Agreements (mCDAs). These model agreements are used in health and social care research throughout the UK and must be used from 28 April 2025. These amends form part of the HRA's UK Clinical Research Delivery programme which aims to develop and mandate an efficient and streamlined single UK standardised commercial contracting process to reduce unnecessary negotiation. The HRA now aims to update the model commercial site agreements for publication in May 2025.