Data protection essentials

Data protection laws in both the UK and EEA (the EU plus Iceland, Norway, and Liechtenstein) are intended to ensure information about living individuals (within the definition of ‘personal data’) is used fairly and responsibly.

To help ensure that, both the UK and EEA data protection laws impose a large number of obligations on those ‘processing’ personal data (and on controllers of such processing) and grant rights to those whose personal data is processed (the ‘data subjects’). In summary, ‘processing’ includes doing almost anything with personal data, including storing, sharing, deleting or using it.

UK data protection law is largely derived from EEA data protection laws and is therefore generally based on similar principles, although there are some detailed differences.

This subtopic provides certain core resources commonly required by commercial lawyers when addressing UK and EEA data protection laws under:

•
the EU’s General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR) regime, which applies under the

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

TAKE A FREE TRIAL

Latest Public Law News

Law Commission launches 14th Programme with ten new reform projects

The Law Commission of England and Wales has published its 14th Programme of Law Reform on 4 September 2025, announcing ten new projects spanning criminal, commercial, property and public law. The programme, developed following 500 consultation submissions, includes reforms to agricultural tenancies, commercial leasehold, consent in criminal law, deeds, insanity defence, corpse desecration, housing estate management, ownerless land, product liability and public sector automated decision-making. These projects will run alongside 17 existing initiatives, with the Commission aiming to modernise and simplify the law while ensuring it remains fair and cost-effective. The programme requires parliamentary approval before implementation, with project timelines to be announced.

MoJ updates guidance on creating and amending criminal offences and penalties

The Ministry of Justice (MoJ) has published updated guidance for government officials on creating or amending criminal offences and penalties, replacing the former ‘Making new criminal offences’ guidance. The updated document provides an overview of the matters that must be considered before seeking Cabinet Committee approval for the creation or amendment of criminal offences or penalties.

Defence Committee launches inquiry into MoD Afghan data breach and resettlement schemes

The Defence Committee has launched an inquiry to assess the Ministry of Defence (MoD)’s Afghan data breach of February 2022 and the subsequent resettlement schemes. The inquiry follows the July 2025 lifting of a High Court superinjunction that had suppressed information about the breach since September 2023. The inquiry will examine the circumstances of the breach, which exposed the personal data of thousands of Afghan applicants, review the government’s use of legal injunctions, assess information security protocols and risk management procedures and evaluate the planning and delivery of resettlement efforts. Written evidence must be submitted by 14 October 2025.

Latest consultation on public procurement reform closes 5 September 2025

The Cabinet Office has issued a reminder that its consultation on further public procurement reforms closes at 5pm on 5 September 2025. The consultation opened on 26 June 2025 and outlines plans for further reforms to the public procurement regime, building on the reforms introduced by the Procurement Act 2023 (PA 2023). The Cabinet Office says that the consultation aims to inform the development of future primary legislation amending PA 2023 ‘when parliamentary time allows’.