Compliance planning

Copyright © 2025 LexisNexis

The challenge of complying with the UK General Data Protection Regulation (UK GDPR) should not be underestimated, nor should the consequences of failing to do so—the potential for fines of £17.5m or 4% of annual global turnover.

Does the UK GDPR apply to your business?

Assimilated Regulation (EU) 2016/679 (UK GDPR) applies to all organisations that handle personal data. As it is virtually impossible to operate a business without handling personal data, it's probably safe to assume your organisation is caught by the UK GDPR.

The GDPR also applies to organisations outside

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

Existing user? Sign-in TAKE A FREE TRIAL
Powered by Lexis+®
Latest Risk & Compliance News

NCA, OFSI and FCDO publishes Red Alert on Russian oil sanctions evasion network

The National Crime Agency (NCA), Office of Financial Sanctions Implementation (OFSI) and Foreign Commonwealth & Development Office (FCDO) have jointly published a Red Alert warning financial institutions about a sophisticated Russian oil sanctions evasion network. The alert details how the network operates through 'blue' companies interfacing with Western institutions and 'red' companies trading directly with Russian oil firms. It follows UK sanctions imposed on key network entities 2RIVERS DMCC and 2RIVERS PTE in December 2024, and NORD AXIS in May 2025. The alert provides red flag indicators to help identify potential sanctions breaches.

DUAA 2025—Key compliance takeaways in our latest Practice Note

The Data (Use and Access) Act 2025 (DUAA 2025), which received Royal Assent on 19 June 2025, introduces targeted amendments to the UK’s data protection regime. While most provisions await further regulation, compliance professionals in UK private sector organisations should take note of the implications of DUAA 2025 and prepare for phased implementation. To help you with this, we’ve published a new Practice Note explaining what’s changing, when and what you need to do about it.

US Treasury sanctions Aeza Group and affiliates for enabling cybercrime

The US Department of the Treasury's Office of Foreign Assets Control (OFAC) has designated Russia-based Aeza Group and its affiliates under Executive Order 13694 for providing bulletproof hosting services to cybercriminals. The action includes sanctions against two subsidiary companies and four senior executives. The measures target infrastructure supporting ransomware attacks, technology theft and illegal drug trading. The sanctions block all US-based property and interests of designated persons and prohibit US persons from transacting with them.

OFSI adds General Licence INT/2025/6275812 to expired licences

The Office of Financial Sanctions Implementation (OFSI) has added General Licence INT/2025/6275812 to its list of expired licences which had authorised the wind-down of positions involving St Petersburg Currency Exchange and Non-bank Credit Organisation Joint-Stock Company Petersburg Settlement Center under the Russian sanctions regime.

View Risk & Compliance by content type :  
News
Practice notes
Precedents
Q&As

Popular documents

Can I charge a fee for dealing with a data subject access request?

Can I charge a fee for dealing with a data subject access request?The General Data Protection Regulation (GDPR) provides for enhanced rights for data subjects including providing rights of rectification, erasure and restriction of processing, data portability, a right to object to processing and a

Priority between loss reliefs in loss making companies

Priority between loss reliefs in loss making companiesWhy does it matter?A company that is a member of a group and has incurred any of the types of losses available for surrender by way of group relief may, without any further rules, have more than one way in which to use the loss. There are a

What is the difference between an appeal and a review?

What is the difference between an appeal and a review?What is an appeal?An appeal in insolvency proceedings is no different to an appeal in normal litigation. An appeal will be allowed only if the appeal court is satisfied that the decision of the lower court was 'wrong' or 'unjust because of a

Can shares in a limited company that have not been paid-up at all be cancelled?

Can shares in a limited company that have not been paid-up at all be cancelled?A limited company having a share capital may not alter that share capital, except in the ways listed in section 617 of the Companies Act 2006 (CA 2006). Shares in a company cannot simply be cancelled without following an
Can I charge a fee for dealing with a data subject access request?

Can I charge a fee for dealing with a data subject access request?

Can I charge a fee for dealing with a data subject access request?The General Data Protection Regulation (GDPR) provides for enhanced rights for data subjects including providing rights of rectification, erasure and restriction of processing, data portability, a right to object to processing and a

Priority between loss reliefs in loss making companies

Priority between loss reliefs in loss making companies

Priority between loss reliefs in loss making companiesWhy does it matter?A company that is a member of a group and has incurred any of the types of losses available for surrender by way of group relief may, without any further rules, have more than one way in which to use the loss. There are a

What is the difference between an appeal and a review?

What is the difference between an appeal and a review?

What is the difference between an appeal and a review?What is an appeal?An appeal in insolvency proceedings is no different to an appeal in normal litigation. An appeal will be allowed only if the appeal court is satisfied that the decision of the lower court was 'wrong' or 'unjust because of a

Can shares in a limited company that have not been paid-up at all be cancelled?

Can shares in a limited company that have not been paid-up at all be cancelled?

Can shares in a limited company that have not been paid-up at all be cancelled?A limited company having a share capital may not alter that share capital, except in the ways listed in section 617 of the Companies Act 2006 (CA 2006). Shares in a company cannot simply be cancelled without following an