Information security

Copyright © 2025 LexisNexis

Information security has become a business-critical issue. It is not something you can tackle in isolation, as there are obvious overlaps with cybersecurity and data protection.

Identifying what information you hold

There are a number of management tools you can use to identify what information you hold and are legally responsible for, such as an information audit.

An information audit is a process through which you:

  1. •

    identify and consider all of the information you hold (or are responsible for), and

  2. •

    consider how and why the information is processed

To undertake an effective audit, you need to consider each class of information you hold and, for each

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

Existing user? Sign-in TAKE A FREE TRIAL
Powered by Lexis+®
Latest Risk & Compliance News

Debut UK corporate tax evasion prosecution sends message despite dearth of cases

MLex: A UK accounting firm is the first to face prosecution for failure to prevent tax evasion, eight years after the offence was written into UK law. While the law may have changed some companies’ behavior, the case highlights questions over a lack of enforcement so far. But it could help to re-focus compliance efforts: ‘It’s a big moment. It will re-energise those conversations with corporates, Simon York, the former lead fraud prosecutor at the UK tax authority told MLex.

ICO launches consultation on new data protection complaints handling guidance

The Information Commissioner's Office (ICO) has launched a consultation seeking feedback on new draft guidance for organisations handling data protection complaints. The guidance explains requirements introduced by the Data (Use and Access) Act, which amends the Data Protection Act 2018 through section 164A. The amendments require organisations to implement complaint mechanisms, acknowledge complaints within 30 days, respond appropriately without undue delay and inform complainants of outcomes. The consultation closes on 19 October 2025 and aims to clarify compliance requirements before final publication.

ICO launches consultation on UK GDPR recognised legitimate interest guidance

The Information Commissioner's Office (ICO) has launched a consultation to gather feedback on its draft guidance regarding the recognised legitimate interest basis for data processing. This guidance addresses the provisions introduced by the Data (Use and Access) Act 2025 (DUAA), which amends the UK GDPR, even though these provisions are not yet in force.

ICO launches consultation on recognised legitimate interests guidance for public authorities

The Information Commissioner’s Office (ICO) has launched a public consultation on draft guidance covering the recognised legitimate interest basis for requesting personal information in support of public tasks or official functions. This guidance is intended solely for public authorities and similar bodies that request voluntary data sharing from other organisations to fulfil their public responsibilities. It forms part of the recognised legitimate interest framework introduced by the Data (Use and Access) Act 2025 and is distinct from the broader guidance on recognised legitimate interest, which is also under consultation. The consultation runs until 30 October 2025.

View Risk & Compliance by content type :  
News
Practice notes
Precedents
Q&As

Popular documents

If a rentcharge is shown as being informally exonerated on title information, does this apply to the

If a rentcharge is shown as being informally exonerated on title information, does this apply to the current registered owner? Or does the informal exoneration only apply to the parties to the document which informally exonerated the rentcharge?This Q&A considers the situation where, at some

Contributory negligence in personal injury claims

Contributory negligence in personal injury claimsContributory negligence is a partial defence which can lead to a discount in damages.Other defences may also be relevant. See Practice Notes: Did the claimant consent to the risk of injury? and Was the claimant involved in an illegal activity?If a

Can shares in a limited company that have not been paid-up at all be cancelled?

Can shares in a limited company that have not been paid-up at all be cancelled?A limited company having a share capital may not alter that share capital, except in the ways listed in section 617 of the Companies Act 2006 (CA 2006). Shares in a company cannot simply be cancelled without following an

Template for regulatory references given by SMCR firms and disclosure requirements

Template for regulatory references given by SMCR firms and disclosure requirements[Insert addressee details]Dear [insert name][It is our understanding that [insert name of prospective employee] [was an employee of yours between the dates of [insert dates as appropriate] OR is a current employee of
If a rentcharge is shown as being informally exonerated on title information, does this apply to the

If a rentcharge is shown as being informally exonerated on title information, does this apply to the

If a rentcharge is shown as being informally exonerated on title information, does this apply to the current registered owner? Or does the informal exoneration only apply to the parties to the document which informally exonerated the rentcharge?This Q&A considers the situation where, at some

Contributory negligence in personal injury claims

Contributory negligence in personal injury claims

Contributory negligence in personal injury claimsContributory negligence is a partial defence which can lead to a discount in damages.Other defences may also be relevant. See Practice Notes: Did the claimant consent to the risk of injury? and Was the claimant involved in an illegal activity?If a

Can shares in a limited company that have not been paid-up at all be cancelled?

Can shares in a limited company that have not been paid-up at all be cancelled?

Can shares in a limited company that have not been paid-up at all be cancelled?A limited company having a share capital may not alter that share capital, except in the ways listed in section 617 of the Companies Act 2006 (CA 2006). Shares in a company cannot simply be cancelled without following an

Template for regulatory references given by SMCR firms and disclosure requirements

Template for regulatory references given by SMCR firms and disclosure requirements

Template for regulatory references given by SMCR firms and disclosure requirements[Insert addressee details]Dear [insert name][It is our understanding that [insert name of prospective employee] [was an employee of yours between the dates of [insert dates as appropriate] OR is a current employee of