Q&As

View Risk & Compliance by content type:

Practice notes

Precedents

Q&As

Featured Risk & Compliance content

Money Laundering Regulations 2017—simplified due diligence

You may apply simplified customer due diligence (SDD) measures in relation to particular business relationships or transactions which you determine...

Facilitation payments under the Bribery Act 2010

Facilitating the performance of a duty by public officialsFacilitation payments, also known as facilitating or grease payments, are generally small...

What is a solicitor's undertaking?

An undertaking is a commitment by a solicitor to do something. It can be enforced against the solicitor by the courts. Failure to comply with an...

Dawn raid—who can raid my organisation and why?

The UK Government has legislated to permit a number of UK authorities to obtain search warrants to 'raid' a business premises. The potential for a...

Practice notes

Active bribery, passive bribery and bribing foreign public officials

The purpose of this Practice Note is to provide a general understanding of the offences under section 1, 2 and 6 of the Bribery Act 2010 (BA 2010). It...

Produced in partnership with Joanne Kane of Carmelite Chambers 9th Nov

Practice notes

High-risk third countries tracker

This Practice Note lists high-risk third countries identified by the Financial Action Task Force (FATF), HM Treasury and the European Commission as...

9th Nov

In-house

Practice notes

Getting the Deal Through: Merger Control 2021

Jurisdictions coveredThe following jurisdictions are covered in this report:Albania; Australia; Austria; Belgium; Bosnia and Herzegovina; Brazil;...

9th Nov

Precedents

Modern slavery: contract clauses

1DefinitionsModern Slavery Policy•means the Customer's anti-slavery and human trafficking policy as set out in Schedule [insert] as updated by the...

9th Nov

In-house

Practice notes

AML and counter-terrorist financing—source of funds

Source of funds and wealth was a key focus of the SRA’s Preventing Money Laundering and Financing of Terrorism thematic review, published in March...

9th Nov

In-house

Practice notes

Introduction to retained EU law

This Practice Note provides an introduction to retained EU law, which is an entirely new legal concept introduced to UK domestic law in preparation...

9th Nov

Brexit

Precedents

Standard contractual clauses—set II—controller to controller (Model Clauses)

DRAFTING FOR BREXIT: For the latest information on the impact of Brexit on the drafting, negotiation and enforceability of this Precedent, see...

9th Nov

Practice notes

Money Laundering Regulations 2017—nominated officer

This Practice Note sets out when organisations must appoint a nominated officer, the duties of the nominated officer and practical steps nominated...

9th Nov

In-house

Most recent Q&As content

Q&As

Which national data protection laws apply?

What is the legislative basis for determining applicable law?The provisions of art 4(1) of Directive 95/46/EC govern the application of a member...

29th Nov

Q&As

Can the Model Clauses be amended to limit or exclude the rights of a data subject?

Amending Model ClausesClause 10 of the 2010 Model Clauses provides that ‘The parties undertake not to vary or modify the Clauses. This does not...

29th Nov

Q&As

Does one need explicit consent to share personal data?

In answering this Q&A, we have assumed that all parties and data subjects are exclusively based in the UK, no overseas laws or regulation applies,...

29th Nov

Q&As

Is a search engine a data controller?

This question has been discussed in the case of Google Spain v Agencia Española de Protección de Datos (Google Spain) and also in guidelines...

29th Nov

Q&As

Under Article 3 of the General Data Protection Regulation, will all personal data processed ‘in the context of the activities of an establishment of a controller or a processor’ based in the EU fall under the regulation regardless if the personal data in question relates to EEA individuals or not?

The General Data Protection Regulation (EU) 2016/679 (the GDPR) applies in all EU Member States from 25 May 2018. Note that in answering this question...

Produced in partnership with Shobana Iyer of Swan Chambers 29th Nov

Q&As

Who is the data processor for the purposes of the Data Protection Act 1998?

The Data Protection Act 1998 (DPA 1998), provides that a data processor is any person, other than an employee of the data controller, who processes...

29th Nov

Q&As

What is the absolute time limit for responding to a subject access request?

Organisations of all types and sizes process data about a variety of people every day, particularly about staff and clients. Much of this will be...

29th Nov

Q&As

Can you provide any guidance for data transfer outside the EEA?

See the following content:•Standard contractual clauses—data controller to data processor in third country: Encyclopaedia of Forms and Precedents...

29th Nov

Q&As

What does an organisation need to do to update their marketing consent and opt-out notices to comply with the GDPR?

This Q&A naturally assumes the organisation is the data controller and has customers (or proposed customers) who are the data subjects.Organisations,...

Produced in partnership with Shobana Iyer of Swan Chambers 29th Nov

Q&As

Despite not being in effect until 25 May 2018, can you address the GDPR in contractual agreements now?

ImplementationThe General Data Protection Regulation, Regulation (EU) 2016/679, (the GDPR) came into force on 24 May 2016, but due to a two-year...

29th Nov

Q&As

What is sensitive personal data for the purposes of the Data Protection Act 1998?

Personal dataUnder section 1 of the Data Protection Act 1998 (DPA 1998), 'personal data' is defined as data which relate to a living individual who...

29th Nov

Q&As

How do I protect confidential information in the workplace?

What counts as confidential information? The legal definition of confidential information is information that is (i) confidential in nature, and (ii)...

29th Nov

Q&As

Who is a 'data controller' for the purposes of the Data Protection Act 1998?

For the purposes of the Data Protection Act 1998 (DPA 1998), a 'data controller' is defined as: 'a person who (either alone or jointly or in common...

29th Nov

Q&As

When drafting agreements that have data processing implications, do you need to take into account the provisions of the General Data Protection Regulation even though the provisions of that Regulation will not come into force until May 2018?

The General Data Protection Regulation, Regulation (EU) 2016/679, (the GDPR) represents the most significant development in data protection law for...

29th Nov

Q&As

When should I delete personal data?

Eight principles for handling personal information form the core of the Data Protection Act 1998 (DPA 1998) and any person or organisation that...

Produced in partnership with Ashley Roughton of Ipchambers.eu 29th Nov

Q&As

How do I develop a bring your own device (BYOD) policy?

Focus on the policy objective—protecting company informationThe objective of a BYOD policy should be to ensure company information is adequately...

29th Nov

Q&As

Following a proposed change in suppliers (for example, transferring to a new provider of outsourced services), is the data subject’s consent required when transferring personal data from one service provider to another?

Such a situation can arise, for example, in fulfilment, where supplies are made to a customer (the data subject if an individual) by the supplier on...

Produced in partnership with Ashley Roughton of Ipchambers.eu 29th Nov

Q&As

When do I need consent for data protection purposes?

BackgroundThe Data Protection Act 1998 (DPA 1998) requires all processing of personal data to be 'fair and lawful'. Additionally, that processing must...

29th Nov

Q&As

What is 'personal data' for the purposes of the Data Protection Act 1998?

For the purposes of the Data Protection Act 1998 (DPA 1998), 'personal data' is defined as: 'data which relate to a living individual who can be...

29th Nov

Q&As

Can we rely on the new Privacy Shield?

What is Privacy shield?On 29 February 2016, the European Commission announced draft details of the EU–US Privacy Shield to replace the Safe Harbour...

29th Nov