This Practice Note summarises the Deferred Prosecution Agreement Code of Practice published by the Serious Fraud Office (SFO) and Crown Prosecution Service (CPS) on the use and negotiation of deferred prosecution agreements (DPAs). This is known as the DPA Code of Practice. For detailed guidance on what DPAs are, who might obtain one and what offences they are available for as well as how they are being deployed in practice, see Practice Notes: Deferred prosecution agreements, DPAs in practice and Financial penalties as a term of a DPA. What does the DPA Code of Practice mean for prosecutors? The DPA Code of Practice was issued by the SFO and CPS in accordance with the Schedule 17 Part 1, para 6(1) of the Crime and Courts Act 2013. Designated prosecutors (currently only the SFO and CPS) must have regard to the DPA Code of Practice when they are: • negotiating a DPA with an organisation whom the prosecutor is considering charging for an offence specified in CCA 2013 • applying to the court for the approval of a DPA,

Which organisations will be suitable for DPA negotiations The Deferred Prosecution Agreement Code of Practice (DPA Code) for prosecutors is intended to guide prosecutors through the process of a deferred prosecution agreement (DPA) and provide a framework within which DPAs will operate. It is important that lawyers are familiar with it to ensure that the procedure is correct and that their client organisation is negotiating on a proper basis and properly represented at each stage. See Practice Notes: Deferred prosecution agreements and DPA Code of Practice. When dealing with the Serious Fraud Office (SFO), the DPA Code should be read in conjunction with the SFO’s Corporate Guidance. These documents are intended to assist organisations in understanding what will be expected of them in order for their work to count as co-operation for the purposes of a DPA. For further information, see Practice Notes: Corporate co-operation guidance for organisations seeking a DPA and Summary of SFO's guidance and policies. The test to be satisfied in order for a DPA to be granted judicial approval in the UK courts is set out

Court's oversight of the interests of justice and fairness, reasonableness and proportionality The UK deferred prosecution agreement (DPA) regime provides for judicial oversight of DPAs. After negotiations as to the terms of a DPA have commenced and before it has been concluded, the court must determine: • whether it is likely to be in the interests of justice, and • that its proposed terms are fair, reasonable and proportionate Therefore, each factor must be supported by clear and persuasive proof in order to seek to persuade the court to approve the DPA. The declarations given under Schedule 17 Part 1, para 8 to the Crime and Courts Act 2013 (CCA 2013) provide insight into the court's approach as to when a DPA is suitable and this has, in turn, fed into the prosecutor's approach (see Practice Note: The SFO's approach to Deferred Prosecution Agreements (DPAs) [Archived]). For detailed information on DPAs in general, the process followed by the court when considering whether to approve an agreement and the cases in which DPAs have been agreed to date,

A Deferred Prosecution Agreement (DPA) is a voluntary agreement between an organisation and a designated prosecutor which enables the prosecutor to defer a criminal prosecution by staying an indictment on specific terms agreed with the organisation (see Practice Note: Deferred prosecution agreements). It is therefore an alternative to prosecution. It involves: • the prosecutor inviting the organisation to enter into negotiations for a DPA • the organisation agreeing to comply with a range of terms and conditions which are monitored • the prosecutor agreeing to start but then halt criminal proceedings for the alleged offence • the prosecutor applying to the court for approval of the DPA No proceedings in relation to the matters covered by the DPA may be instituted against the organisation while the DPA remains in force and is complied with. Should the organisation breach the terms of the DPA, the prosecutor can apply to the court to restart the original criminal prosecution. DPAs are only available to organisations in respect of the offences specified under the Schedule 17 of the

Deferred Prosecution Agreements (DPAs) have been available since 24 February 2014, when the Crime and Courts Act 2013 (CCA 2013) came into force, see Practice Note: Deferred prosecution agreements. The decision to offer a DPA rests with the designated prosecutor who can only offer them to bodies corporate, partnerships or unincorporated associations, and not individuals. The purpose of this note is to provide companies and their representatives with some practical advice as to when a DPA may be available, and how they can put themselves, or their clients, in the best possible position when seeking a DPA. For further information on what the DPAs are and how and when they can be used, see Practice Notes: Deferred prosecution agreements, Terms and content of a DPA and The SFO's approach to Deferred Prosecution Agreements (DPAs) [Archived]. For further information on when a DPA is permitted to be entered into, see Practice Notes: Deferred prosecution agreements—How is a DPA reached? and DPA Code of Practice. DPAs made to date For a record of DPAs made to date including

The Data Protection Commission (DPC) has engaged extensively with technology companies regarding the use of personal data to train large language models in the EU/EEA, with a particular focus on Meta’s proposed projects. The DPC initially identified several issues with Meta’s plans to utilise public content from Facebook and Instagram for AI training, and after communicating concerns, Meta temporarily paused its project. In pursuit of regulatory harmonisation, the DPC also consulted its European Data Protection Board (EDPB) peers to obtain a formal Regulation (EU) 2016/679 (General Data Protection Regulation )(GDPR)) Opinion on key aspects of AI model training and deployment, which provided supervisory authorities with general compliance criteria.

This approval form summarises the basis on which the project outlined in your [ data protection impact assessment (DPIA) OR privacy impact assessment (PIA)] is approved, and the data protection compliance measures you must put in place. The final [DPIA OR PIA] is attached and contains full details of the advice summarised below—you should review both documents carefully before implementing your project. Please contact [insert relevant point of contact, eg your organisation’s data protection officer (DPO) or data protection manager (DPM)] if you require any further information. 1 Project overview Project name [Insert project name] Project

This Flowchart is designed to help you identify whether you must complete a data protection impact assessment (DPIA) when starting a new project involving personal data. It reflects: • three circumstances under which a DPIA is compulsory under Article 35(3) of Assimilated Regulation (EU) 2016/679, UK General Data Protection Regulation (UK GDPR); and • a further ten types of processing for which the Information Commissioner’s Office (ICO) mandates that a DPIA must be conducted In circumstances where a DPIA is not required, you should consider conducting a simpler type of assessment, which we have called a privacy impact assessment (PIA). This Flowchart will help you establish which assessment (DPIA or PIA) is most suitable for your project. For more guidance on DPIAs and PIAs, see Practice Note: How to complete a data protection impact assessment—DPIA. See also Precedents: • Data protection impact assessment—DPIA and Data protection

The Digital Property Market Steering Group (DPMSG) has asked property practitioners to participate in a short survey on the value of developing a digital property information protocol. The purpose of the protocol would be to help improve the home moving, buying and selling process through encouraging the use of digital processes and helping action upfront information. It would lay out stakeholders' roles and responsibilities in the adoption of digital property information and digital solutions across all sectors. The survey closes on 1 April 2024.

Under Assimilated Regulation (EU) 2016/679, the General Data Protection Regulation (UK GDPR), certain organisations are required to appoint an individual to act as their data protection officer (DPO). The appointment can be internal, eg an employee of the organisation, or external, eg a consultant under a service contract. This DPO appointment decision tree will help you determine whether your organisation needs to appoint a DPO under the requirements of the UK GDPR. If your organisation has operations in jurisdictions outside the UK, you will also need to check whether local law or regulations require you to appoint a DPO in any of those jurisdictions. For more information on the

Pensions analysis: The Deputy Pensions Ombudsman (DPO) has partially upheld a complaint from an employer about a section 75 debt in a multi-employer pension scheme which arose following the incorporation of a personal plumbing business. Martin Scott of gunnercooke LLP looks at the decision.

Pensions analysis: The Deputy Pensions Ombudsman (DPO) has rejected a complaint about a personal pension scheme’s fees and transparency of its fee schedule. Martin Scott of gunnercooke LLP looks at the decision.