Project [insert name]: Data room rules These rules (Rules) regulate the manner in which [insert name of the seller] (the Seller) grants potential buyers and their advisers access to the data room (Data Room) containing information and documents (Information) relating to the proposed sale of [the entire issued share capital OR the assets and undertaking] of [insert name of company or business] (the Proposed Transaction). By way of consideration for their use of the Data Room, potential buyers (Potential Buyers, of which each is a Potential Buyer) shall agree to be bound by these Rules and shall procure that each of their officers, employees, agents and advisers attending the Data Room (Visitors, of which each is a Visitor) shall comply with and be bound by these Rules. These Rules shall apply to each and every occasion on which Visitors visit the Data Room. 1 Location The Data Room is located at [insert address] or such other location notified to Visitors from time to time. 2 Confidentiality 2.1 Each Potential Buyer agrees that the Information made available in the Data Room constitutes confidential

Project [insert name]: Virtual data room rules These rules (Rules) regulate the manner in which [insert name of the seller] (the Seller) grants potential buyers and their advisers access to the virtual data room (VDR) containing information and documents (Information) relating to the proposed sale of [the entire issued share capital OR the assets and undertaking] of [insert name of company or business] (the Proposed Transaction). The VDR shall be provided and maintained by [insert name of VDR provider] (the VDR Provider). By way of consideration for their use of the VDR, potential buyers (Potential Buyers, of which each is a Potential Buyer) shall agree to be bound by these Rules and shall procure that each of their officers, employees, agents and advisers accessing the VDR shall comply with and be bound by these Rules. These Rules shall apply to each and every occasion on which the VDR is accessed by, or on behalf of, any Potential Buyer. 1 Provision of VDR 1.1 The VDR will be managed and supported by the VDR Provider and

This Practice Note, which applies to both share purchase and asset purchase transactions, explains: • the differences between a physical data room (a room filled with documents in a set location) (PDR) and a virtual data room (an online data repository to which documents are uploaded) (VDR) and the factors involved in choosing which of the two to use • a summary of the key organisational issues for the seller and the seller's team of advisers to consider when setting up a data room, including how to decide what to include and how to organise the data room, and • the documentation which should be drafted by the seller/seller's advisers and executed by those accessing the data room (namely a confidentiality agreement and data room rules) Different data room procedures will apply depending on whether a PDR or VDR is being used, but the rationale for setting up a data room is the same in both instances. It will be important for the seller to identify appropriate senior individuals within its/the target's organisation to provide

Defined in CPR PD 31B para 5(1) as the process of checking data by identifying and checking representative individual documents

UK GDPR This Practice Note provides an overview of the data protection issues to consider under the UK General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR) where personal data is shared in connection with the formation or ongoing business of a joint venture or the investment in a private equity fund. As part of a joint venture transaction, personal data may be shared between potential joint venture parties as part of their due diligence prior to entry into a joint venture or between joint venture parties in an existing joint venture and a party considering joining such joint venture as part of its due diligence. Additionally, once a joint venture is set up, the joint venture parties may continue to provide personal data (between themselves and possibly to the joint venture company (JVC)) to further the business of the JVC. For the purposes of this Practice Note, it is assumed that the relationship between the joint venture parties sharing personal data following formation of the joint venture would be that

Law360: Only 68% of pension scheme members who have transferred from a defined benefit (DB) to a defined contribution (DC) scheme in the last four years are happy with their choice, analysis shows.

Under the GDPR, an identified or identifiable natural person. The concept is key to determining what is personal data (ie information relating to a data subject) and which persons have rights under the GDPR.

Ask for copies of your data You have the right to ask for copies of your personal data we store and use. This is your right of access, also known as making a data subject access request or ‘DSAR’. We will normally respond within one calendar month of receiving your request. There may be times where we need longer or we may need to charge a reasonable fee for admin costs. We will let you know if this is the case. You do not have to use this form to ask for copies of your data, but it is helpful for us to know what you’re looking for so we can respond fully and promptly. You can use this form to request access to personal data on behalf of someone else. In that case, we will need you to confirm you have that person’s authority to ask for access to their data. Please send your completed form to us using the contact details at section 7. You can also use these contact

Assimilated law is the name given to retained EU law which remains in force after the end of 2023. For further information, see Practice Note: Assimilated law. This Practice Note provides guidance on an individual’s rights as a data subject in the employment context. It reflects the UK GDPR regime, and legislative links are to Assimilated Regulation (EU) 2016/679, UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 (DPA 2018), unless expressly stated otherwise. It takes into account provisions of the Data (Use and Access) Act 2025 (DUAA 2025) in force as at 5 February 2026 (see Practice Note: Data (Use and Access) Act 2025—employment implications). Updated guidance from the Information Commissioner’s Office (ICO) is still awaited. For an overview of the key themes of Assimilated Regulation (EU) 2016/679, UK GDPR and DPA 2018 and guidance on particular issues of relevance to employment lawyers, see Practice Notes: • The UK GDPR and DPA 2018: key data protection issues for employment lawyers, and • The UK GDPR and DPA 2018: lawful processing of

Dispute Resolution analysis: A recent first instance decision, on remission from the claimants’ successful appeal to the Court of Appeal: see [2017] EWCA Civ 74 [2017] 1 WLR 28, serves to underscore the scope and thus potential in specific litigation contexts of standalone claims for disclosure relying on disclosure rights under data protection legislation. The issues that arose were largely determined in favour of the claimants, cementing their earlier success in the Court of Appeal, and underscoring the potential of data subject access requests (DSAR) principles as an ancillary to substantive litigation.

We take your privacy very seriously. You have a range of rights in relation to the way in which we process your personal data. To ask us for copies of your personal data or other information such as where we get personal data from and who we share it with, please complete our separate [insert link to your data subject access request form]. Please continue with this form to: • object to your personal data being processed • ask us to restrict how we use your personal data • ask us to delete your personal data • ask us to transfer the personal data you gave us to another organisation • ask us to correct or delete personal data you think is inaccurate or incomplete, or • query an automated decision that we’ve made More guidance on each type of request can be found in the Appendix. You do not have to use this form, but it is helpful for us to know what you’re asking for so we can respond fully and promptly. We will normally respond within one calendar month

The UK General Data Protection Regulation (UK GDPR) provides rights for data subjects including providing rights of access, rectification, erasure and restriction of processing, data portability, a right to object to processing and rights relating to automated decision making, including profiling, with strict time limits for complying. This Precedent: is designed to help you keep a record of the data subject requests