You must have appropriate security in place to prevent personal data being accidentally or deliberately compromised. Information security is wider than cybersecurity (the protection of your networks and information systems from attack), as information security also covers things like physical and organisational security measures. This Practice Note reflects requirements in the UK General Data Protection Regulation (UK GDPR) and ICO expectations, as set out in the ICO’s A guide to data security. The CIA triad The ICO guidance specifically refers to the ‘CIA triad’: confidentiality, integrity and availability. If any of the three elements is compromised, there can be serious consequences—for you as a data controller and for the individuals whose data you process. You are also required to ensure the resilience of your processing systems and services. Resilience refers to: • whether your systems can continue operating under adverse conditions, eg a physical or technical incident, and • your ability to restore them to an effective state See the range of tools available in subtopic: Business continuity plan. The

Disclosure: an important and integral part of litigation Disclosure requires parties to list all the documents that are in their control and connected to the disputed issues, show this to the other participants and allow their opponents to inspect the documents. Disclosure is a compulsory part of, and integral to, the litigation process. It may be case-winning and case-losing. According to the rules governing disclosure in claims in the Business and Property Division (see regime 2 below), disclosure is ‘important in achieving the fair resolution of civil proceedings’ (CPR PD 57AD, para 2.1). The process involves ‘identifying and making available documents that are relevant to the issues in the proceedings’. In conducting litigation, the Court of Appeal said (2014) there was ‘a public interest in ensuring that all relevant evidence is provided to the court’, while recognising that the obligation ‘is an invasion of the litigant's right to privacy and confidentiality’. In a situation where the defendants had failed to comply with disclosure orders, a judge said (2022) that: ‘[t]here is no choice

The extended producer responsibility (EPR) regime for packaging and packaging waste has moved the full cost of dealing with packaging waste from households to packaging producers, giving producers responsibility for the costs of their packaging throughout its lifecycle. Producers pay less for sustainable packaging, incentivising packaging that uses less material and is easier to recycle. Through the EPR regime, Local Authorities (LAs) receive producer‑funded payments to cover the net costs of collecting, managing, recycling and disposing of this household packaging waste. EPR is regulated through the Producer Responsibility Obligations (Packaging and Packaging Waste) Regulations 2024, SI 2024/1332 (as amended). These regulations establish a number of persons and bodies with defined functions within the EPR regime. These are: • producers—these are the primary duty holders • compliance schemes • the Scheme Administrator (SA) (PackUK) • ‘relevant authorities’ which are LAs as household waste collection and disposal authorities responsible for household waste services • reprocessors and exporters • the ‘appropriate agency’—in England, the Environment Agency (EA)

The register of overseas entities was launched on 1 August 2022. Overseas entities that want to buy, sell, transfer or charge property or land in the UK, must have registered with Companies House and declared who their registrable beneficial owners or managing officers are by 31 January 2023 (the end of the transitional period for the register). It should be noted, separately, that an overseas company has to be registered at Companies House if it opens an 'establishment' in the UK. An establishment is a branch within the meaning of the Eleventh Company Law Directive, or a place of business that is not such a branch. This registration requirement derives from the Overseas Companies Regulations 2009. It is an entirely distinct requirement from the registration regime described in this note relating to overseas entities owning property in the UK. For further information see Practice Note: Overseas companies with an establishment in the UK. Guidance The register of overseas entities creates compliance requirements for a wide range of lawyers, including corporate, property

This guide sets out a non-exhaustive list of the key steps to be taken by a company secretary (or other company administrator) following a general meeting or annual general meeting (AGM). It makes references to the requirements under the Companies Act 2006 (CA 2006) that apply to meetings of all companies, and additional requirements under the UK Listing Rules (UKLRs), Alternative Investment Market (AIM) Rules and UK Corporate Governance (UKCG) Code that apply, as relevant, to listed companies and AIM companies. For further information on the steps being undertaken, see Practice Note: Post general meeting (including AGM) actions and procedures. Depending on the type of company (ie private limited company, public limited company, listed company or AIM company), certain formalities will need to be completed after the meeting has concluded, including: • preparing minutes of the meeting • updating or amending the company's registers and records • attending to filing (whether with the Registrar of Companies (the Registrar) or other regulators such as the Financial Conduct Authority (FCA)) • making any

Before you can start taking steps to take control of the contract management process in the legal department, you have to understand what the current commercial and legal processes involve. You should conduct a contract management audit that includes all the stakeholders, resources, and processes across your organisation (including the legal department) that impact how your organisation’s contracts are handled, from negotiation and creation to execution and management. This Practice Note provides suggestions as to how to conduct an audit of contract management processes together with an indication of the topics you should investigate during your audit. Conducting the audit There are several ways you could conduct an audit of contract management processes in your organisation: Method Advantages Disadvantages Impromptu hallway or office conversations. Ad hoc meetings may give you the required information if your organisation is small. —You need to steer the conversation with targeted questions. See Precedent: Impromptu contract audit meeting questions for some sample questions.—Risk of gaining an incomplete picture. Conduct a workshop that includes a representative

This ‘How to’ guide sets out how to conduct a disciplinary (or conduct) hearing or meeting, as part of a fair conduct management procedure. It provides an overview of the legal considerations, and details the procedure to follow. It considers sound recordings, notes and minutes of the hearing, adjournment, reconvening the hearing, the right of appeal and record-keeping. Where a disciplinary investigation leads to a recommendation that a disciplinary hearing be convened (see Practice Note: How to conduct a disciplinary investigation), the manager charged with conducting that hearing will prepare for it (see Practice Note: How to plan and prepare for a disciplinary hearing). The guidance set out below explains how to conduct the hearing itself when the day arrives. The manager should bear in mind that a well-implemented and conducted disciplinary procedure should enable a business to uphold expected standards of conduct, while at the same time promoting good employee relations. Conducting disciplinary hearings well is one important element of that procedure, and can help to achieve those goals. The functional purpose

This ‘How to’ guide sets out how to conduct a disciplinary or misconduct investigation, including the investigation meeting and process, as part of a fair conduct management procedure. Where a potential conduct issue arises in the workplace, the first stage in managing that issue is to investigate the problem, in order to establish the facts of the case. This is essential if the employer is to act fairly, and minimise the risk of unfair dismissal claims. For further information on investigating a conduct issue, see Practice Notes: Managing conduct—Investigating a problem and Dismissing fairly for conduct reasons—Investigation. The purpose of a disciplinary investigation A disciplinary investigation is undertaken to establish the facts and circumstances relating to an allegation of misconduct against an employee. It is to: • gather evidence from all sides • find out if there is a case to answer • make sure everyone is treated fairly, and • help the employer to decide what should happen next Its main purpose is to gather all the evidence and documentation that may be

You have a duty to take appropriate precautions to minimise the risk of fire in your workplace and, so far as is reasonably practicable, ensure the safety of your employees and others in the event of fire. There are no hard and fast rules about what fire safety provisions you are required to put in place: smaller organisations may only need the minimum provision but larger organisations or those with particular fire risks may require more resources. To establish what is adequate and appropriate for your operations you must make a suitable and sufficient assessment of the risks—a fire risk assessment. This Practice Note provides information on conducting a fire risk assessment. It covers fire safety in an office-based, non-residential workplace. Other industry/premises-specific requirements may apply in different environments, especially to residential and domestic buildings, including flats and multi-storey residential buildings. Regulatory requirements in relation to fire safety in residential and domestic premises are outside the scope of this Practice Note as are building regulations requirements in relation to fire

You have a duty to provide adequate and appropriate equipment, facilities and personnel to ensure your employees receive immediate attention if they are injured or become ill in the workplace. What is adequate and appropriate will depend on a number of factors, including the size and nature of your business. To establish what is adequate and appropriate for your operations you should conduct a first aid needs assessment. This Practice Note provides information on conducting a first aid needs assessment. For information about regulatory requirements relevant to first aid, see Practice Note: First aid in the workplace—regulatory requirements. Key staff members You should ensure the person (or persons) with overall responsibility for assessing first aid needs is of sufficient seniority to enable them to lead the assessment process and oversee any measures put in place. You should also consider how to adequately involve all staff in discussing and agreeing the salient parts of the assessment. If all staff members are given an opportunity to have a say, they are more likely

Having in place a well-thought-out and accessible structure on health and safety can help an organisation ensure it is managed effectively and efficiently. Some elements of health and safety, such as assessing (and controlling) the risks in your workplace are required by law. An organisation should therefore: • identify its overriding principles and objectives to ensuring the health and safety of its key stakeholders, ie what it wants to achieve (see subtopic: Health and safety policy) • identify key members of staff and obtain their input • conduct a risk assessment • formulate an action plan justifying what the organisation needs and why (see Practice Note: How to formulate a health and safety plan) • implement the plan, and • review the plan This Practice Note provides information on conducting a health and safety risk assessment in an office-based workplace. Other industry/workplace-specific issues may apply in different working environments. For information about regulatory requirements relevant to health and safety assessment and planning, please refer to Practice Notes: Health

The UK General Data Protection Regulation (UK GDPR) permits processing of personal data where that processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. There is clearly a balancing exercise to be done: your legitimate interests versus the interests, fundamental rights and freedoms of the data subject—see Precedents: Legitimate interests assessment—data processing—short form and Legitimate interests assessment—data processing. The outcome of the assessment largely determines whether legitimate interests may be relied on as a lawful ground for processing personal data. This Practice Note provides guidance on how to conduct a legitimate interests assessment under the UK GDPR. It is based on the UK GDPR, together with: • detailed guidance from the Information Commission’s Office (ICO): Legitimate interests under the UK GDPR, and • European Data Protection Board (EDPB) Guidelines