1 Management and organisational information security ICO expectation and current status More information LexisNexis® Precedents Your business identifies, assesses and manages information security risks☐ Not yet implemented or planned☐ Partially implemented or planned☐ Successfully implemented☐ Not applicable Before you can establish what level of security is right for your business, you need to review the personal data you hold and assess the risks to that information.You should consider all processes involved as you collect, store, use, share and dispose of personal data. Also, consider how sensitive or confidential the data is and what damage or distress could be caused to individuals, as well as the reputational damage to your business, if there was a security breach.You can then begin to choose the security measures that are appropriate for your needs.In addition, as part of a data protection by design approach, you should conduct a data protection impact assessment (DPIA) in specific circumstances to assess privacy risks. You must do a DPIA before you begin any type of processing which is ‘likely to result in a high risk’. This means that although you have not yet assessed

Why you need to manage this risk Information is an asset. Preserving and protecting that asset is critical to the commercial success of any organisation. It is not something you can tackle in isolation, as there are obvious overlaps with cyber security, data protection, management of records and physical spaces. All businesses rely on technology to store and process information. You cannot, however, assume that deploying sophisticated information technology (IT) systems will make your business impregnable. Cyber criminals are equally if not more sophisticated and you must never overlook the human factor—your own staff can inadvertently or maliciously expose the organisation to loss of information or cyber attack. This risk management guide acknowledges that most in-house lawyers and compliance professionals are not information security experts, nor are they responsible for information security within their organisation. This responsibility is likely to rest with the IT department. However, in the event that an information security breach occurs, it is inevitably the in-house legal department and/or compliance team that have to deal with the legal implications. For

This Checklist is designed to help you determine whether you have the systems in place to comply with regulatory requirements in relation to information management and security. Required document or action ☐ Have you identified what information you hold and/or are responsible for? See Precedent: Data processing register. ☐ Have you evaluated risks to those assets? See Precedents: Data protection risk assessment—short form or Data protection risk assessment—long form. ☐ Do you have procedures for the protection of those assets, eg as articulated in

All staff are collectively and individually responsible for information security. This involves knowing and following all relevant policies and procedures designed to safeguard [insert organisation's name]’s information. All staff are expected to: • keep user IDs and passwords confidential and not share them with others or write them down • ensure computers and other electronic devices are kept physically safe and password protected, and the

Passwords are a widely available method of protecting access to personal data and the systems used to process it. They are relatively affordable and simple to implement, so it is recommended by the Information Commission’s Office (ICO) as a means of protecting personal data. Organisations could be subject to regulatory action where appropriate data protection measures have not been implemented. Many data breach incidents investigated by the ICO where personal data was stolen, lost or accessed without appropriate authorisation, would have been less severe if the data had been adequately protected. This Practice Note reflects the ICO’s detailed Guidance on passwords to help organisations understand their options and responsibilities, as well as the UK General Data Protection Regulation (UK GDPR). Introduction to passwords One of the biggest issues when handling personal data and other information is making sure that access to it is available to those who need it, while preventing access by unauthorised individuals. This means you need to authenticate and authorise the individual who is attempting to access it. This is commonly done by checking

This Practice Note is intended for solicitors, including those working in-house, and law firms regulated by the SRA. It explains the information sharing measures (statutory protection for breach of confidentiality) introduced by sections 188 and 189 of the Economic Crime and Corporate Transparency Act 2023 (ECCTA 2023). These measures make it easier for relevant businesses to share information with each other for the purposes of preventing, investigating and detecting economic crime. They also cover information sharing via a third party intermediary. Economic crime in this context is defined in ECCTA 2023, Sch 11 and includes money laundering, terrorist financing, bribery, sanctions evasion, tax evasion, market abuse and fraud. There are a number of conditions that must be met for the statutory protection to apply. Background to the ECCTA 2023 information sharing measures The government recognised that businesses regulated for anti-money laundering (AML) purposes wanting to share client information for the purposes of preventing, detecting or investigating economic

According to Article 1(1)(b) of Directive (EU) 2015/1535, an ISS means: ‘…any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services.’ It goes on to state: ‘For the purposes of this definition: (i) ‘at a distance’ means that the service is provided without the parties being simultaneously present; (ii) ‘by electronic means’ means that the service is sent initially and received at its destination by means of electronic equipment for the processing (including digital compression) and storage of data, and entirely transmitted, conveyed and received by wire, by radio, by optical means or by other electromagnetic means; (iii) ‘at the individual request of a recipient of services’ means that the service is provided through the transmission of data on individual request.’

This Practice Note describes the Electronic Commerce (EC Directive) Regulations 2002 (E-Commerce Regulations 2002), SI 2002/2013 as they apply to businesses established in the UK, including key definitions, obligations and statutory defences. Background and divergence The position in the UK The E-Commerce Regulations 2002 gave effect in the UK to Directive 2000/31/EC (OJ L 178/1), the EU E-Commerce Directive. Following the end of the Brexit implementation period (being 11 pm on 31 December 2020), the E-Commerce Regulations 2002 became part of the body of EU retained law applicable in the UK, as amended by the Electronic Commerce (Amendment etc) (EU Exit) Regulations 2019, SI 2019/87. From 1 January 2024, retained EU law is ‘assimilated’ into domestic law by virtue of the fact it is generally stripped of EU-derived interpretive effects (eg supremacy of EU law, directly effective rights, and general principles previously retained under the European Union (Withdrawal) Act 2018 (EU(W)A 2018)). For more information, see Practice Note: Assimilated law. UK businesses that are information society service providers (ISSPs) are subject to the provisions of the E-Commerce

This Practice Note describes Directive 2000/31/EC, the Directive on electronic commerce or EU E-Commerce Directive, including key definitions, obligations and the country of origin principle. The defences under the EU E-Commerce Directive, which have been incorporated into Regulation (EU) 2022/2065, the EU Digital Services Act, since 17 February 2024, are only covered briefly in this Practice Note. For more information on the liability of providers of intermediary services and the conditional exemptions from liability, see Practice Note: The liability exemptions/defences under the EU Digital Services Act. Background EU businesses that are information society service providers (ISSPs) are subject to the provisions of the EU E-Commerce Directive (and any applicable local laws in relevant EEA countries) in respect of information society services provided in the EEA. Information society services providers must: • provide certain specified information to service recipients • clearly identify commercial communications • provide certain information to service recipients with whom they conclude an electronic contract, and • comply with certain requirements where orders are placed electronically It also

A term describing a network of integrated electronic communications systems connecting people around the world to information, businesses, governments and each other.

This Checklist has been drafted for use by the buyer and is designed to highlight issues commonly arising, and key questions that should be asked, when undertaking due diligence in the course of a share purchase transaction where the target is a limited liability company. This Checklist focuses exclusively on the information technology (IT) assets used internally by the target, and is intended to be used in conjunction with due diligence enquiries in other areas such as general corporate, data protection, intellectual property, accounting and tax and as to financial position. For guidance on how to do this, see: • Intellectual property due diligence in share purchase transactions—checklist regarding detailed intellectual property right (IPR) due diligence in share purchase transactions • Practice Note: The impact of the UK GDPR on M&A transactions regarding detailed data protection due diligence in share purchase transactions • Practice Note: Due diligence—share and asset purchases and Precedent: Legal due diligence questionnaire—private M&A—share purchase regarding due diligence in share purchase transactions generally • Precedent: Share purchase agreement—pro-buyer—corporate seller—conditional—long form for

This Practice Note covers the information which should be provided to the nominee in order to allow them to consider the merits of the CVA proposal and to prepare their report to the court (see below: Information to the nominee of a company voluntary arrangement (CVA)—Nominee who is the administrator or liquidator). Statement of Insolvency Practice (SIP) 3.2 is relevant to the whole of this Practice Note. Where Nominee is not the administrator or liquidator The Insolvency (England and Wales) Rules 2016 (IR 2016), SI 2016/1024 apply to CVAs. The nominee is required to prepare a report on whether: • the company’s financial position is materially different from that contained in the CVA proposal, explaining the extent to which the information has been verified • the CVA is manifestly unfair • the proposer’s consent is sought on any modifications to the proposal put forward by creditors, and the proposer understands the impact of the modifications on the implementation of the CVA and its viability • (where a modification is adopted)