This Precedent Data breach report form can be used by staff to notify your data protection officer or head of compliance of actual or suspected personal data breaches. It complements Precedents: Ireland—Letter notifying data subject of data breach, Ireland—Letter notifying data breach to insurer, Ireland—Public statement on data breach, Ireland—Data breach—panic sheet, Ireland—Data breach assessment and action plan and Ireland—Personal data breach plan. These Precedents are intended to ensure you capture the information required by the EU General Data Protection Regulation (EU GDPR) and comply with guidance from the

This data breach panic sheet gives tips on what to do and what not to do in the immediate aftermath (first 24 hours) of a data security breach. It reflects requirements of the GDPR itself and follows the preliminary stages of a process suggested in the UK Information Commission’s Office’s (ICO) guidance on data security breach management (subsequently withdrawn, and although not directly applicable in Ireland provides useful guidance and tips). There is not an equivalent set of guidance published by the Data Protection Commission (DPC) on data breach process. The DPC have published guidance on requirements relating to the data breach notification to the DPC and data subjects, which is reflected in this note and hyperlinked. On discovering a data breach, the first thing you should do is assemble a data breach team comprising the various people within your organisation who are best placed to respond to the breach (as described above). Having assembled your data breach team, you can then: • conduct a preliminary assessment of the breach • contain the data breach and (so far as reasonably practicable) recover, rectify

A data centre is a facility that houses computer and communications equipment. This Practice Note covers the following key issues: • Security • Personal data • Technology • Service descriptions and service levels • Business continuity • Encryption • The supplier • Contracting issues • Ongoing management Data centre services may be provided through various models, which may be summarised at a high level as follows: • co-location service—a co-location service enables the customer to rent space in the data centre and for the supplier to provide the facilities in which the customer operates its own servers. The supplier will also provide ancillary services that are essential to use such space relating to the maintenance of the security of the data centre and the rented space, provision of power and the control of the humidity and temperature throughout the data centre. The amount of space taken may range from use of a shelf on an equipment rack,

This Practice Note provides a general introduction to data protection law in Ireland and its key concepts and provision. Irish data protection law is predominantly determined by the application of the EU General Data Protection Regulation (Regulation (EU) 2016/679) (EU GDPR) regime and there are separate, more detailed Practice Notes advising on specific aspects of data protection law at an EU level. This Practice Note discusses the most important of these aspects at a high level and places them in an Irish regulatory context. Ireland is an important jurisdiction for data protection commentators, as a significant number of major personal-data-rich companies including large social media platforms and digital service providers have their European headquarters in Ireland. Introduction to data protection law and its purpose Data protection law is generally intended to ensure information about living individuals (within the definition of ‘personal data’) is used fairly, properly, securely and responsibly. Its ultimate objective is to ensure that personal data is not used in a way which compromises the rights and freedoms of natural persons. To this end, data

This short form Precedent Data protection risk assessment can be used to identify data protection, information security and privacy risks within your organisation. This involves reviewing what personal data you hold, how you process that data, why, who you share personal data with, how data moves within your organisation, whether you transfer personal data outside the EU/EEA, how you ensure personal data remains accurate and up to date, how long you keep personal data and your process for destroying personal data. It also encourages you to review any findings or trends you have identified from data security audits or breaches. Armed with this information, you can identify your data protection and privacy risks and populate a privacy risk register—see Precedent: Ireland—Privacy risk register. There is no established format for a risk assessment, but it makes sense to consider: • what personal data do you receive and/or hold? • how do you process data? • for what purposes do you process data? • do you transfer or share data—if so, to whom and how? • how does data move within your organisation?

This Precedent sets out rules to be used in a share or business sale when potential buyers and their advisers will be granted access to a physical data room to conduct their due diligence. The data room rules will be prepared by the seller's solicitors (or the seller’s financial advisers if they are running the data room). The data room will be a physical room which can be set up at the seller's premises but, in order to avoid disruption to the seller's business on a day-to-day basis and to keep the transaction confidential from employees, the data room will normally be set up at the offices of the seller's solicitors, financial advisers or accountants. It will contain all the information relating to the target company, any target group companies and the business in the case of a share sale, or the target business in the case of a business sale. People wishing to review the information must go to where the information is. By highlighting deal breakers at

This Precedent sets out rules to be used in a share or business sale when potential buyers and their advisers will be granted access to a virtual data room (VDR) to conduct their due diligence. The virtual data room rules will be prepared by the seller's solicitors (or the seller’s financial advisers if they are running the VDR). A VDR is an internet site which is set up by the seller with a third party service provider to give potential buyers and their advisers access to documents and information relating to the target, any group companies and the business in the case of a share sale, or the target business in the case of a business sale. The VDR will contain all the information relating to the due diligence exercise. By highlighting deal breakers at an early stage, a data room should allow the potential buyer to conduct sufficient due diligence to decide whether to bid for the target company or the target business. A data room is commonly

This Practice Note, which applies to both share purchase and asset purchase transactions, explains: • the differences between a physical data room (a room filled with documents in a set location) (PDR) and a virtual data room (an online data repository to which documents are uploaded) (VDR) and the factors involved in choosing which of the two to use • a summary of the key organisational issues for the seller and the seller's team of advisers to consider when setting up a data room, including how to decide what to include and how to organise the data room, and • the documentation which should be drafted by the seller/seller's advisers and executed by those accessing the data room (namely a confidentiality agreement and data room rules) Different data room procedures will apply depending on whether a PDR or VDR is being used, but the rationale for setting up a data room is the same in both instances. It will be important for the seller to identify appropriate senior individuals within its/the target's organisation

This Precedent data sharing agreement is for use when an independent controller wishes to disclose or share personal data with another party, who will then become a further independent controller for that shared data. The key example envisaged is for use in relation to a proposed corporate transaction, such as the undertaking of due diligence. Sharing personal data, whether on a one-off or a continuous basis, and whether with a service provider, affiliate, partner, government agency or other third party qualifies as ‘processing’ and so is subject to the data protection regime. Data protection law distinguishes between controllers (in summary, a natural or legal person or body which (either alone or jointly with others) determines the purposes and means of processing personal data) and processors (in summary, any person or body (other than an employee of the controller) who processes the personal data on behalf of the controller). For further information, see Practice Note: Key definitions under EU data protection law. Meaning of ‘independent’ and joint controllers’ Where data is processed by a processor

The EU’s General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR) governs much related to personal data protection, including in the work setting. In this Practice Note, we look at data subject access requests (DSAR or DSARs, as applicable), see Practice Note: EU GDPR—rights of data subjects. In some sources, these are called subject access requests (SAR or SARs, as applicable). DSARs will be used here. DSARs constitute the most frequent basis for complaint to the Irish Data Protection Commission (DPC). In the Irish employment context, the DPC has provided further information on DSARs (DPC Guidance), rather than the Workplace Relations Commission (WRC). This Practice Note provides an outline for understanding and addressing DSARs by adapting the generalised framework from the EU GDPR, the Data Protection Act 2018 (Ireland) (DPA 2018 (IRL)), as well as the guidance from the European Data Protection Board (EDPB), and the DPC. What is a DSAR? Recital 63 of the Regulation (EU) 2016/679 (EU GDPR) offers a useful starting point for data subject access requests: ‘A

Introduction Unannounced inspections by authorities, known as ‘dawn raids’, can disrupt operations, expose businesses and individuals to serious legal consequences, and have the potential to reshape entire industries. Dawn raids can occur at any time and at any place but are typically conducted at business premises, at private residences (of directors or other employees) and vehicles. Dawn raids are a powerful tool used by competition regulators to enter premises pursuant to a search warrant, if necessary, by force, and to inspect and seize books, documents, electronic records and other critical evidence of suspected violations. In Ireland, the Competition and Consumer Protection Commission (CCPC) and the Commission for Communications Regulation (ComReg) are responsible for enforcing competition law at the national level, while the European Commission tends to conduct dawn raids across European Union (EU) Member States, either unilaterally or in tandem with national competition authorities (NCAs) when suspected violations affect multiple jurisdictions. This note will refer to the EU position where the legal framework diverges from the Irish position

This Precedent sets out details of a standard dawn raid response team, including names, contact details and a very brief description of their responsibilities. Because dawn raids are usually conducted without notice, it is important that staff are as prepared as possible and this document can help you. For guidance, see: • Ireland—Dawn raids by the Competition and Consumer Protection Commission—key information • Ireland—How to deal with a dawn raid—checklist This table sets out details of a standard dawn raid response team, including names, contact details and a very brief