ARCHIVED: This archived Practice Note provides information on the data protection regime before 25 May 2018 and reflects the position under the Data Protection Act 1998. This Practice Note is for background information only and is not maintained. STOP PRESS: The General Data Protection Regulation, Regulation (EU) 2016/679 (the GDPR) (applicable from 25 May 2018) introduces substantial amendments to EU and UK data protection law and replaces the Data Protection Act 1998 (DPA 1998) and Directive 95/46/EC (the Data Protection Directive) from that date. This Practice Note will be updated to reflect the changes to data protection law as a result of the GDPR regime in due course. In the meantime for further information, see Practice Note: Introduction to the EU GDPR and UK GDPR and the main section of this Practice Note: Privacy notices under the GDPR below. For a comprehensive introduction to the GDPR, collating key practical guidance, see: UK data protection law collection. Processing personal data fairly and lawfully The first data protection principle set out in Schedule

This Practice Note sets out information requirements that are contained at various places in the UK General Data Protection Regulation (UK GDPR). Most of these relate to privacy notices (privacy policies), but there are also information requirements relating to issues like data breaches and data protection officer (DPO). This Practice Note does not cover information requirements where information society services are provided to children. Transparency is a key principle of the UK GDPR. Most organisations will comply with transparency requirements by way of their privacy notice or privacy policy. For a quick reference check in relation to the form and content of your privacy notices, see Precedent: Privacy notice audit. For a sample privacy notice, see Precedents: • Privacy policy—general commercial organisation—customer-facing • Privacy policy—law firms and professional services • Data protection privacy notice (employment) Consent Information to be given Timing Format Regulatory requirement or recommended? ☐ Notice that the data subject has the right to withdraw their consent at any time Prior to the data subject giving consent In a format to

In brief In summary, UK data protection law is intended to ensure information about living individuals (within the definition of ‘personal data’) is used fairly and responsibly. To help ensure that, the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR) regime imposes a large number of obligations on those ‘processing’ personal data, and on the controllers of such processing, when they are in the scope of the UK GDPR regime. The UK GDPR also grants rights to those whose personal data is processed (the ‘data subjects’). ‘Processing’ includes doing almost anything with personal data, including storing, sharing, deleting or using it. It is virtually impossible to operate a business or other organisation without processing personal data. Among other things, the ‘controllers’ of personal data processing are required to provide certain information to data subjects, such as to ensure they know why their personal data is being collected, how it is being used, who it is being shared with, and their own key rights (that is called the ‘right to be informed’). That

Commonly refers to an external-facing data protection policy (or ‘notice’) addressing the information and transparency requirements under data protection and privacy laws.

This [page] forms part of our privacy policy and gives more detailed information on who your personal data is shared with further to the summary provided in [insert as appropriate, eg section [insert] of our privacy policy]. For your convenience, words have the same meanings as in the rest of the policy. Who we share your personal data with—in more detail [Insert as appropriate, eg section [insert] of our privacy policy] gives a summary of who we share your

We take your privacy very seriously. Please read this privacy policy carefully as it contains important information on how and why we collect, store, use and share your personal data. It also explains your rights in relation to your personal data and what to do if you have a complaint. This privacy policy does not apply to any third party websites that may have links to our own website. 1 Who are we and what do we do? 1.1 [Insert organisation name] provides [describe the type of services or goods that you supply and, if appropriate, who to]. 1.2 We collect, use and are responsible for certain personal data about you. When we do so we must comply with the UK General Data Protection Regulation (UK GDPR). 1.3 Our services and website are not aimed specifically at children. If you are a child and you want further information about how we might use your data, please contact us (see ‘How to contact us’ at section 16 below). 2 Terminology It would be helpful to explain some key terms used in this policy: We, us, our [Insert

We take your privacy very seriously. Please read this privacy policy carefully as it contains important information on who we are and how and why we collect, store, use, and share your personal data. It also explains your rights in relation to your personal data and how to contact us or supervisory authorities in the event you have a complaint. We collect, use and are responsible for certain personal data about you. When we do so we are subject to the UK General Data Protection Regulation (UK GDPR). [We are also subject to the EU General Data Protection Regulation (EU GDPR) in relation to goods and services we offer to individuals [and our wider operations ]in the European Economic Area (EEA).] Key terms It would be helpful to start by explaining some key terms used in this policy: We, us, our [Insert full legal name of your organisation, together with any trading name or names that may be more familiar to the customer][ and our group companies] [Our data protection officer] [[Insert [name and ]contact details—if you have a data

We take your privacy very seriously. Please read this privacy policy carefully as it contains important information on how and why we collect, store, use and share your personal data. It also explains your rights in relation to your personal data and what to do if you have a complaint. This privacy policy does not apply to any third party websites that may have links to our own website. Clients of this firm should read this policy alongside our general terms and conditions, which provide further information on confidentiality. 1 Who are we and what do we do? 1.1 [Insert firm name] is a [insert structure, eg limited liability partnership][, authorised and regulated by the Solicitors Regulation Authority under number [insert number]]. Contact details can be found at section 16. 1.2 We collect and use personal data in the course of providing our services. When we do so we must comply with the UK General Data Protection Regulation (UK GDPR). [We must also comply with the EU General Data Protection Regulation (EU GDPR) in relation to services we offer to individuals [and

Please click for an Excel version of this register. The register consists of three tabs: • sample privacy risk register—this has been populated with a number of risks to demonstrate how the risk register is intended to be used • blank privacy risk register, which you can populate with any risks you identify for your business • drafting notes and key—this explains how to assign a numerical value to each risk, using a 3 x 3 risk matrix This register has been prepared in Excel and it therefore cannot be downloaded to Word. What is a privacy risk register? A privacy risk register is a tool that allows

Key issues in respect of privacy, confidentiality and publicity in the Court of Protection It is vital to the rule of law not only that justice is done, but that it is seen to be done. Court hearings should be open to the public and the media save in exceptional circumstances in order to comply with Article 10 of the ECHR (freedom of expression). Both the common law and Article 6 of the ECHR (right to a fair trial) admit of exceptions to the principle that hearings be in public in the case of children and vulnerable persons. Until recently, the default rule was for family and Court of Protection proceedings to be held in private and for limited reporting to take place. Cases dealt with by the Court of Protection raise issues about the most fundamental, personal and private matters and there is a presumption in favour of anonymity for the vulnerable persons about whom decisions are made in order to give effect to P and sometimes members of P’s

A Abatement Where, after payment of the deceased’s funeral expenses, debts and liabilities, there are insufficient assets or funds to pay all the legacies in full, they must be abated, ie reduced. This is subject to a contrary intention shown in the deceased’s Will. The rules for abatement in a solvent estate are set out in Part II of Schedule 1 to the Administration of Estates Act 1925. See Practice Note: Payment of legacies. Accruals basis If income is taxed on an accruals basis, it is allocated to a tax year on the basis of the number of days in that tax year in which the activity producing the income tax liability accrued. See Practice Note: What is the basis of income tax?. Accumulation and maintenance (A&M) trust A particular type of non-interest in possession trust, intended to make provision for children and young adults up to the age of 25, and which enjoyed privileged inheritance tax treatment between 1975 and 2006. See Practice Note: Accumulation and maintenance trusts—IHT [Archived]. Accredited

ARCHIVED: This archived Practice note sets out links to relevant News Analyses on Brexit published on Private Client and available in the Brexit collection. Date News Analysis Brief description of News Analysis 26 January 2021 Private Client—Brexit considerations Private Client analysis: On 24 December 2020, seven days before the end of the Brexit transition period at 11pm on 31 December 2020 (IP completion day), it was announced by the Prime Minister, Boris Johnson, the UK and EU had negotiated a deal. Angharad Lynn, senior associate at VWV, considers the impact of the Trade and Cooperation Agreement (TCA) upon private client law in the UK. 22 January 2021 Pensions after Brexit and the UK-EU trade deal Pensions analysis: Rosalind Conner and Danyal Enver, managing partner and associate respectively at Arc Pensions Law, look at the implications for pensions after Brexit following the UK-EU trade deal. 11 December 2020 Contentious trusts and Brexit—looking beyond the implementation period Private Client analysis: Nicholas Holland, partner and Anita Shah, associate both of McDermott Will