Before you can improve a process, you need to understand how that process operates. This Precedent provides

ARCHIVED: This Flowchart has been archived and is no longer maintained. This Flowchart shows the key steps in the process of an arbitration under the Commercial Rent (Coronavirus) Act 2022 (CR(C)A 2022), including eligibility for arbitration, giving notice of intention to make a reference to arbitration, the appointment of an arbitrator and submission of formal proposals for relief from payment, the process whether or not an oral hearing is requested, the awards that the arbitrator may make, and the end of the moratorium on enforcement. It is drafted on the assumption that the tenant will make the reference to arbitration but applies equally if the parties are reversed. Some details have been omitted for clarity—for full guidance see Practice Note: Rent arrears recovery under the Commercial Rent (Coronavirus) Act 2022 [Archived]. Note that the deadline for beginning a new reference to arbitration has now passed. See Practice Note: Rent arrears recovery under the Commercial Rent (Coronavirus) Act 2022 [Archived]. Note 1—Is there a protected rent debt under

Bill A Bill is a proposal for a new law or a proposal for an amendment to an existing law which is presented to Parliament for debate. Bills can be presented in either the House of Commons (the Commons) or the House of Lords (the Lords) initially, but unless the Parliament Acts apply (see below) both Houses must examine, amend and approve the Bill before it is enacted. Once the Houses have agreed on the content of the Bill, it is then presented for Royal Assent. Bills can be introduced by: • the government • individual MPs • individual Lords, and • private individuals or organisations There are four different types of Bill: • Government Bills—these are the most common type of Bill, introduced by government ministers. Government Bills are almost always Public Bills, which is to say that they aim to change the law as it applies to the general population. They can be introduced by either House, although it is more common to find that Bills which deal with taxes or the management

Processing means obtaining, recording, holding, or carrying out any operation on personal data. It includes organisation or alteration; retrieval or use; disclosure and anonymisation, blocking or destruction. Most operations in relation to personal data will constitute processing.

Immigration analysis: The Home Office is struggling to cope with a surge of demand for immigration application-related services ahead of an increase in the Immigration Health Surcharge and upcoming changes to the Skilled Worker and Partner routes. Andrew Osborne, Supinder Singh Sian, Stephen O’Flaherty and Naomi Hanrahan-Soar, all partners at Lewis Silkin discuss the services affected.

The processing of personal data for law enforcement purposes is regulated by Part 3 of the Data Protection Act 2018 (DPA 2018) and is a separate regime to the general processing of personal data under the UK General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR). DPA 2018, Pt 3 applies to competent authorities which process personal data for ‘law enforcement purposes’. It covers processing for the prevention, investigation, detection or prosecution of criminal offences, or the execution of criminal penalties, including the safeguarding against, and the prevention of, threats to public security. DPA 2018, Pt 3 incorporated the EU Law Enforcement Directive (EU) 2016/680 (EU LED) into UK law. The Information Commission’s Office (ICO) has published guidance specifically on the obligations under DPA 2018, Pt 3 which is essential reading for those advising on this area. The ICO guidance, which is currently under review, can be accessed here. The Data (Use and Access) Act 2025 (DUAA 2025) introduces significant amendments to DPA 2018 and UK GDPR.

This Practice Note explains the scope for relying on legitimate interests as a lawful ground for processing personal data under the UK General Data Protection Regulation (UK GDPR). It is based on the requirements of the UK GDPR, together with: • detailed guidance from the Information Commission’s Office (ICO): Legitimate interests under the UK GDPR, and • European Data Protection Board (EDPB) Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR—according to the ICO, EDPB guidelines are no longer directly relevant to the UK regime and are not binding under the UK regime, however they may still provide helpful guidance on certain issues For guidance on conducting a legitimate interests assessment, see Practice Note: How to conduct a legitimate interests assessment. See also Precedent: Legitimate interests assessment—data processing and Legitimate interests assessment—flowchart. Why is this important? You cannot process personal data simply because you wish to do so. You can only process personal data if you satisfy one of the grounds set out in UK GDPR, Art 6(1). These are commonly

This Practice Note pulls together practical examples of situations where legitimate interests may be considered as the lawful ground for processing personal data. These examples are taken from several sources: • the Information Commission’s Office (ICO) UK GDPR guidance and resources—Legitimate interests • European Data Protection Board (EDPB) Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) • WP29 (now EDPB) Opinion on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC—this predates the EU General Data Protection Regulation (EU GDPR), but Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) are stated to build on this earlier Opinion According to the ICO, EDPB guidelines are no longer directly relevant to the UK regime and are not binding under the UK regime. However, they may still provide helpful guidance on certain issues. Lawful grounds for processing personal data under UK GDPR You cannot simply process personal data because you wish to do so. You can only process personal data if you satisfy one

This Practice Note is based on the UK General Data Protection Regulation (UK GDPR) and consent guidance published by the Information Commission’s Office (ICO) and is intended for private sector commercial organisations. Consent is unlikely to be the default ground for processing personal data under the UK GDPR and organisations will need to consider whether any other lawful grounds are more appropriate from a legal and operational perspective—see below: Do you need consent? and Practice Note: How to process personal data lawfully. What is consent? Consent is defined as any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of their personal data. Consent must therefore be: • freely given • specific • informed • unambiguous There are two levels of consent depending on the type of data you are processing: • standard consent, which is required to process standard personal data • explicit consent, which is required to process special category (sensitive) personal

In a communication to stakeholders sent on 30 August 2024, the Home Office has announced that it will introduce shorter processing times for marriage and family entry clearance applications, bringing the service standard down from 120 working days to 60 working days. The announcement states that this service standard has been amended to reflect what has been happening for some time in practice.

This Practice Note is intended for law firms but it may also be relevant to in-house lawyers. It considers the potential lawful grounds under the UK General Data Protection Regulation (UK GDPR) for processing special category personal data of clients. It reflects the UK GDPR and guidance published by the Information Commission’s Office (ICO) about the scope of the condition for processing special category personal data, ‘processing necessary for the establishment, exercise or defence of legal claims’. For guidance about processing special category personal data of third parties, see Practice Note: Processing special category personal data of third parties—law firms. For guidance about special category personal data more generally, see Practice Note: How to identify and manage special category personal data. What is special category personal data? Special category personal data is: • personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership • genetic data • biometric data processed for the purpose of uniquely identifying a natural person, or • data concerning health or

This Practice Note is intended for law firms but it may also be relevant to in-house lawyers. It considers the potential lawful grounds under the UK General Data Protection Regulation (UK GDPR) for processing special category personal data of third parties received in the course of providing legal services. It reflects the UK GDPR and guidance published by the Information Commission’s Office (ICO) about the scope of the condition for processing special category personal data, ‘processing necessary for the establishment, exercise or defence of legal claims’. For guidance about processing special category personal data of clients, see Practice Note: Processing special category personal data of clients—law firms. For guidance about special category personal data more generally, see Practice Note: How to identify and manage special category personal data. Special category personal data is: • personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership • genetic data • biometric data processed for the purpose of uniquely identifying a natural person, or • data