https://s1-uk.practicallaw.thomsonreuters.com/WLN-PLCUK-SC_2605.1.2002/productViews/plcuk/Askhttps://uk.practicallaw.thomsonreuters.comData ProtectionData ProtectionDo you have any guidance on section 80 of the DUA Act 2025?https://uk.practicallaw.thomsonreuters.com/Document/I655fd82806d711f18086beb24ce176bb/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/I655fd82806d711f18086beb24ce176bb/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Wed, 11 Feb 2026 00:00:00 CSThttps://uk.practicallaw.thomsonreuters.com/Document/I655fd82806d711f18086beb24ce176bb/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Could you please provide practical guidance on a supplementary statement for the purposes of responding to a rectification request under Article 16 UK GDPR?https://uk.practicallaw.thomsonreuters.com/Document/I86cc0eb206e211f1b4bafd5f4135974b/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/I86cc0eb206e211f1b4bafd5f4135974b/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Wed, 11 Feb 2026 00:00:00 CSThttps://uk.practicallaw.thomsonreuters.com/Document/I86cc0eb206e211f1b4bafd5f4135974b/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Does Practical Law plan to update the UK GDPR definition referenced in any resources given the Data (Use and Access) Act 2025 (DUAA) amendments to the UK data protection regime (UK GDPR and DPA 2018)?https://uk.practicallaw.thomsonreuters.com/Document/I86cc0de306e211f1b4bafd5f4135974b/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/I86cc0de306e211f1b4bafd5f4135974b/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Wed, 11 Feb 2026 00:00:00 CSThttps://uk.practicallaw.thomsonreuters.com/Document/I86cc0de306e211f1b4bafd5f4135974b/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Is an external DPO a controller or processor under the UK GDPR?https://uk.practicallaw.thomsonreuters.com/Document/I88a473ecf77411f0bc29ee412aedc12c/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/I88a473ecf77411f0bc29ee412aedc12c/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Thu, 22 Jan 2026 00:00:00 CSThttps://uk.practicallaw.thomsonreuters.com/Document/I88a473ecf77411f0bc29ee412aedc12c/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Have Articles 35 and 36, EU GDPR been retained under the UK GDPR?https://uk.practicallaw.thomsonreuters.com/Document/I9c5cd35ce3dc11ebbea4f0dc9fb69570/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/I9c5cd35ce3dc11ebbea4f0dc9fb69570/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Sat, 04 Oct 2025 00:00:00 CDThttps://uk.practicallaw.thomsonreuters.com/Document/I9c5cd35ce3dc11ebbea4f0dc9fb69570/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Do you have a SaaS template agreement that can be modified for use in a healthcare context?https://uk.practicallaw.thomsonreuters.com/Document/I76d8e2cb363f11f0b6a3874d50b19388/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/I76d8e2cb363f11f0b6a3874d50b19388/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Wed, 21 May 2025 00:00:00 CDThttps://uk.practicallaw.thomsonreuters.com/Document/I76d8e2cb363f11f0b6a3874d50b19388/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Could you clarify the time limit for responding to a DSAR if the controller has requested further information?https://uk.practicallaw.thomsonreuters.com/Document/I45dbb37e106211f082a5ae4bb4582a09/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/I45dbb37e106211f082a5ae4bb4582a09/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Thu, 03 Apr 2025 00:00:00 CDThttps://uk.practicallaw.thomsonreuters.com/Document/I45dbb37e106211f082a5ae4bb4582a09/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Do we need to include a data transfer clause in a data sharing agreement if the transfers are made on the basis of adequacy decisions?https://uk.practicallaw.thomsonreuters.com/Document/I7f2f25c3107111f0aee9df768af9403e/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/I7f2f25c3107111f0aee9df768af9403e/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Thu, 03 Apr 2025 00:00:00 CDThttps://uk.practicallaw.thomsonreuters.com/Document/I7f2f25c3107111f0aee9df768af9403e/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Do organisations need to ask employees consent to place non-essential Cookies on internal sites/intranets?https://uk.practicallaw.thomsonreuters.com/Document/I94f7d33a109b11f082a5ae4bb4582a09/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/I94f7d33a109b11f082a5ae4bb4582a09/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Thu, 03 Apr 2025 00:00:00 CDThttps://uk.practicallaw.thomsonreuters.com/Document/I94f7d33a109b11f082a5ae4bb4582a09/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29What are the benefits of binding corporate rules vs SCCs/IDTA for an intra group data transfer agreement?https://uk.practicallaw.thomsonreuters.com/Document/I94f7faa7109b11f082a5ae4bb4582a09/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/I94f7faa7109b11f082a5ae4bb4582a09/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Thu, 03 Apr 2025 00:00:00 CDThttps://uk.practicallaw.thomsonreuters.com/Document/I94f7faa7109b11f082a5ae4bb4582a09/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29If a company is developing a new piece of software which will process personal data for clients, as a data processor are they still required to do a DPIA on the new software?https://uk.practicallaw.thomsonreuters.com/Document/Ic9c98d560fb211f0aee9df768af9403e/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/Ic9c98d560fb211f0aee9df768af9403e/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Wed, 02 Apr 2025 00:00:00 CDThttps://uk.practicallaw.thomsonreuters.com/Document/Ic9c98d560fb211f0aee9df768af9403e/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Can an unincorporated partnership be a controller for the purposes of the UK GDPR?https://uk.practicallaw.thomsonreuters.com/Document/Idb40e0d60fb311f0aee9df768af9403e/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/Idb40e0d60fb311f0aee9df768af9403e/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Wed, 02 Apr 2025 00:00:00 CDThttps://uk.practicallaw.thomsonreuters.com/Document/Idb40e0d60fb311f0aee9df768af9403e/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29If the docking clause is included within the EU SCCs, is it still an option to have new data importer parties sign separate bilateral SCCs with the data exporter rather than accede via the docking clause?https://uk.practicallaw.thomsonreuters.com/Document/If95ab2730fd011f082a5ae4bb4582a09/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/If95ab2730fd011f082a5ae4bb4582a09/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Wed, 02 Apr 2025 00:00:00 CDThttps://uk.practicallaw.thomsonreuters.com/Document/If95ab2730fd011f082a5ae4bb4582a09/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29What permissions does a business need to take photographs of office premises? Must permission be obtained from any employees in the office on the day of filming?https://uk.practicallaw.thomsonreuters.com/Document/I726aed26f29a11ef923e8983a02fa0ca/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/I726aed26f29a11ef923e8983a02fa0ca/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Mon, 24 Feb 2025 00:00:00 CSThttps://uk.practicallaw.thomsonreuters.com/Document/I726aed26f29a11ef923e8983a02fa0ca/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Is it reasonable to release some information provided as a confidential reference as part of a DSAR response?https://uk.practicallaw.thomsonreuters.com/Document/I16fff360d1a011efa0f6d5d0d6d6ed12/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/I16fff360d1a011efa0f6d5d0d6d6ed12/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Mon, 13 Jan 2025 00:00:00 CSThttps://uk.practicallaw.thomsonreuters.com/Document/I16fff360d1a011efa0f6d5d0d6d6ed12/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Could you provide some further information on the withdrawal of consent and managing the right to erasure when a controller has shared data with third parties?https://uk.practicallaw.thomsonreuters.com/Document/If9488bf4b24d11efb5eab7c3554138a0/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/If9488bf4b24d11efb5eab7c3554138a0/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Wed, 04 Dec 2024 00:00:00 CSThttps://uk.practicallaw.thomsonreuters.com/Document/If9488bf4b24d11efb5eab7c3554138a0/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29What are adequacy regulations and where can I find a list of countries deemed adequate?https://uk.practicallaw.thomsonreuters.com/Document/I98fc9fb4ad7711efb5eab7c3554138a0/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/I98fc9fb4ad7711efb5eab7c3554138a0/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Thu, 28 Nov 2024 00:00:00 CSThttps://uk.practicallaw.thomsonreuters.com/Document/I98fc9fb4ad7711efb5eab7c3554138a0/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29How often should a company update its cookie policy?https://uk.practicallaw.thomsonreuters.com/Document/Ic4f84b7ea8dd11efb5eab7c3554138a0/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/Ic4f84b7ea8dd11efb5eab7c3554138a0/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Fri, 22 Nov 2024 00:00:00 CSThttps://uk.practicallaw.thomsonreuters.com/Document/Ic4f84b7ea8dd11efb5eab7c3554138a0/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Are there any exemptions under the UK GDPR or DPA 2018 whereby one is entitled to a prisoner's details such as prison number and prison location?https://uk.practicallaw.thomsonreuters.com/Document/I142a5bf4a8de11efb5eab7c3554138a0/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/I142a5bf4a8de11efb5eab7c3554138a0/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Fri, 22 Nov 2024 00:00:00 CSThttps://uk.practicallaw.thomsonreuters.com/Document/I142a5bf4a8de11efb5eab7c3554138a0/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Some employees choose to enable the fingerprint recognition on their work-issued phones. Who is the controller of this data?https://uk.practicallaw.thomsonreuters.com/Document/I19cfd96191d811efb5eab7c3554138a0/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/I19cfd96191d811efb5eab7c3554138a0/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Thu, 24 Oct 2024 00:00:00 CDThttps://uk.practicallaw.thomsonreuters.com/Document/I19cfd96191d811efb5eab7c3554138a0/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Where a non-profit otherwise meets the criteria to fall within the exception contained in Article 9(2)(d) UK GDPR, does it cease to fall within that exception if the personal data will be processed by a third party processor?https://uk.practicallaw.thomsonreuters.com/Document/I329e82e458ad11ef9a5f906d9a270520/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/I329e82e458ad11ef9a5f906d9a270520/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Mon, 12 Aug 2024 00:00:00 CDThttps://uk.practicallaw.thomsonreuters.com/Document/I329e82e458ad11ef9a5f906d9a270520/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Example of legislation which incorporates the Law Enforcement Directive?https://uk.practicallaw.thomsonreuters.com/Document/Ic3e15f3158b011ef9a5f906d9a270520/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/Ic3e15f3158b011ef9a5f906d9a270520/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Mon, 12 Aug 2024 00:00:00 CDThttps://uk.practicallaw.thomsonreuters.com/Document/Ic3e15f3158b011ef9a5f906d9a270520/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Could you give some examples of what is considered "HR data" in relation to the EU-US DPF Framework certifications?https://uk.practicallaw.thomsonreuters.com/Document/I2a4b211a438611ef8921fbef1a541940/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/I2a4b211a438611ef8921fbef1a541940/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Tue, 16 Jul 2024 00:00:00 CDThttps://uk.practicallaw.thomsonreuters.com/Document/I2a4b211a438611ef8921fbef1a541940/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Is a provider of occupational health services a controller or processor?https://uk.practicallaw.thomsonreuters.com/Document/I5d49f1a43ec511ef8921fbef1a541940/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/I5d49f1a43ec511ef8921fbef1a541940/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Wed, 10 Jul 2024 00:00:00 CDThttps://uk.practicallaw.thomsonreuters.com/Document/I5d49f1a43ec511ef8921fbef1a541940/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Can the EU SCCs and UK Addendum be incorporated into an agreement by reference without listing the full text of the EU SCCs and UK Addendum?https://uk.practicallaw.thomsonreuters.com/Document/Ia4abf39f2c9b11ef8921fbef1a541940/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/Ia4abf39f2c9b11ef8921fbef1a541940/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Mon, 17 Jun 2024 00:00:00 CDThttps://uk.practicallaw.thomsonreuters.com/Document/Ia4abf39f2c9b11ef8921fbef1a541940/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Are you aware of any update since July 2023 on the ICO and Gambling Commission publications on CRA data and problem gambling? And do you have any suggested wording for a privacy notice to address the increased scope of data sharing by credit reference agencies?https://uk.practicallaw.thomsonreuters.com/Document/I1ebc54a52a4d11ef8921fbef1a541940/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/I1ebc54a52a4d11ef8921fbef1a541940/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Fri, 14 Jun 2024 00:00:00 CDThttps://uk.practicallaw.thomsonreuters.com/Document/I1ebc54a52a4d11ef8921fbef1a541940/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29When a client signs up to a service can we have one pre-ticked box for all communications that might include direct marketing as well as general service specific messages?https://uk.practicallaw.thomsonreuters.com/Document/Id606a597130f11ef8921fbef1a541940/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/Id606a597130f11ef8921fbef1a541940/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Thu, 16 May 2024 00:00:00 CDThttps://uk.practicallaw.thomsonreuters.com/Document/Id606a597130f11ef8921fbef1a541940/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29If a processor is responsible for their sub-processor and that sub-processor contracts with another sub-contractor to assist with provision of service to its processor, who is responsible for the sub-contractor; the sub-processor or the processor?https://uk.practicallaw.thomsonreuters.com/Document/I98bcfe7b08bc11ef8921fbef1a541940/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/I98bcfe7b08bc11ef8921fbef1a541940/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Fri, 03 May 2024 00:00:00 CDThttps://uk.practicallaw.thomsonreuters.com/Document/I98bcfe7b08bc11ef8921fbef1a541940/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29If a controller has agreed to a general authorisation under Article 28(2), UK GDPR, is it within the processor's discretion whether or not to act upon such an objection?https://uk.practicallaw.thomsonreuters.com/Document/Ic504b7d8093211ef8921fbef1a541940/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/Ic504b7d8093211ef8921fbef1a541940/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Fri, 03 May 2024 00:00:00 CDThttps://uk.practicallaw.thomsonreuters.com/Document/Ic504b7d8093211ef8921fbef1a541940/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Where personal data is being exported from the EU for processing by an importer which is subject to the GDPR by virtue of Article 3's territorial scope requirements, how can the transfer be made lawful?https://uk.practicallaw.thomsonreuters.com/Document/If810f713ea8711ee8921fbef1a541940/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29https://uk.practicallaw.thomsonreuters.com/Document/If810f713ea8711ee8921fbef1a541940/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29Mon, 25 Mar 2024 00:00:00 CDThttps://uk.practicallaw.thomsonreuters.com/Document/If810f713ea8711ee8921fbef1a541940/View/FullText.html?transitionType=Default&contextData=%28sc.Default%29