GDPR legal advice

Does GDPR apply to me and my business?

Whether you're a small business, SME, or international organisation, if you handle personal data relating to UK individuals, you must comply with the UK GDPR. The regulation applies to both data controllers (those who determine how and why personal data is used) and data processors (those acting on behalf of others).

Organisations are accountable for any "processing" of personal data which includes collecting, storing, using, sharing, backing up, or deleting information that could identify a living person. The data must be securely protected, and organisations must be able to demonstrate that appropriate measures are in place.

The UK General Data Protection Regulation (UK GDPR) came into effect on 1 January 2021, following the UK’s departure from the EU. It sits alongside the Data Protection Act 2018 and mirrors many of the principles of the original EU GDPR that applied from 25 May 2018.

Why GDPR compliance is important your business

With increased regulatory scrutiny and rising public concern over data privacy, compliance with the UK GDPR is more important than ever. Beyond avoiding fines and reputational damage, good data governance helps build trust with customers, employees and suppliers.

Whether you're managing subject access requests, responding to a data breach, or reviewing your internal policies, our experienced data protection solicitors provide clear, practical advice to support compliance and reduce risk.

At Wright Hassall, we work with clients across all sectors to ensure their data protection frameworks are robust, compliant, and proportionate to the scale and nature of their operations.

Understand the impact of the GDPR

Many organisations struggled to fully understand the impact these changes will have and are not sufficiently prepared to implement the changes needed to be compliant. The complexities of the GDPR mean a ‘one size fits all’ approach may leave organisations at risk of a breach.  

What is the cost if a business doesn't comply with the GDPR?

It is critical to any business that they are aware of, and have a plan to deal with personal data. The costs of not complying with the GDPR are high. Financially, a business can face fines of up to 4% of annual turnover or 20 million euros, whichever is the higher.

How to check a business is compliant?

It’s important that your business looks ahead to GDPR and lays the foundations to ensure compliance. Your approach should include:

• A review of the GDPR guidance.
• An assessment of your data processing activities.
• The systems and processes using data, and for what purpose.
• Current compliance measures and procedure.
• Implementation of internal procedures.
• A GDPR compliance gap analysis.
• Designing and implementing a set of compliance guidelines, or building on guidelines already in place.
• Any technical or procedural changes needed.
• Designing and implementing training programmes.
• Monitoring compliance.

How can we help?

Our team of GDPR and data protection specialists offer the following services:

• An audit of your organisation to help identify what data you hold, the purposes for which you process that data, the current measures you have in place to comply with data protection legislation and where the key risks of non-compliance are.
• Reviewing your existing contracts with employees, contractors and suppliers to identify whether they address data protection and, more specifically, the GDPR.
• Varying your existing contracts so that they address the changes brought about by the GDPR and adequately protect you going forward.
• Advising you on steps to take to comply with privacy by design requirements for new technology projects.
• Drafting of applicable policies and procedures to support compliance with the new regime.
• Whether you are a data processor or a data controller under a particular contractual arrangement, we can advise you on what your obligations are under the current data protection regime and how these will change once the GDPR comes into force.
• What due diligence you should be carrying out when looking to engage a third party as a data processor.
• Tailored training on what the GDPR will mean for your business and what steps you can take towards meeting the requirements of the legislation.
• Data breach incident response support and advice.
• Advice on responding to subject access requests, guidance around applicable procedures to ensure requests are managed and risk of confidential information being disclosed is mitigated.

Contact us