The requirement to appoint a GDPR Representative is often misunderstood as a technical formality. In practice, the role serves a specific regulatory purpose within the GDPR framework....
If your organisation is based outside the EU or the UK but has customers or users there, you may have come across references to an EU Representative...
Understanding whether your organisation has an “establishment” in the EU or the UK is crucial when determining its obligations under both the EU GDPR and the UK...
For many organisations, the Record of Processing Activities (ROPA) is one of the least understood - and most frequently misunderstood - requirements under the General Data Protection...
For sponsors established outside the European Union or the United Kingdom, the conclusion of a clinical trial often prompts a reassessment of data protection obligations. ...
For sponsors established outside the European Union or the United Kingdom, the conclusion of a clinical trial often prompts a reassessment of data protection obligations. ...
In this series of articles we are unpacking some of the questions that we frequently get asked about the role of data protection representatives....
From 1 June 2026, organisations will be legally required to have a publicly accessible internal data protection complaints procedure under the UK’s Data (Use and Access) Act...
In a pivotal ruling, the Court of Justice of the European Union (CJEU) has clarified that pseudonymized data may not always constitute personal data for the recipient,...
Following extensive parliamentary debate between the upper and lower chambers...