Notice: Function _load_textdomain_just_in_time was called incorrectly. Translation loading for the acf domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /var/www/vhosts/triadclients.com/tollers.triadclients.com/public_html/wp-includes/functions.php on line 6121
Commercial Law FAQs | Tollers Solicitors

Commercial Law FAQs

Data Protection
What should my business's data protection policy cover?

Internal data protection policies (DDP) should set out the principles and legal conditions that organisations must satisfy when obtaining, handling, processing, transporting or storing personal data in the course of their operations and activities, including customer, supplier and employee data. This should provide a clear guide for employees so they know how to handle and process data in compliance with the law.

The six key privacy principles to be set out in the DPP are as follows: (1) Lawfulness, fairness and transparency - personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject; (2) Purpose limitation – there must be a specified, explicit and legitimate purpose for which personal data is collected; (3) Data minimisation – only essential personal data which is relevant to the purpose for which the information is processed can be collected and stored; (4) Accuracy - personal data must be accurate and kept up to date. Any incorrect data must be updated or deleted without delay; (5) Storage limitation - personal data which allows an individual to be identified must only be kept for as long as is necessary for the purposes for which the data is processed; and (6) Integrity and confidentiality – measures should be put in place to protect any data held to ensure that it is kept confidential and is not at risk of being seen or used by anyone who is not authorised to process the data.

There is also an accountability principle which should also be covered. This will deal with what data the controller is responsible for and demonstrate how it is in compliance with the data protection principles (e.g. that there is an appointed data protection officer, regular training is to be carried out by employees etc.).

The grounds for processing data should also be covered in the DPP. There are six grounds for which data can be lawfully processed (1) consent from the data subject, (2) that it is necessary in connection with a contract; (3) it is necessary to comply with legal obligation to which the controller is subject, (4) to protect the vital interests of the data subject or another person, (5) the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or (6) the processing is necessary for the purposes of the legitimate interests pursued by the controller. The policy should set out what is required to satisfy the relevant grounds which the company is seeking to rely on and ensure this process is followed in order to reduce the risk of there being any data protection breaches.

Data Protection
When do you need a solicitor for specialised data protection legal advice?

There will be certain things which you will be able to deal with internally such as compliance on a day to day basis with your data protection policies. However, this is an area of law for which it would always be best practice to get an opinion or to take advice on any matters which you are unsure or concerned about. Please note, that the Information Commissioners Office (ICO- ico.org.uk) has a very useful information service and although they do provide a “policing” function as the UK data protection authority they are very concerned about prevention. Consequently, they are very approachable.

When it comes to matters such as subject access requests (SAR) you need to seek legal advice as soon as possible. There is a strict time limit of one month of receipt in which the request must be dealt with and there are penalties for non-compliance within this time period. However, even more importantly, you could be investigated by the ICO. Most businesses run into problems with respect to SARs because they simply ignore them.

Data Protection
What are the main principles of GDPR?
The UK GDPR sets out seven key principles which should be considered when processing personal data. These key principles are as follows: (1) lawfulness, fairness and transparency, (2) purpose limitation, (3) data minimisation, (4) accuracy, (5) storage limitation, (6) integrity and confidentiality (security) and (7) accountability.
Data Protection
What are the requirements for organisations to keep data secure?
One of the key principles of GDPR is to process personal data securely by means of ‘appropriate technical and organisational measures’. An organisation should consider aspects such as risk analysis, organisational policies and physical and technical measures in order to comply with this requirement. An organisation will also need to take into account additional requirements about the security of its processing which also apply to data processors.
Data Protection
Does my business need to have a Data Protection Officer (DPO)?

If you are not a public authority or body, do you monitor individuals on a large scale (eg tracking an individual’s behaviour on the internet or on CCTV), do you not process as your core activities “special categories” of personal data (eg racial or ethnic origin) or criminal convictions or offences data then you don’t need to appoint a DPO. You can do that voluntarily but you must register the individual with the Information Commissioner’s Office (ICO) and the DPO does have to take on a high level of responsibility. Having said that, you should have somebody in the organisation that is responsible for data protection.

Do access the ICO’s website(ico.org.uk) for a variety of very helpful information including guidance for DPOs.

Data Protection
How does data protection apply during a business sale or business transfer?
Both the buyer and the seller need to fully understand what personal data is used by the seller, how that is processed within the business and who that data is supplied to. There also needs to be a high level of understanding regarding the sellers data protection compliance and that can range from registration with the ICO to practices and procedures (eg privacy statements) and awareness and methodology for dealing with subject access requests (SARs). Data protection continues to be a substantial element in transaction work and ignore that element of the deal can be very costly.
Data Protection
How should my business handle data protection for deceased individuals?
Data protection legislation only applies to an identifiable living individual. However, it is good practice to only maintain personal data records for a reasonable period. If a person dies the organisation holding the records should consider whether their information continues to be relevant and should be retained. There are also specific rules under the Freedom of Information Act 2000, Environmental Information Regulations 2004 and Access to Health Records legislation.
Data Protection
Can a data protection officer (DPO) be prosecuted?
In short, a DPO cannot be prosecuted merely for failing to perform the ascribed role of a DPO. There is the possibility of a potential civil claim or breach of employment contract but there is no statutory criminal penalty against a DPO. For example, there are some obligations placed on the DPO such as compliance with secrecy and confidentiality, and there is a requirement to comply with the terms of their employment contract. It is worth noting that organisations are forbidden from dismissing or penalising a DPO in connection with the performance of their role as DPO (Article 38(3), UK GDPR).
Data Protection
Can I rely on a 'soft opt-in' for marketing under UK data protection laws?
‘The soft opt-in’ is a term used for where an organisation sends marketing emails or texts using customer data they gathered when that customer bought or expressed interest in their products or services. There are certain criteria which need to be met to rely on the soft opt-in. You can only use the soft opt-in when you're sending marketing emails or texts to offer similar goods or services. The soft opt-in can only be used when you’re selling something or negotiating to sell something (source ICO).
Data Protection
What happens if your business breaches data protection law?
The Data Protection Act 2018 provides for maximum fines of up to £17.5 million or 4% of the undertaking’s total annual worldwide turnover, in addition to fines, there may also be criminal offences.
Data Protection
What is the law on data protection for businesses?
The law on data protection for organisations is The Data Protection Act 2018. As a result of Brexit, the UK stopped being a part of the EU and therefore the EU General Data Protection Regulation (‘EU GDPR’) cease to be applicable. The provisions of the EU GDPR has been incorporated directly into UK law as the UK General Data Protection Regulation (‘UK GDPR’). The UK GDPR sits alongside The Data Protection Act 2018. The rules on data protection must be followed if your business stores or uses personal information. The main data protection rules are set out in the UK GDPR. The UK GDPR set out seven key principles:
  • Lawfulness, fairness and transparency
  • Purpose limitation
  • Data minimisation
  • Accuracy
  • Storage limitation
  • Integrity and confidentiality (security)
  • Accountability

All things Tollers

We partner with...

Headway Accreditation 2024
SIA Business Member Badge
Santander Logo
Barclays Logo
HSBC Logo
Sports Aid Logo
Harlestone Park Logo
NGC logo
Northamptonshire County Cricket Club Logo
Legal Fees Insurance Logo
Muddy Stilettos
1 Waterside Way
Bedford Road
Northampton
NN4 7XD
Sat Nav: NN4 7XD
Telephone: 01604 258 558
View our Legal Services
2 Exchange Court
Cottingham Rd
Corby
NN17 1TY
Sat Nav: NN17 1TY
Telephone: 01536 276 727
View our Legal Services
6 Arlington Court
Arlington Business Park
Whittle Way
Stevenage
Sat Nav: SG1 2FS
Telephone: 01438 901 095
View our Legal Services
Moorgate House
201 Silbury Blvd
Milton Keynes
MK9 1JL
Sat Nav: MK9 1JL
Telephone: 01908 396 230
View our Legal Services
148 Bedford Rd
Kempston
Bedford
MK42 8BH
Sat Nav: MK42 8BH
Telephone: 01234 857 014
View our Legal Services
4 Mill St
Oakham
LE15 6EA
Sat Nav: LE15 6EA
Telephone: 01572 756 866
View our Legal Services