Accountability, governance and compliance

This subtopic provides guidance on various aspects of the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR) concerning accountability, governance and compliance. This includes identifying and assessing data protection risks, the role of data protection officers (DPOs), data mapping, data protection impact assessments (DPIAs) and the appointment of representatives.

For an introduction to the UK GDPR, see Practice Notes: Introduction to the EU GDPR and UK GDPR and The UK General Data Protection Regulation (UK GDPR).

This subtopic contains:

•
an introduction to the UK GDPR
•
guidance on how to identify and assess data protection risks
•
accountability
•
data protection by design and default
•
guidance relating to DPOs
•
guidance on data mapping
•
guidance on DPIAs
•
information on appointing representatives

Identifying

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

TAKE A FREE TRIAL

Latest Information Law News

Information Law weekly highlights—19 December 2024

Welcome to this week’s edition of the Information Law weekly highlights: a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. Each week these highlights focus on developments in key topics such as data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation.

ICO warns against Google's fingerprinting policy change, issues draft guidance

The Information Commissioner's Office (ICO) has responded to Google's announcement permitting fingerprinting techniques from February 2025, warning that businesses must still comply with data protection laws. The ICO has published draft guidance on how data protection law, including PECR, applies to storage and access technologies such as fingerprinting. The ICO emphasises that organisations must provide transparency, obtain consent, and ensure fair processing when using fingerprinting for advertising purposes. The regulator plans to release a comprehensive strategy in the new year to give users meaningful control over personalised advertisement. A consultation on this guidance opens on Friday, 20 December 2024.

MI5 wins case against lawyer accused of being Chinese spy

Law360, London: A solicitor accused of being a Chinese spy has lost her legal challenge against MI5, after a tribunal found 17 December 2024 that the UK security service acted lawfully when it warned parliamentarians that she was trying to interfere with the political process.

OpenAI, X, Google can use legitimate interest for AI models, EDPB says

MLEX: OpenAI, X, Google and Meta will be able to use legitimate interests as a legal basis for processing personal data for developing and deploying AI models provided that adequate mitigation measures are in place, the European Data Protection Board (EDPB) said in an influential opinion today. The EDPB opinion also touched upon how to address unlawful data processing for AI model development, and in what circumstances AI models can be considered anonymised.

View Information Law by content type :

News