Share on LinkedInShare on LinkedIn

ARTICLE · 23 MAY 2018

GDPR – Key Steps to Compliance

Mishcon de Reya LLP
Mishcon de Reya LLP
Contributor
Mishcon de Reya LLP

Mishcon de Reya LLP

Founded by Lord Mishcon in 1937, in a one-room office in Brixton, Mishcon de Reya now employs over...

View firm profile
Explore more from Mishcon de Reya LLP

There has been a lot of noise in the run up to the 25th of May about what businesses need to be doing under GDPR.

United KingdomPrivacy
Adam Rose
Adam Rose
Jon Baines
Jon Baines
Nina O'Sullivan
Nina O'Sullivan

There has been a lot of noise in the run up to the 25th of May about what businesses need to be doing under GDPR. Unfortunately, this has led to confusion and, in some cases, misinformation, meaning some organisations might be taking unnecessary steps.

No one organisation is the same, but there are a number of core steps that any organisation that is collecting, storing and using individuals' personal data must put in place to ensure they are compliant with GDPR:

  • Information audit: you need to know what personal data you hold and how you use it across the organisation.
     
  • Communicate to your customers, employees and other relevant individuals: you need to be transparent about what you are doing with individuals' personal data, and under GDPR you must give significantly more information than under the previous data protection law. You will need to update your Privacy Policies and also relevant documents such as your Terms of Business and Employment Contracts/

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

ICO Cookie Crackdown 2.0: The ICO’s New Storage And Access Technologies Guidance

The UK Information Commissioner's Office has finalized its guidance on storage and access technologies, expanding compliance requirements beyond traditional cookies to include tracking pixels, device fingerprinting, and web storage. Organizations must now navigate stricter consent standards and three new narrow exceptions introduced by the Data (Use and Access) Act 2025, while facing significantly increased enforcement penalties of up to £17.5 million or 4% of annual worldwide turnover.
United KingdomPrivacy
ZwillGen
ZwillGen
Article

European Commission Press Release: EU AI Act Transparency Enforcement Starts This Sunday! Do You Know Who Your Chatbots Are? We Break Down The Commission’s Guidelines On Transparency Below

The European Commission has announced that EU AI Act transparency rules take effect August 2, 2026, requiring chatbots to identify themselves, deepfakes to be labeled, and AI-generated content to be marked. Organizations must assess whether their AI systems trigger disclosure, labeling, or content-marking requirements, with limited exceptions and penalties reaching €15 million or 3% of global turnover for noncompliance.
GlobalPrivacy
Seyfarth Shaw LLP
Seyfarth Shaw LLP
Article

ICO Consults On Draft Guidance On Anonymisation And Pseudonymisation For Research

The Information Commissioner's Office has launched a consultation on draft guidance addressing anonymisation and pseudonymisation for research, archiving and statistical purposes. This guidance provides critical insight into how organisations should apply data minimisation principles in modern research practices, including AI development, trusted research environments, and synthetic data generation.
United KingdomPrivacy
Burges Salmon LLP
Burges Salmon LLP
Article

ICO Launches Consultation On Draft Guidance Regarding Anonymisation And Pseudonymisation For Research Purposes

The UK's Information Commissioner's Office has opened a public consultation on draft guidance addressing anonymisation and pseudonymisation techniques for processing personal data in research, archiving, and statistical contexts. The guidance explores critical distinctions between anonymous and pseudonymous data, outlines required safeguards under UK GDPR, and examines emerging technologies including synthetic data and privacy-enhancing tools.
United KingdomPrivacy
A&O Shearman
A&O Shearman
Article

UK Right To Work Checks: What Changes On 1 October 2026

The UK's right-to-work regime is undergoing a fundamental transformation that will extend compliance obligations far beyond traditional employment relationships. From 1 October 2026, businesses engaging contractors, agency workers, platform-based workers, and complex supply chains will face new liability risks that travel up entire contracting chains. Understanding these changes and implementing the required contractual terms, substitution controls, and identity verification systems is now critical for orga
United KingdomEmployment and HR
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

Meta's $18 Billion Settlement: Reckoning Or Managed Exit?

Meta has agreed to pay up to $18 billion over 10 years to settle claims by 52 US state and territory attorneys general in the largest state consumer-protection settlement in American history outside tobacco. The settlement imposes binding child-safety obligations including time limits and age assurance, but leaves the core algorithmic feed unchanged and raises questions about whether this represents genuine accountability or a commercially managed outcome.
United KingdomLitigation, Mediation & Arbitration
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

Samsung Ordered To Pay The Swatch Group US$11.6 Million In Damages For Trade Mark Infringement

The High Court has awarded the Swatch Group US$11.6 million in negotiation damages against Samsung for trade mark infringements involving watch face apps on the Galaxy App store. Rejecting both parties' extreme valuations of US$170 million and US$301, the court established important principles for assessing damages when brand owners don't license their marks and no comparable market royalties exist.
United KingdomIntellectual Property
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

The New Trade Union Right Of Access: What Employers Need To Do Now

From 30 October 2026, independent trade unions will gain statutory rights to access workplaces - both physically and digitally - regardless of existing union membership or recognition. With tight statutory deadlines for responding to access requests and penalties reaching £500,000 for repeated breaches, employers face a significant shift in how unions can establish themselves in previously non-unionised workplaces.
United KingdomEmployment and HR
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

Manchester City: Independent Commission Publishes Decision On Premier League Charges

An independent Premier League Commission has found Manchester City in breach of financial rules spanning nine seasons, with findings that the club artificially inflated revenues and reduced costs by over £900 million. The decision marks what the Premier League describes as the most significant case in its history, though Manchester City strongly disputes the findings and intends to appeal, setting the stage for further proceedings that could reshape English football's regulatory landscape.
United KingdomCorporate/Commercial Law
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

Can Insurers Avoid Covering Defence Costs Under A D&O Policy Before Fraud Is Proved?

In a landmark ruling, the English Commercial Court has determined that insurers must continue advancing defence costs under D&O policies even when fraud allegations are pending, provided a non-avoidance clause is present. The decision addresses whether such clauses violate public policy and establishes that insurers cannot withhold coverage until fraud is either admitted or proven by final court decision.
United KingdomInsurance
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

Protecting Reputation In The AI Era: How To Prepare, Monitor And Respond

AI has fundamentally altered how reputation is shaped, with AI-powered search engines now delivering authoritative-seeming summaries rather than traditional search results. From deepfakes and voice cloning to coordinated review bombing and bot-driven harassment campaigns, the threats are evolving rapidly—but so are the defensive tools available to those who understand how to deploy them strategically.
United KingdomMedia, Telecoms, IT, Entertainment
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

Protecting Reputation In The AI Era: Legal Levers For AI-driven Reputational Harm

AI-generated content poses unprecedented reputational threats, from deepfakes to coordinated bot campaigns. While English law lacks AI-specific remedies, existing legal frameworks—including harassment protections, defamation claims, and the Online Safety Act 2023—offer powerful tools for those who act decisively. The emerging question of AI liability itself remains untested, focusing attention on the human decisions behind AI deployment.
United KingdomLitigation, Mediation & Arbitration
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

R (University Of Sussex) v Office For Students: Reshaping The OfS's Guidance On Freedom Of Speech And Academic Freedom

The High Court's landmark ruling in R (University of Sussex) v Office for Students has fundamentally reshaped how the OfS regulates freedom of speech in higher education, leading to revised guidance that requires holistic policy assessment and proper consideration of remedial actions. With the new free-speech complaints scheme now operational, institutions face heightened scrutiny of their policies and must ensure their frameworks protect lawful speech while meeting equality obligations.
United KingdomConsumer Protection
Mishcon de Reya LLP
Mishcon de Reya LLP