Privacy and data protection
DSARs on the clock, Article 28 reviews, DPIAs, and a register of what the ICO said this week.
One agent handles the privacy workflow end to end inside the matter, and a scheduled watch handles the reading, from the ICO to the EDPB.
| Development | Pack | Materiality | Deadline | Owner |
|---|---|---|---|---|
| FCA consultation on AI use in regulated firms | UK financial services | High | 6 Oct 2026 | R. Okafor |
| ICO guidance update on employee monitoring | Data and privacy | Medium | 14 Nov 2026 | S. Patel |
| SRA guidance on new technology and COLP duties | UK core legal | High | 2 Dec 2026 | COLP |
A privacy horizon register: an ICO guidance update with its materiality, a deadline and an owner.
The day this changes
Before
Privacy work runs on two clocks. The statutory one: the DSAR arrived on the 3rd and the answer is due on a date the client cannot move.
The regulatory one: the ICO publishes, the EDPB opines, and the advice you gave in March quietly stops being right.
Article 28 processor terms are the quiet problem. Every client signs dozens, almost nobody reviews them properly, and the gaps only matter after an incident.
After
The Privacy and Data Protection Agent handles the DSAR workflow inside the matter: the exemptions turn on the documents, and it reads the documents.
Horizon Scanning watches the ICO, the EDPB, the EDPS and the CNIL on a schedule and keeps a register of what changed.
An Article 28 review comes back against the client's own terms, with the gaps quoted, for a privacy lawyer to sign.
Grounded on the matter
Open the matter and load the documents, and the DSAR workflow reads them, because the exemptions turn on what is actually in the file. An Article 28 review runs against the client's own processor terms and quotes the gap. The conflict check runs on open, and every run attaches to the client, so the DSAR clock and the answer sit in one place with the deadline recorded.
See how matters workClient
Calder & Finch LLP
Reference
CF-2026-0184
Practice area
Employment
Jurisdiction
England and Wales
Responsible partner
R. Okafor
Status
Open
Conflict check on open: clear across 214 matters searched.
Clear- Matter opened: conflict check run automatically.
- Documents added: employment contract, board minutes.
- Contract Agent run completed: 6 action items, 14 authorities.
The privacy matter, with the conflict check that runs on open.
A deliverable, not a chat
The run returns a DSAR response pack, a DPIA, or an Article 28 gap analysis, not a chat reply. The processor terms are quoted, never paraphrased, and the exemptions are tied to the documents they apply to. Set Prepare for a Client Update and the same analysis comes back in plain English. What you keep is a document a privacy lawyer can settle, ready to download as Word.
See the agentsContract Agent Completed
Senior Associate Employment Contract: English Law Review
Calder & Finch LLP · Employment · CF-2026-0184
Summary
Overall risk is HIGH. The UK/Ireland/EU non-compete is likely unenforceable, while the holiday carry-over cap and blanket data/monitoring consent require replacement; the remaining covenants, working-time opt-out and bonus clause should be narrowed and clarified.
- 1. Clause 9(c), non-compete: High: the 12-month prohibition on working for any law firm anywhere in the UK, Ireland or EU is wider than reasonably necessary.§ Tillman v Egon Zehnder Ltd [2019] UKSC 32
- 2. Clause 11, data and monitoring: High: blanket contractual consent is not an adequate basis for general employment processing or unrestricted monitoring.§ UK GDPR
An Article 28 review with the processor terms quoted and gaps flagged.
Verified, then shareable
The register cites the ICO or EDPB instrument behind every development, and any authority in the advice is fetched from the approved sources and marked with a verdict. Read the verdicts, then share the response with the client through a passcode link that logs every view on the matter. The advice you gave, and the reading behind it, both carry a date you can show.
See horizon scanning| Development | Pack | Materiality | Deadline | Owner |
|---|---|---|---|---|
| FCA consultation on AI use in regulated firms | UK financial services | High | 6 Oct 2026 | R. Okafor |
| ICO guidance update on employee monitoring | Data and privacy | Medium | 14 Nov 2026 | S. Patel |
| SRA guidance on new technology and COLP duties | UK core legal | High | 2 Dec 2026 | COLP |
The privacy register, each item citing the ICO or EDPB instrument.
A weekly ICO and EDPB horizon digest costs about 64 credits, about £0.64. The figure is observed, not a saving claim.
See pricingObjections
Our documents are confidential.
Files sit in Microsoft Azure UK, encrypted in transit and at rest, scoped to the matter, and never used to train a model. The security statement sets out the detail.
Read the security statementWe already have Copilot.
A general assistant answers from the open web and will cite a case that does not exist. This works from a closed list of primary law and marks each authority verified, needs a check, or not found.
See how verification worksOur COLP will not sign this off.
Sources are a closed list, every citation carries a verdict, and every run, share and check sits on a register you can export or print as an inspection bundle.
See the audit registerRun a DSAR workflow on one of your own matters.
Free plan, two seats, 500 welcome credits, no card.