Data and privacy · DPO, privacy counsel, HR director
Run a DPIA on a new staff monitoring tool
An operations team wants to install activity monitoring software on every laptop and has asked legal to sign it off. The assessment works through the processing as described, the lawful basis available and the risks that would remain after mitigation.
- First draft
- A structured first assessment comes back from one run, before the pilot is scheduled.
The problem
Step 01 of 05
Open the assessment matter
The vendor documentation, the proposed configuration, the staff privacy notice and the existing acceptable use policy are uploaded to one matter.
Project Halcyon: SPA warranties and disclosure
Buy-side warranty review, disclosure analysis and cited due-diligence grid.
- Client
- Halcyon Bidco Ltd
- Reference
- WC-2026-0412
- Practice area
- Corporate / M&A
- Jurisdiction
- England and Wales
- Responsible partner
- E. Vance
No conflict check on file.Chat, on this matter
Compare warranties with the disclosure letter.
Three high-priority exceptions require action: the unregistered charge, the change-of-control right and the tribunal claim.
Send a message… (@ to mention tools)BalancedPrepare for- 25 Aug
Disclosure exceptions matrix
Chat
- 21 Aug
Disclosure exceptions matrix
Run · completed · 560 credits
- 18 Aug
Project Halcyon: Disclosure Letter
Document · indexed
- 16 Aug
Project Halcyon: Share Purchase Agreement
Document · indexed
- 4 Aug
Matter opened
Opened
Step 02 of 05
Describe the processing properly
Prepare for: Work-Stream Memo. The first section restates what is actually captured, at what frequency, for how long and by whom it can be viewed, drawn from the configuration rather than the brochure.
Agent
Jurisdiction
Prepare for
Deliver as
Instruction
What should the agent look for?Documents
Drop a contract, or pick one from the matter
Also on the matter
- Offer_letter_v3.pdf2 pages
- Staff_handbook_2025.docx61 pages
- Board_minute_14_Aug.pdf3 pages
Platform model · zero data retention · audit register onStep 03 of 05
Work the lawful basis
Consent is ruled out for an employment context on the reasoning set out, and the necessity and balancing analysis is written for the legitimate interests position.
6 items need your confirmation14 authorities · Where we lookedSenior Associate Employment Contract: English Law Review
Summary
- 1.
Clause 9(c), non-competeHigh
The 12-month prohibition on working for any law firm anywhere in the UK, Ireland or EU, in any capacity, is almost certainly wider than reasonably necessary and therefore unlikely to be enforceable.
Tillman v Egon Zehnder Ltd [2019] UKSC 32 - 2.
Clause 11, data and monitoringHigh
Blanket contractual consent is not an adequate basis for general employment processing, special-category data or unrestricted monitoring.
UK GDPR, Arts 6 and 9 - 3.
Clause 4, holiday carry-overHigh
The unconditional five-day cap conflicts with mandatory carry-over rights where sickness, statutory leave or employer failure prevents leave being taken.
Working Time Regulations 1998, regs 13 to 13A
- 1.
Step 04 of 05
Read the residual risks
Three risks remain after the proposed mitigations, including keystroke capture that would incidentally collect personal messages and credentials.
6 items need your confirmation14 authorities · Where we lookedSenior Associate Employment Contract: English Law Review
Summary
- 1.
Clause 9(c), non-competeHigh
The 12-month prohibition on working for any law firm anywhere in the UK, Ireland or EU, in any capacity, is almost certainly wider than reasonably necessary and therefore unlikely to be enforceable.
Tillman v Egon Zehnder Ltd [2019] UKSC 32 - 2.
Clause 11, data and monitoringHigh
Blanket contractual consent is not an adequate basis for general employment processing, special-category data or unrestricted monitoring.
UK GDPR, Arts 6 and 9 - 3.
Clause 4, holiday carry-overHigh
The unconditional five-day cap conflicts with mandatory carry-over rights where sickness, statutory leave or employer failure prevents leave being taken.
Working Time Regulations 1998, regs 13 to 13A
- 1.
Step 05 of 05
Take the conditions
Action items set out the configuration changes required before rollout, the notice to issue, and the consultation the employer should carry out.
Replace the UK/Ireland/EU non-compete with a 3 to 6 month restriction tied to competing corporate-law work.
Replace blanket data consent with a lawful-basis clause and a separate monitoring notice.
Remove the five-day carry-over cap and reference the statutory carry-over rules.
Narrow the client non-solicit to clients dealt with in the final 12 months.
Add an explicit working-time opt-out withdrawal mechanism.
Confirm the bonus clause states the discretion is exercised in good faith.
What comes back
A document, not a transcript.
- A description of the processing built from the configuration, not the vendor's marketing material.
- A lawful basis analysis with the necessity and balancing reasoning written out rather than asserted.
- Three residual risks after mitigation, including the incidental capture of credentials.
- Pre-rollout conditions covering configuration, notice and staff consultation.
What it does not do
- It does not sign the assessment off. That is the controller's decision and the DPO's advice.
- It does not configure the tool or test what it captures in practice.
- It does not consult the regulator where the residual risk stays high; it names that step and who owns it.