2 Apr 2026 • Article 3 min read
Services
Information is one of your most valuable assets – and one of your biggest risks.
Our Data Protection & Information Law team helps organisations handle personal data and information requests with confidence. We bring together specialists from across litigation, employment, corporate, housing and regulatory work, so you get clear, practical advice that fits how your organisation actually operates.
We work daily with organisations where data risk is high – particularly in social housing, public services and complex employment environments. We understand the pressures you face: tight deadlines, complex governance, operational demands and close regulatory scrutiny. Rather than simply mapping the law, we focus on what you need to do next.
High-profile breaches, increasing expectations from the Information Commissioner’s Office (ICO) and a sharper focus on accountability leave little room for error. We help you think ahead. Whether you are reviewing governance, planning a major project, preparing for an investigation or recovering from an incident, we set out clear priorities and a realistic route forward.
Our work spans UK GDPR and the Data Protection Act 2018, sector-specific rules and the full range of information access regimes, including the Freedom of Information Act (FOIA) and the Environmental Information Regulations (EIR). We help you balance transparency with the need to protect sensitive, personal and commercially valuable information.
Our Services
Whether you need to strengthen compliance, respond to a breach, manage a difficult subject access request or handle overlapping FOIA and data protection issues, we provide structured, actionable advice so you can move quickly and stay in control.
We act for:
- Registered providers and other social housing organisations
- Local authorities and other public sector bodies
- Employers across a range of sectors
- Regulators and quasi-public bodies
- Commercial organisations
Data Protection
We support organisations at every stage of their data protection lifecycle – from routine compliance to urgent breach response. Our advice is practical, structured and grounded in the realities of your operational environment.
GDPR compliance
We review and refine policies, procedures and supporting documents to keep your organisation aligned with regulatory expectations. For clients who need a full reset, we design tailored frameworks supported by UK GDPR compliance audits and targeted data protection policies and contracts.
Data Protection Impact Assessments and audits
When you are planning a new project, we help you identify risks early, assess alternative approaches and document decisions clearly. Our audit work gives you a focused view of what is working, what is vulnerable and where immediate steps are required.
Data sharing
Clear, well-structured data-sharing arrangements reduce risk. We advise on collaborative projects, joint ventures and public sector partnerships, providing legal guidance on data sharing agreements that aligns commercial aims with compliance obligations.
Personal data breaches and notification
If you experience a breach, we help you contain it quickly, manage internal communication and assess whether the ICO needs to be notified. Where the regulator becomes involved, we guide you through the process, offering legal support and advice on ICO investigations and enforcement to keep disruption to a minimum. We can also help you deal with any consequential legal claims that may arise following a personal data breach.
Data subject rights
Responding to data subject requests requires judgment and efficiency. We help you apply exemptions, manage deadlines and review material for disclosure. Our subject access requests legal assistance gives you a clear plan for handling even the most complex requests.
Contracts and commercial arrangements
We draft and review data protection clauses across a wide range of commercial contracts to ensure roles, responsibilities and liabilities are clearly set out.
Data Protection Compliance Health Check
Our Health Check benchmarks your compliance against UK GDPR and the Data Protection Act 2018, giving you a structured set of priorities and practical next steps.
Freedom of Information Act and EIR
We advise on all aspects of FOIA and the Environmental Information Regulations, for both public authorities and organisations engaging with them.
For public authorities, we:
- Help design and refine FOI procedures and training
- Advise on applying exemptions and exceptions robustly
- Support decisions through internal review, ICO investigation and appeal
- Draft and refine FOI-related provisions in public sector contracts
For commercial organisations, we:
- Help you make targeted FOI and EIR requests where access to information is important to your commercial or strategic objectives
- Advise on how your information is described and protected in public sector contracts
- Support you in challenging inappropriate disclosure of sensitive or confidential information
Our team has successfully challenged ICO decisions on the applicability of FOIA, protecting clients from unfair or excessive disclosure of commercially sensitive material. We combine a detailed understanding of the legislation with practical experience of how requests are handled in reality.
Meet the Team
Our Data Protection & Information Law practice is led by Hetal Ruparelia and brings together lawyers from across litigation, employment, corporate, housing and regulatory work. That breadth means you receive senior-level insight backed by hands-on experience of how organisations operate day to day.
We regularly liaise with the ICO, act in disputes where data plays a central role, and support organisations through high-risk operational change – from new systems and restructures to investigations and enforcement. Whatever the issue, you can expect clear thinking, steady judgment and advice that is shaped around your organisation, your people and your priorities.
Contact us
For initial enquiries please complete this form and send us a message. We’ll direct your enquiry to the appropriate person.
Related
10 Mar 2026 • Article 4 min read
New Transparency Requirements for Land Deals: Contractual Control Agreements and Rights
6 Feb 2026 • Article 1 min read
Data (Use and Access) Act 2025 update: Secondary legislation gives effect to majority of key provisions
23 Jan 2026 • Article 4 min read
STAIRs Update: Housing Ombudsman consults on its role under STAIRs
11 Dec 2025 • Article 3 min read
STAIRs Update: Regulator Consults on Consumer Standards changes
13 Oct 2025 • Article 6 min read
Data Centres and the UK Planning System: A Sector in Flux
1 Oct 2025 • Article 3 min read
Supply chain risk in the wake of the JLR Cyber Incident
17 Jul 2025 • Article
Data Protection Considerations in Residential Personal Emergency Evacuation Plans (PEEPs)
26 Jun 2025 • Article
Who’s policing the platform? Platform liability and the rising tide of online fraud
25 Jun 2025 • Article
Regulatory Wake Up Call: Information Commissioner Fines 23andMe £2.31m for Failing to Protect Genetic Data
27 May 2025 • Article
Learning from retail cyberattacks - our practical cybersecurity tips
18 Dec 2024 • Article