The General Data Protection Regulation (GDPR) is the European Union’s new data protection regime which came into effect in May 2018.

It has wide territorial scope – it applies not only to organisations with a physical presence in EU member states, but also to entities located anywhere in the world, if they are processing personal information about, or monitoring the behaviour of, EU citizens.

GDPR also introduces vastly increased fines. The maximum fine for a serious infringement is 4% of annual worldwide turnover, or €20 million, whichever is the greater. Therefore even a smaller organisation could potentially face an administrative fine of up to €20m.

Organisations to which GDPR applies must, if they are not themselves established in an EU member state, formally designate a representative established within the EU, for the purposes of GDPR compliance. It is easy for the data protection authorities to check whether or not you have done this, and there are only limited exceptions to the rule. This obligation will potentially apply also to UK-based entities, following Brexit, and to any organisations that trade with the UK, they'll need to appoint a UK Representative if they have no physical base in the UK. 

Contact our experienced lawyers to discuss your requirements and explore how we can help make your organisation GDPR-compliant.


We can help you by:

  • Acting as your Article 27 EU Representative  through our affiliate company, Willans Data Protection Services. Find out whether your organisation needs to appoint an EU representative.
  • Acting as your UK Representative - find out whether you need to appoint a UK representative
  • Gap analysis and advice on remedial actions
  • Data audits and compilation of Article 30 records (legally required records of your data processing activities)
  • Developing your data protection policies, procedures and privacy notices
  • Advice on measures to be taken to ensure GDPR compliance when transferring data out of the EU
  • Data protection impact assessments – to be undertaken when new processes or technologies are introduced which might affect the rights and freedoms of data subjects
  • Drafting agreements (which are legally required) to regulate your relationship with other entities who may be processing personal data on your behalf, or on whose behalf you may be processing personal data.

"We have had a great experience working with you and your team both personally and professionally."

"I personally contact about 100 law firms worldwide each year and you are undoubtedly on the top tier."

GDPR and data protection team

Please contact the lead lawyers in the team:

Matthew Clayton MA LLM (Cantab)

Kym Fletcher LLB (Hons)

Matthew Clayton

“... the incredibly professional corporate and commercial group ...” Legal 500

Kym Fletcher