Data, Privacy, GDPR & Regulation

Expert Data Protection & GDPR Solicitors for Businesses

200+ Consultants

Across England & Wales

170+ 5 Star Reviews on TrustPilot

Data, Privacy & GDPR at Woodstock Legal Services


Handling personal data comes with strict legal obligations, and getting it wrong can lead to regulatory action, fines and lasting damage to your reputation. Whether you hold customer, employee or supplier data, it’s essential to understand your responsibilities. Woodstock Legal Services helps businesses of all sizes comply with data protection law across England and Wales.


Our data protection lawyers advise on UK GDPR and Data Protection Act compliance, privacy notices and policies, data processing and sharing agreements, international data transfers, cookies and direct marketing, data breaches, and subject access requests.


You’ll work directly with an experienced lawyer who explains your obligations in plain English and gives you practical advice that keeps your business compliant and protects your customers.


Data Protection Compliance


Compliance starts with understanding what personal data you hold, why you hold it and who you share it with. From there, you need the right documents and processes to show you’re handling data lawfully, fairly and securely.


Our lawyers review how your business uses personal data and identify any gaps. We then put the right documentation in place, including privacy notices, data protection policies, data processing agreements and data sharing agreements. We also advise on international transfers, cookies and direct marketing rules. With data protection law continuing to evolve, we’ll help you keep your approach up to date.


We’ll give you a clear, proportionate compliance framework that works for your business without unnecessary complexity.


Data Breaches & Subject Access Requests


Even with the best systems in place, data breaches can happen, and individuals have strong rights over their personal data. How you respond can make a significant difference to the outcome.


Our data protection lawyers advise on responding to data breaches, including whether to report a breach to the Information Commissioner’s Office (ICO) and to affected individuals. We also help you respond to subject access requests and other data rights requests, especially complex or sensitive ones, such as those linked to employment disputes. We work closely with our employment and technology teams where issues overlap.


We’ll help you respond quickly and correctly, protecting your business and the people whose data you hold.

Get in Touch With Our Media & Technology Team

Brief Us Now

Or call us today on 0330 088 5792 or send us an email

Data, Privacy, GDPR & Regulation FAQs

  • Does UK GDPR apply to my business?

    If your business collects or uses personal data about individuals, such as customers, employees or suppliers, UK GDPR is likely to apply. This includes small businesses and sole traders. The obligations you need to meet depend on the type and amount of data you handle and how you use it.

  • What should a privacy notice include?

    A privacy notice should explain what personal data you collect, why you collect it, the lawful basis for using it, who you share it with, how long you keep it and what rights individuals have. It must be clear, concise and easy to understand. We can draft or review your privacy notice.

  • Do I have to report a data breach?

    If a personal data breach is likely to result in a risk to people’s rights and freedoms, you must usually report it to the ICO within 72 hours of becoming aware of it. If the risk is high, you may also need to tell the individuals affected. You should keep a record of all breaches, whether reported or not.

  • How long do I have to respond to a subject access request?

    You must usually respond to a subject access request within one month of receiving it. This can be extended in some cases, for example if the request is complex. Some information can be withheld if an exemption applies. We can help you respond correctly, particularly to complex or sensitive requests.

  • What is a data processing agreement?

    A data processing agreement is a contract required when a business (the controller) uses another organisation (the processor) to handle personal data on its behalf, such as a payroll provider or cloud software supplier. It sets out how the data must be handled and protected. We can draft or review these agreements.

Why Choose Woodstock Legal Services?

Low Caseloads: Your Matter Gets Time

As consultants, our solicitors manage their own caseloads and only work for a handful of clients at any one time. Whether you’re negotiating a production deal or a software licence, your matter gets the time, care and attention it deserves.

Proactive Updates: No Chasing

Our consultancy model means you deal directly with your lawyer, not a call centre or a rotating team. They keep you informed at every stage and are on hand to answer your questions, so you’ll never need to chase.

Real Industry Experience

Our media lawyer has advised high-profile artists, independent production companies and major international studios. You’ll get practical advice from someone who understands your industry, not just the law.