Technology, data protection and AI law

Most businesses now collect personal data, rely on software they did not write and use AI in some part of their work. Each of those carries legal obligations, and for a business trading in both the UK and the EU, the obligations come from two regimes that are close but no longer the same.

We advise businesses on UK data protection law, including the changes made by the Data (Use and Access) Act 2025, on the EU GDPR and EU AI Act where they reach UK businesses, and on the contracts that sit behind technology products and services. Our advice is practical: what you need to do, what you can deprioritise, and what documents you need.

What we do

Data protection compliance

We advise on compliance with the UK GDPR, the Data Protection Act 2018 and the EU GDPR. That includes privacy notices, records of processing, lawful bases, data subject requests, data protection impact assessments, and the complaints process that controllers have had to operate since 19 June 2026.

Data breaches

We help businesses respond to personal data breaches: assessing whether to notify the ICO or an EU supervisory authority and affected individuals, managing communications, and reducing the risk of repetition. Where a breach affects people in more than one country, we coordinate the response.

International data transfers

We advise on transferring personal data between the UK, the EU and other countries, including the transfer mechanisms and risk assessments required.

Artificial intelligence

We map how a business develops or uses AI, assess whether the EU AI Act applies, and put governance, transparency and contractual protections in place. We also advise on data protection and intellectual property issues in AI use.

Technology contracts

We draft and negotiate software licences, SaaS agreements, development and support agreements, technology partnership agreements and data processing agreements, and the technology terms in investment documents.

Situations we help with

• You sell a software product to customers in the UK and Spain and need contracts and privacy terms that work in both.
• You have suffered a data breach and need to decide quickly whether to report it.
• Your team has started using AI tools and you want a policy and a view on EU AI Act exposure.
• You received a subject access request or a data protection complaint and need to respond correctly.
• You are raising investment and the investor's lawyers have asked about your data protection compliance.

How we work

• UK and EU together. We advise on both regimes in one piece of work.
• Practical outputs. Policies, assessments, contract templates and response plans, not only memoranda.
• Joined-up. We work with our IP, corporate and employment colleagues on ownership and workplace monitoring.
• English and Spanish. We advise in both languages.

How a matter usually runs

1. Scoping. We learn how your product or business uses data and technology.
2. Gap analysis. We identify what applies and where the gaps are.
3. Remediation. We prepare documents, policies and contracts.
4. Ongoing support. We advise on new products, incidents and regulatory changes.

Related services

• Intellectual Property: software, brands and AI-generated content.
• Corporate & Commercial: investment.
• Employment: workplace monitoring and staff data.
• Spanish Desk: operating in Spain.