bto solicitors - Corporate & Commercial Business Lawyers Glasgow Edinburgh Scotland

EU General Data Protection Regulation Updates


If you would like to receive GDPR updates by email CLICK HERE (opens a new email).  See our Privacy Notice for information on how we process your data.


This web page will keep you up to date with the implementation of the EU General Data Protection Regulation (GDPR) which fundamentally changes the way that data protection is regulated in the UK.

The law in relation to data protection is changing across Europe. In 2018 the EU General Data Protection Regulation came info force and has a direct effect in every European country. This is the biggest change in relation to data protection regulation in the UK since 2000 when the Data Protection Act 1998 came into force. The GDPR replaces the 1998 Act and the EU Directive 95/46/EC.

To discuss how to comply with the Data Protection Act 1998 or the General Data Protection Regulation, please contact Paul Motion on T: 0131 222 2939 E:





  25 May 2018

GDPR came into force. 

  4 May 2016

Final text of Regulation 2016/679 published 

  14 April 2016

Final text approved by EU Parliament

  17 December 2015

Text of the GDPR approved by the Civil Liberties Committee (Press Release)

  15 December 2015

The text of the EU GDPR was finalised and can be found here

  15 June 2015

Member states approved their negotiated position 

  12 March 2014

The Parliament confirmed the final position 

  21 October 2013 

The Civil Liberties Committee adopted its position on the Regulation which would form the basis for the negotiations with the member states.

  January 2012

First proposal for reform were published. 


  General Guidance / Blogs


Google and Facebook breaches

[published in Scottish Legal News]
Facebook and Google have been hit with a series of lawsuits, in the wake of GDPR of coming into force, that accuse the tech giants of coercing users into sharing their personal data.

Lack of compliance with GDPR with only around 20% of UK companies compliant
[published in IT Pro]
ICO recorded nearly 2,000 self-reported data breaches in June.

Risky Business
Paul Motion considers the Information Commissioner’s new draft guidance on Data Protection Impact Assessments, issued on 22 March 2018.

Are you ready for data changes
[published in Scottish Licensed Trade News]
With laws on data management changing it's vital hospitality firms are compliant.  The General Data Protection Regulation (GDPR) comes into force on May 25 2018 and will change the way organisations within the EU process personal data.

Constructing compliance: what the industry needs to know about GDPR
[published in Project Scotland]
Despite the GDPR coming into force imminently, the recent Cyber Security Breaches Survey 2018, commissioned by the UK Government, found that just 38% of businesses had heard of the GDPR, with businesses operating in the construction sector demonstrating the lowest rate of awareness at just 25%.

Data Processors beware: what the GDPR means for you
With 25 May 2018 no longer just a distant thought, implementing the GDPR is, or should be, on the minds of all Data Controllers.

Data Protection and Vicarious Liability
On 1st December, the High Court of Justice issued its much anticipated decision in Various Applicants v Wm Morrisons Supermarkets plc, finding the supermarket chain liable for the unauthorised disclosure of personal data by one of their employees.

The GDPR: What you need to know about the changes to registration and fees

As the GDPR live date gets ever nearer, we provide you with the relevant updates you need.

Post GDPR and ‘Soft Opt-In’ For Marketing
The definition of consent is changing significantly under the GDPR and from 25 May 2018 it will be very difficult to obtain valid consent. In addition, you can only rely on consent obtained prior to 25 May 2018 if it is GDPR compliant. What will valid consent look like under the GDPR?

GDPR Updates: A Little Bit of Certainty
The Government published its Statement of Intent today in relation to the new Data Protection Bill anticipated in September 2017. This had been mentioned by the Queen, no less, in her speech following the 2017 General Election. This was also published taking into account the views expressed by those responding to the consultation exercise which took place earlier this year identifying the areas where the UK Government can derogate from the provisions in the GDPR.

Top Ten GDPR Facts Businesses Need to Think About Now
The General Data Protection Regulation (GDPR) will have direct effect throughout Europe from 25 May 2018. The UK will still be in Europe at that time. The Government has confirmed that UK businesses will need to comply.

Where are we with GDPR Certainty?
There is less than year to go until the GDPR is enforced throughout Europe and the guidance is coming thick and fast.

The GDPR is coming! You now have 18 months to comply!
Now that we seem to have confirmation from the Government that the GDPR will come into force in the UK on 25 May 2018, it is time to provide you with more information.

Back to Basics
Reading the text of the General Data Protection Regulation has given me the chance to remember how useful it is to go back to reading the basic legal text and background material to legislation, specifically the UK Data Protection Act 1998 and the European Directive as well as the shiny new Regulation.

Personal Data Breaches and Enforcement under the #GDPR
One of the headline grabbing features of the new data protection regime that is likely to be in place by mid-2018 are the maximum fines that the ICO will be able to impose. ‘Administrative fines’ of up to €20,000,000 or 4% of global turnover will be available for certain infringements, with less serious infringements attracting fines of up €10,000,000 or 2% of global turnover.

Data Protection 2016: NOW is the time to start considering compliance
The first of a monthly series of blogs throughout 2016 on this important topic.



To discuss how to comply with the Data Protection Act 1998 or the General Data Protection Regulation, please contact Paul Motion on T: 0131 222 2939 E:


“The level of service has always been excellent, with properly experienced solicitors dealing with appropriate cases" Legal 500

Contact BTO


  • 48 St. Vincent Street
  • Glasgow
  • G2 5HS
  • T:+44 (0)141 221 8012
  • F:+44 (0)141 221 7803


  • One Edinburgh Quay
  • Edinburgh
  • EH3 9QG
  • T:+44 (0)131 222 2939
  • F:+44 (0)131 222 2949