Risk & Compliance

This law which is designed to protect human health and the consumer’s interest in relation to food has been retained.

A key issue in SaaS agreements is who owns the data hosted on the platform, but also who has access to it. If personal data can or is accessed and processed by the provider and customer, there needs to be a (written) agreement in place about who is the data controller and data processor and their respective responsibilities.

The UK’s data protection laws remain as they were prior to Brexit, so it will depend on where the data is being processed (inside or outside the EU) as to how this should be dealt with in the SaaS agreement.

A risk register is a document used as a risk management tool by a company to fulfil regulatory compliance. It is the record for all risks identified, including additional information about each risk, such as the likelihood of the risk occurring, its consequences, mitigation measures and the risk owner.

This is the Control of Substances Hazardous to Health Regulation 2002 and requires employers to control substances that are hazardous to health.

GxP is a series of quality guidelines and regulations designed to ensure that biological and pharmaceutical products and processes are safe, meet their intended use, and adhere to quality standards during manufacturing, control, storage, and distribution. GxP is a general abbreviation, the “x” is usually replaced by the relevant letter as required. For example, Good Distribution Practice becomes GDP.

This is the science and activities relating to the detection, assessment, understanding and prevention of adverse effects or any other medicine-related problem.

Compliance with laws and regulations is generally mandatory; it creates a level playing field of protection for business, employees, the supply chain, and society as a whole. Risk management is wider and not necessarily mandated. Risk management covers risks which a sensible business should manage beyond strict just compliance with the law (like geo-political, insurance or supply chain risks).

The Physician Payments Sunshine Act 2010 is a piece of US legislation which requires manufacturers of drugs, medical devices, biological and medical supplies to monitor financial relationships between doctors and teaching hospitals. It has become a beacon for good governance outside of the USA to ensure transparency and cast a light on conflicts of interest between those that prescribe and those that manufacture drugs and devices.

UK REACH is part of the UK’s chemicals regulatory regime. Reach stands for “Registration, Evaluation, Authorisation and Restriction of Chemicals.” If you sell or distribute chemicals in the UK and the EU, you’ll need to follow both UK REACH and EU REACH rules.

Local planning authorities are responsible for renewable and low carbon developments of 50 megawatts or less installed capacity. Above that it is the Secretary for State for Energy.