Risks and challenges: The fundamentals of data protection in the legal sector

Each subject access request should be assessed on its own merits, even if you have received multiple requests and you feel you have provided the information being requested. All the personal data held on a client file that falls within the scope of the subject access request should be provided.

Having appropriate procedures in place for managing data retention for all the data held will assist with handling SARs. The procedures should include understanding what data you hold, why it is being held, how long it should be retained for and the processes for managing this.

If a client requests access to all the personal data you hold on them, you must deal with the request even if it may take a long time to collate the information, unless the request is obviously disproportionate or involves excessive costs. You should ask the client to clarify the time periods over which they are requesting the data if it is not clear.

If you are considering redacting or withholding any information, then you will need to refer to the legislation to see if an applicable exemption applies. Exemptions such as legal professional privilege may apply, however such exemptions cannot be relied upon in their entirety and will depend on the exact circumstances of each matter.

Best practice is to provide the requested information because that is the cornerstone of the fundamental rights in the axis. It is really important that you get that right and be as helpful as you can.

Follow the ICO guidance on SARs and any exemptions that may apply. If a complaint is made by the client and the ICO potentially needs to ask you about it, if you have followed the guidance and you are confident in your decision, you have documented your decisions that will be extremely helpful for the ICO when dealing with the complaint as it evidences the decisions you have made and why.

It may seem on occasion that the SAR process is being abused by clients and may be used in contemplation for a complaint or claim. The reasons behind the request for personal data should not matter as clients are entitled to exercise their rights to request access to their personal data. What you need to consider is that there is going to be a reason behind the request and a very common reason is going to be that an individual may be unhappy in some shape or form, they may want that information to use to it to support any complaint or to at least consider it.

Follow the guidance on the ICO and Law Society website about how to deal with those types of requests and consider whether they might be excessive, or involve disproportionate efforts, as it is appreciated that there will be occasions when people are being unreasonable making their requests.

Requests for metadata also need to be considered, if the data has been deleted during the course of the business or in accordance with retention guidelines then that may not need to be considered. However, good record management comes into play here as any data deleted to prevent disclosure is a criminal offence under the Data Protection Act 2018^[3].

With regards to data sharing the core message really is that data protection legislation is an enabler for data sharing. It's there to protect those who are vulnerable including the safeguarding of children. It is important to remember that data protection facilitates data sharing rather than hindering it. The ICO's guidance clarifies this point and outlines how data sharing agreements can help law firms comply with the legislation and address contractual liability.

Resources for data sharing

• Data Sharing Code of Practice
• Data Sharing and Children
• Data Sharing Agreements

If you are transferring data to a third country that is not covered by UK adequacy regulations, then you must have an appropriate safeguard in place (for example, data protection clauses such as the ICO’s International Data Transfer Agreement) after having undertaken a Transfer Risk Assessment.

If you are transferring data within the same corporate group, then you can rely on Binding Corporate Rules (BCRs) and the UK BCR addendum (introduced in December 2023^[4]) can be added to existing EU BCRs before the documentation is submitted to the ICO for prompt approval. This process is simple, and relatively straight forward and there is useful guidance about international transfers available on the ICO website.

Resources for international transfers

• Guide to international transfers
• Guide to Binding Corporate Rules