GDPR Compliance Checklist for UK Law Firms

Law firms handle some of the most sensitive personal data of any sector — client instructions, financial details, medical records in personal injury matters, family information in family law. Our document management GDPR compliance guide covers the general framework. This checklist covers the legal sector specifically.

The SRA and GDPR Overlap

SRA Principle 6 requires solicitors to behave in a way that maintains trust in the profession. SRA Rule 6.3 requires that client information is kept confidential. These obligations overlap significantly with GDPR — failing to protect client data properly is both a GDPR breach and an SRA breach, potentially triggering both ICO enforcement and SRA regulatory action.

Document Management GDPR Checklist — Law Firms

Data mapping and ROPA

☐ Record of Processing Activities (ROPA) maintained and up to date
☐ All personal data categories documented: client data, matter data, employee data, witness data
☐ Processing purposes documented for each data category
☐ Third-party data processors documented (DMS vendor, cloud provider, email provider)
☐ Data flows documented (where data goes: client → firm → counsel → court)

Matter and client file management

☐ Client files held only for the matter duration + 6 years minimum after closure
☐ Destruction policy in place — certificates of destruction maintained
☐ Files not retained indefinitely by default
☐ Conflict check system integrated with client/matter data to prevent data access breaches
☐ Ethical walls enforced at system level, not just by policy
☐ Access to closed matter files restricted and logged

Client data and consent

☐ Privacy notice provided to clients covering: data collected, purpose, retention, rights
☐ Lawful basis documented for each type of client data processing
☐ Marketing communications: consent obtained and records kept
☐ Third-party data sharing with counsel/experts: covered in engagement letter or privacy notice
☐ ID verification documents (AML checks): retention limited to 5 years after matter close (MLRO guidance)

Access controls and security

☐ DMS/document system has user-level access controls
☐ Fee earner access limited to matters they are working on
☐ Admin access restricted to a small number of authorised staff
☐ Multi-factor authentication enabled for all staff accessing client data
☐ Audit log active — records who accessed which file and when
☐ External sharing controls configured — documents shared with clients via secure portal, not email

Subject access requests

☐ SAR procedure documented and all staff trained on it
☐ Designated person to handle SARs identified
☐ Ability to search all systems for a named individual's data confirmed
☐ Response time tracking in place (30-day deadline)

Breach management

☐ Data breach procedure documented
☐ 72-hour ICO reporting obligation known and understood
☐ Breach log maintained (even for breaches not reported to ICO)
☐ Staff trained to recognise and report potential breaches
☐ Note: SRA must also be notified of serious breaches as part of SRA transparency obligations

The Document System Requirements

The checklist above is only achievable with a document management system that provides: matter-centric access controls, ethical wall enforcement, comprehensive audit logging, retention scheduling with automatic flagging, and secure external sharing (client portal). A shared file server or unstructured SharePoint library cannot reliably deliver all of these.