GDPR for UK solicitors: SRA, Law Society, ICO rules

UK legal practices are subject to overlapping regulatory regimes: UK GDPR / Data Protection Act 2018 (enforced by the ICO), SRA Standards and Regulations (Solicitors Regulation Authority for England and Wales) and the equivalent professional bodies in Scotland and Northern Ireland. All require data protection compliance, but they approach it differently.

Want a quick read on where your firm's website stands? Run our free compliance scan to see whether your privacy notice, cookie banner and SRA disclosures meet the baseline before you start the deeper work below.

---

SRA and Law Society position

The SRA Standards and Regulations require firms to maintain "appropriate systems and controls" for compliance with statutory and regulatory obligations, UK GDPR is squarely within scope. The Law Society of England and Wales has published practical guidance on data protection for solicitors and the Law Society of Scotland publishes its own equivalent.

Key positions across the UK regulators:

• Firms must have a documented data protection policy and clearly identified responsibility for data protection compliance. Larger firms may need a formal Data Protection Officer (DPO) under UK GDPR Article 37
• Client files must be stored securely with access restricted to those working on the matter
• Physical files must be stored securely, digital files must be encrypted or appropriately access-controlled
• Cyber Essentials certification is increasingly expected by professional indemnity insurers and sophisticated client-side procurement teams

---

Client confidentiality and UK GDPR

Legal professional privilege and the duty of confidentiality are longstanding principles of English, Scots and Northern Irish law. UK GDPR adds a layer of formal obligations on top of these duties.

Key interactions:

• Clients' right of access: A client can submit a Data Subject Access Request (DSAR) for all personal data you hold about them. You have one month to respond. The Data Protection Act 2018 Schedule 2 paragraph 19 provides a specific exemption for information covered by legal professional privilege, but you cannot ignore DSARs entirely, you must respond, claim the exemption explicitly and disclose what isn't privileged.
• Right to erasure: Clients can request deletion of their personal data. Solicitors can decline where retention is required by law (e.g. MLR 2017) or necessary for the establishment, exercise or defence of legal claims under UK GDPR Article 17(3)(e).
• Third-party data: Files often contain data about opposing parties, witnesses and others. Be careful about disclosing this in response to a client DSAR, UK GDPR Article 15(4) and DPA 2018 protections for third parties apply.
• Stop-the-clock on SARs: The Data (Use and Access) Act 2025 introduced a UK-specific mechanism allowing controllers to pause the one-month SAR deadline while clarification is sought from the requester. This is a small but useful change for firms processing complex requests.

---

Anti-money laundering (AML) data retention

Solicitors are designated persons under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017) and must comply with related obligations under the Proceeds of Crime Act 2002 and the Terrorism Act 2000. AML obligations create specific retention requirements that interact with UK GDPR's data minimisation principle.

Required AML records:

• Customer Due Diligence (CDD) documentation: copies of ID and verification documents
• Records of transactions you conducted on behalf of clients
• Correspondence and notes related to Suspicious Activity Reports (SARs) submitted to the National Crime Agency

Retention period: 5 years from the end of the business relationship or the date of the transaction.

This creates a floor on data retention that overrides a client's right to erasure for AML-covered records during the 5-year period. UK GDPR Article 17(3)(b) recognises this, retention is required by law.

---

Your firm's website

A solicitors' firm website typically collects personal data through:

• Contact enquiry forms
• Online consultation booking
• Newsletter or legal-update subscriptions
• Free initial assessment forms

Required on your website:

The SRA Transparency Rules are firm-specific to the legal profession and have no equivalent in most other regulated sectors. Failure to publish the required information has been a stated SRA enforcement priority since 2018.

---

Professional indemnity and data protection

Data breaches and ICO enforcement actions may engage your professional indemnity insurance. The SRA's minimum terms and conditions of professional indemnity insurance require coverage for civil liability arising from the practice of law, but the interaction with UK GDPR fines and ICO investigation costs varies by insurer. Review your specific policy for:

• Costs of ICO investigations and legal representation
• Regulatory fines (UK GDPR fines are generally not insurable, investigation costs often are)
• Client notification costs in the event of a data breach
• Cyber-incident response (often a separate cyber endorsement)

---

Checklist for solicitors' practices

---

Check your firm's website

Free compliance scan for your law firm website

---

Sources

• Solicitors Regulation Authority, Standards and Regulations
• Law Society of England and Wales, Data protection topic
• ICO, UK GDPR guidance and resources
• Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017

---

This is technical analysis, not legal advice. Consult the SRA and a qualified data protection specialist for your specific situation.