YOUR WORKING OUTCOME
Connect matter handling, professional confidentiality, supplier access and record duties in one controlled review.
Where to begin
Start with a representative matter from first enquiry to archiving. Include the information of clients, counterparties, witnesses and others, and distinguish solicitor and notarial activities where their duties differ.
Sole practitioners, law-firm managers, notaries, compliance officers and case-management owners.
Your first working session
Trace one matter safely
Use a de-identified matter outline to identify intake, identity checks, case work, communications, execution and archiving.
Bring back: A matter-stage map with systems and responsible roles.
Separate the record classes
List accounting records, client matters and the public-form/private-form notarial records actually held.
Bring back: A retention decision list with exact professional sources.
Check external access
Identify case systems, cloud storage, transcription, outsourced work, interpreters and AI tools that may receive information.
Bring back: A supplier and disclosure register with roles and unresolved questions.
Work through the evidence
Map purposes across the matter lifecycle
Record why information is used at each stage, including preliminary enquiries, acting on instructions, regulatory checks, billing and future marketing. Identify separate legal entities and the roles of external professionals and suppliers from the facts.
Evidence: Intake forms, engagement documents, system inventory and a staff walkthrough.Your output: Processing records linked to the actual matter lifecycle.What useful evidence might look like
Illustrative: MAT-01 separates client onboarding from the firm's newsletter list.
ICO: accountability and governance (opens in a new tab) · ICO: current guide to lawful basis (opens in a new tab)
Review confidentiality and lawful disclosure
Check the confidentiality expectations, professional duties and applicable data-protection basis for each disclosure. Where relying on client consent to disclose confidential information, make its scope clear. Assess legal professional privilege on the actual material; a lawyer holding a document does not make every item privileged.
Evidence: Engagement terms, disclosure decisions, relevant duties and item-level exemption reasoning where needed.Your output: A disclosure and confidentiality decision record that staff can follow.What useful evidence might look like
Illustrative: DISC-03 identifies the recipient, purpose and authority for a particular disclosure.
SRA: confidentiality of client information (opens in a new tab) · ICO: data protection exemptions (opens in a new tab)
Test third-party and cloud arrangements
Review external document access and uploads, including cloud services, AI features and outsourced work. Assess supplier roles and guarantees, appropriate contracts, overseas access and professional confidentiality together. Check whether the actual service configuration matches the reviewed terms.
Evidence: Contracting entity, service terms, role permissions, subprocessor details and support locations.Your output: A supplier approval record with conditions and evidence of implemented settings.What useful evidence might look like
Illustrative: SUP-06 records a restricted upload policy while an optional AI service is reviewed.
SRA: confidentiality of client information (opens in a new tab) · ICO: controller responsibilities when using a processor (opens in a new tab) · ICO: required processor contract terms (opens in a new tab) · ICO: international transfer test (opens in a new tab)
Apply the correct record duty
Review the actual record class and jurisdiction. For notaries in England and Wales, apply Rule 24's distinct public-form and other-act record requirements. Keep those decisions separate from solicitor accounting records, matter-file policy and litigation holds.
Evidence: Schedule entries, professional-rule references, archive inventory and disposal controls.Your output: A retention schedule with an explained period and start trigger for each class.What useful evidence might look like
Illustrative: RET-12 identifies the public-form protocol separately from supporting administrative material.
Faculty Office: Notaries Practice Rules 2019, Rule 24 (opens in a new tab) · ICO: storage limitation (opens in a new tab)
Handle requests without blanket assumptions
Establish a route from reception or an individual fee earner to the responsible reviewer. Search proportionately across case systems and communications. Review third-party information, privilege and other exemptions individually; record the reason for each redaction or withheld item.
Evidence: Request log, search plan, exemption decisions and secure disclosure checks.Your output: An auditable response file with reasons and delivery evidence.What useful evidence might look like
Illustrative: SAR-04 links each withheld passage to a reviewed exemption decision.
ICO: guide to subject access (opens in a new tab) · ICO: third-party information in a subject access request (opens in a new tab) · ICO: data protection exemptions (opens in a new tab)
Prove escalation and management oversight
Run a misdirected-email or lost-device scenario. Check who handles containment, insurer or professional obligations and data-protection decisions. Report the important unresolved risks, owners and completion evidence to the accountable principal or management team.
Evidence: Incident exercise record, training evidence, open actions and management decision notes.Your output: A concise management summary and verified remediation list.What useful evidence might look like
Illustrative: BOARD-02 identifies two unresolved supplier questions and the evidence needed to close them.
ICO: personal data breaches guide (opens in a new tab) · ICO: accountability and governance (opens in a new tab)
Your completed starter pack
- Matter data-flow and purpose register
- Confidentiality and disclosure review
- Supplier and transfer evidence pack
- Record-specific retention and hold protocol
- Sample rights-response decision file
- Management summary and incident exercise actions
When to escalate
- Resolve uncertain privilege, confidentiality or conflicting legal duties with a competent reviewer; a generic template cannot determine the answer.
- Do not enter client names, case facts, identity documents or privileged advice into the site's assessment.
- An erasure request does not automatically override a legal retention obligation; record the applicable conditions and any proportionate restriction.
- Escalate active incidents promptly and assess professional, contractual and data-protection duties separately.
Give the open actions an owner.
Use the assessment to organise your findings, then verify the underlying evidence before reporting assurance.
Start your reviewOfficial sources
- ICO: accountability and governance (opens in a new tab)
- ICO: current guide to lawful basis (opens in a new tab)
- SRA: confidentiality of client information (opens in a new tab)
- ICO: data protection exemptions (opens in a new tab)
- ICO: controller responsibilities when using a processor (opens in a new tab)
- ICO: required processor contract terms (opens in a new tab)
- ICO: international transfer test (opens in a new tab)
- Faculty Office: Notaries Practice Rules 2019, Rule 24 (opens in a new tab)
- ICO: storage limitation (opens in a new tab)
- ICO: guide to subject access (opens in a new tab)
- ICO: third-party information in a subject access request (opens in a new tab)
- ICO: personal data breaches guide (opens in a new tab)
- ICO: right to erasure (opens in a new tab)