Information management and security—regulatory requirements—law firms

Produced in partnership with DG Legal

Practice notes

Information management and security—regulatory requirements—law firms

Produced in partnership with DG Legal

Practice notes

This Practice Note explains the key regulatory and statutory provisions governing the management and security of information and data, referred to as information management and security.

SRA Requirements

You must keep the affairs of clients confidential unless disclosure is required or permitted by law or the client consents.

The SRA expects you to identify, monitor and manage all material risks to your business.

You are also under a duty to safeguard money and assets entrusted to you by clients and others.

UK General Data protection Regulation (UK GDPR)

Assimilated Regulation (EU) 2016/679 (UK GDPR) imposes extensive requirements around information security, record-keeping and general information management.

For more guidance, see Practice Note: How to comply with information security requirements and Precedent: Data protection compliance—self-audit.

The UK GDPR security principle

Data security is a cornerstone of the UK GDPR. You must process Personal data in a manner that ensures appropriate security (using appropriate technical or organisational measures), including protection against:

•
unauthorised or unlawful processing, and
•
accidental loss, destruction or damage

The UK GDPR calls this

Jurisdiction(s):

United Kingdom

Key definition:

Requirements definition

What does Requirements mean?

A DCO should include “Requirements” to which the development authorised by the DCO is to be subject. Similar to planning conditions, a requirement specifies the matters for which detailed approval needs to be obtained before the development can be lawfully begin.

��˾��ҹ��