Q&As

If a law firm receives a data subject access request (DSAR) from a third party on a client matter, is there any legal restriction preventing the law firm disclosing the existence of the DSAR to the client under 6.4 of the SRA Code of Conduct for Solicitors?

read titleRead full title
Copyright © 2025 LexisNexis
Published by a LexisNexis Risk & Compliance expert
Published on: 06 February 2025
imgtext

It is important to distinguish between requirements in the SRA Standards and Regulations and your obligations under data protection law.

SRA Standards and Regulations

Fundamentally you must act in a way that upholds public trust and confidence in the solicitors’ profession, with integrity and in the best interests of each client.

You are required to make clients aware of all information material to their matter of which you have knowledge, unless one of four exceptions applies. See Practice Note: Duties of confidentiality and disclosure.

If the exceptions do not apply, and the data subject access request (DSAR) is material to the matter, the Codes of Conduct require you to disclose its existence to the client.

Where the SRA regulatory

Powered by Lexis+®
Jurisdiction(s):
United Kingdom

Popular documents

UK GDPR—the basics

UK GDPR—the basicsThis Practice Note explains, in simple terms, the key features of the UK General Data Protection Regulation (UK GDPR). See also Precedent: Data protection quick reference guide.This Practice Note is intended for non-privacy specialists and there are separate, more detailed,

How do I calculate the time limit for responding to a data subject request?

How do I calculate the time limit for responding to a data subject request?The General Data Protection Regulation, Regulation (EU) 2016/679 (GDPR) provides for enhanced rights for data subjects, including providing rights of access, rectification, erasure and restriction of processing, data

Can a limited company make a subject access request? Can a director of a limited company ask for

Can a limited company make a subject access request? Can a director of a limited company ask for recordings of calls with us? If yes, what personal data must we provide?This Q&A draws on the Information Commissioner’s Office’s (ICO’s) guidance on business-to-business marketing, which may or may

Data protection officer—DPO—job description and role profile

Data protection officer—DPO—job description and role profile1DPO detailsName of organisation[Insert name of organisation]Name of DPO[Insert name]Reports to[Insert name and/or position]Full time/part time[Insert]Details of any other roles held within the organisation[Insert details of any other roles