Data Protection & Security

Last updated: 4 November 2026

Law firms handle some of the most sensitive information there is, and you stay responsible for it when you use outside help. We understand that, so this page sets out plainly how we work and what we put in place, so you can make an informed decision and answer your own compliance questions.

1. Our role: you are the controller

For client and matter information that we handle while providing our services, your firm is the “controller” and we act as your “processor”. That means we use the information only to carry out your instructions, and we do not use it for our own purposes.

Before we start work, we sign a written data processing agreement with you that meets Article 28 of the UK GDPR. It sets out what we will do, what information is involved, how long we keep it and what happens when the engagement ends.

2. Before any work starts

• Confidentiality: a non-disclosure agreement is signed with you, and every team member who works on your files is bound by confidentiality obligations.
• Scope: we agree in writing which tasks we will do and which systems and information we will have access to.
• Named people: you are told who will be working on your account.

3. How we protect information

• Need-to-know access: we only give team members access to what their task requires, and we remove access when it is no longer needed.
• Strong account security: unique passwords and multi-factor authentication on the accounts we use, wherever the service offers it.
• Working in your systems: where your setup allows, we work inside your own email, diary and case management tools, so files stay in your environment instead of being copied elsewhere.
• Encryption in transit: information moves over encrypted connections (HTTPS/TLS).
• No unauthorised sharing: we do not pass your information to anyone else, and we do not use it for any other client or for marketing.
• Return and deletion: when an engagement ends, we return or securely delete your information as set out in the agreement, and confirm in writing.

4. Where our team is based

Our team is based in Pakistan. We say this openly because it matters for your own risk assessment. Pakistan is not currently covered by a UK “adequacy” decision, so transfers of personal data to us need additional safeguards. We support these through:

• the ICO’s International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, signed with you; and
• the technical and organisational measures described on this page, together with the information you need to complete your own transfer risk assessment.

5. Sub-processors

We only use other service providers to handle your information where it is necessary for the work, and we require them to protect it to the same standard. We will give you a list of any sub-processors on request and tell you before adding a new one that would handle your firm’s information.

6. If something goes wrong

If we become aware of a personal data breach affecting your information, we will tell you without undue delay and give you what you need to assess it and meet your own reporting duties, including any notification to the ICO within 72 hours of your becoming aware.

7. Supporting your own compliance

Law firms regulated by the Solicitors Regulation Authority remain responsible for confidentiality and for the risks of outsourcing. We are happy to support your due diligence, including by:

• answering your security and data-protection questionnaire;
• explaining how we handle information day to day; and
• providing the documents you need for your records, such as the data processing agreement and transfer agreement.

We recommend that you take your own legal or compliance advice on outsourcing to us.

8. Ask us anything

If you have a question that is not covered here, or you would like to see our documents before you speak to us, email hello@legaldeskpartners.com. See also our Privacy Policy, which covers information collected through this website.

Book a consultation