Compliance and Governance

The types of data held by legal organisations are amongst the most complex and sensitive. As a result, there are many regulations and guidelines for legal firms to abide by, which can have specific stipulations around the data you can store and the minimum and maximum retention periods.

For example, the FCA stipulates that some pension data has to be held indefinitely, whereas the Limitation Act 1980 stipulates that records relating to children or young adults should be held until the child’s 21st birthday. These are just two examples of a myriad of specific areas of guidance, which all have to balanced against the more generic GDPR guidance of retaining data for the minimum period necessary, and the general guidance of six years retention.

There are also areas of guidance that are open to interpretation. Not only is deciding on your corporate retention policies difficult, but managing those policies in a modern IT environment can be incredibly challenging. Data is stored across different systems that may need to be managed independently, and data replicated into backups or disaster recovery systems also needs to be considered.

Another core area of importance is data governance in a collaborative working world. Hybrid working means that staff need to access and share sensitive data whilst outside of the corporate network. How do you enable the benefits of remote collaboration whilst protecting the firm against data risks such as theft, breaches and unauthorised access?

Meanwhile, all of this data commonly needs to reside within the UK to protect the interests of your clients. This includes any offsite backup software. Data is subject to the laws of the geography where it resides, so what may be deemed illegal access in the UK may be perfectly legal in another country.

Without the right systems to manage retention, firms can quite easily fall foul of legal stipulation and guidance.