A GDPR Compliance Journey

By James Tarling, Corporate & Commercial Partner at Ashtons Legal.

Ashtons Legal has 350 staff spread over 5 offices in the East of England. The firm is broadly split across private client, business law and injury services groups together with a number of niche areas of specialist expertise.

At Ashtons the GDPR compliance journey started with the appointment of a partner as data protection lead. I was volunteered into this position as an experienced adviser on data protection law. I formed a group including our business systems and compliance teams to oversee the firm’s GDPR strategy. We had recently rolled out a new information classification policy and training on this so data protection and information handling was already firmly on the firm’s agenda.

We quickly identified the three broad areas of personal data handled by the firm as data that related to our people, our client matters and the marketing of our business. We created separate work streams for each of these areas feeding into the core group. In order to ensure that we had a clear understanding of all personal data held within each area of the firm we undertook a firm wide data survey of all staff. Whilst largely confirming the information that we had already identified it did highlight areas of greater complexity that needed early attention.

Armed with this information we created a detailed project plan of compliance actions which has been regularly updated and reviewed by the core data protection group to ensure that we are on target for GDPR implementation. We are well on the way to completing this process but there remains some work to do to finalise a number of areas and in particular the full roll out of new policies and training to staff. We are also looking further ahead to future developments both in the law, but more in practice as we see others adopting different practices that we need to interface with.

You can see James speaking about his firm’s GDPR compliance journey by attending the ARK Group’s GDPR for law firms event on 24 April 2018.