Regulatory duties that override normal data rules

It's Friday afternoon. A litigation partner at a mid-size London firm gets three things in the same hour: a subject access request (SAR) from a former client's ex-employee, a letter from the Information Commissioner's Office (ICO) demanding disclosure of internal case files within 14 days, and an email from the litigation team insisting that half the requested documents are protected by litigation privilege and cannot leave the building. Nobody in the room agrees on what has to go out, what can be withheld, and what happens if the firm gets it wrong.

This is not an edge case. It's a Tuesday for GC-adjacent teams at law firms handling regulated, contentious, or cross-border work. This lesson gives you the decision framework partners actually use.

Why law firms are a special case

Law firms sit on two overlapping duties that rarely apply together anywhere else:

• Client confidentiality and legal professional privilege (LPP): a common law and statutory protection (in the US, "attorney-client privilege" plus "work product doctrine") shielding certain communications and documents from forced disclosure.
• Data protection law: in the EU/UK, the GDPR (General Data Protection Regulation) and UK GDPR; in the US, a patchwork including the CCPA/CPRA (California Consumer Privacy Act / Privacy Rights Act) and sector rules.

Normally, data protection law says individuals can ask what personal data a firm holds on them (a SAR under GDPR Article 15, or a "right to know" request under CCPA). But a law firm's core product is confidential case material. When a SAR asks for documents that also happen to be privileged, the two regimes collide, and privilege usually wins, but only within tightly defined limits.

Layer on regulators: the Solicitors Regulation Authority (SRA) in England and Wales, the ICO for data protection, the SEC in the US for firms touching public company disclosure, and courts themselves, all of whom can compel disclosure regardless of confidentiality wishes.

The three-bucket framework

Partners and firm data governancedata governanceData Governance umfasst die Regeln, Rollen und Prozesse, die sicherstellen, dass Daten in einer Organisation korrekt, sicher, klar definiert und verantwortungsvoll genutzt werden.Vollständige Definition ansehen → leads triage every request into three buckets.

Bucket 1: Must share

Legally mandated disclosure. Examples:

• A valid court order or subpoena.
• A regulator's statutory information notice (e.g., ICO enforcement notice under UK GDPR Article 58, or an SRA production order).
• Anti-money laundering reporting duties under the UK's Money Laundering Regulations 2017 or the US Bank Secrecy Act, which can override confidentiality entirely (a "suspicious activity report" (SAR, confusingly the same acronym as subject access request) cannot even be disclosed to the client under "tipping-off" rules).

If it's in this bucket, the debate is over. The only live question is scope: sharing the minimum necessary, not the whole file.

Bucket 2: Can share (with judgment)

Data protection rights requests that are valid but negotiable in scope. A SAR is the classic case: the requester has a right to their personal data, but the firm can apply exemptions.

Key exemption under UK GDPR/Data Protection Act 2018, Schedule 2, Paragraph 19: personal data protected by legal professional privilege is exempt from the right of access. The US equivalent logic sits in privilege doctrine itself rather than a privacy statute, since the US has no single federal privacy law.

So a firm can lawfully redact or withhold privileged content even inside an otherwise valid SAR response. This is where most of the actual work happens: line-by-line privilege review of every document that's responsive to the SAR.

Bucket 3: Cannot share

Protected by privilege, no valid legal compulsion exists, and no exemption forces release. This includes:

• Legal advice communications between lawyer and client (advice privilege).
• Documents created for the dominant purpose of litigation, once litigation is reasonably contemplated (litigation privilege).
• Internal firm work product not responsive to any valid request at all.

Sharing from this bucket without a valid order is a professional conduct breach and can itself trigger an SRA investigation or, in the US, bar disciplinary action.

Applying it to the scenario

Back to Friday afternoon:

1. The SAR goes to Bucket 2. The firm must search all systems (document management, email, case management software) for personal data about the requester, then apply the privilege exemption to redact protected material, keeping a documented rationale for every redaction.
2. The ICO letter goes to Bucket 1, but only if it's a genuine statutory notice, not a preliminary inquiry. The firm's data protection officer (DPO, a mandatory role for many firms under GDPR Article 37) verifies the notice's legal basis before responding.
3. The litigation team's objection feeds directly into Bucket 2's redaction exercise. Litigation privilege doesn't block the SAR outright, it justifies specific redactions, document by document.

The output is never "share everything" or "share nothing." It's a redaction log, typically reviewed by a supervising partner and the DPO together, with reasoning that would survive an ICO audit or a court challenge to the redactions.

Practical data checks firms should run

• Data mapping: know where personal data physically lives (DMS like iManage or NetDocuments, email servers, e-discovery platforms). You cannot respond to a SAR in the statutory window (one month under UK GDPR, extendable to three) if you don't know where the data is.
• Privilege tagging at ingestion: many firms now tag documents as privileged at the point of creation or upload, rather than during a rushed review under deadline.
• Access logging and audit trails: who accessed a file, when, and why. Under GDPR's accountability principle (Article 5(2)), the firm must be able to demonstrate compliance, not just claim it.
• Conflict and retention checks: data retained beyond its lawful purpose is itself a GDPR violation (storage limitation principle, Article 5(1)(e)), and old files often contain material relevant to a live SAR that should have been deleted years earlier.

A simplified version of an internal triage script firms use to flag SAR-responsive documents for review might look like this:

# Pseudocode: flag documents for privilege review in a SAR response
for doc in matter_documents:
    if requester_name in doc.metadata["parties"]:
        if doc.tags.get("privilege_status") == "privileged":
            queue_for_partner_review(doc)
        else:
            queue_for_redaction_check(doc)  # may still contain third-party personal data

This doesn't replace legal judgment, it just ensures nothing responsive slips through unreviewed.

For the underlying UK legal text, the ICO publishes a clear practitioner guide: ICO guidance on the right of access.

When regulators and privilege genuinely conflict

The hardest cases are when a regulator's power to compel disclosure runs into privilege head-on. UK courts have repeatedly held that legal advice privilege is close to absolute and can only be overridden by explicit statutory language (see the House of Lords case *R (Morgan Grenfell) v Special Commissioner*, 2002, still a leading authority). The SRA cannot simply demand privileged material without a valid legal basis; neither can the SEC compel a US firm to hand over attorney work product without meeting a specific legal test.

This means the firm's job in a genuine conflict is not to decide unilaterally. It's to assert privilege formally, force the regulator to justify the legal basis for overriding it, and, if necessary, let a court resolve the dispute. Data governanceData governanceData Governance umfasst die Regeln, Rollen und Prozesse, die sicherstellen, dass Daten in einer Organisation korrekt, sicher, klar definiert und verantwortungsvoll genutzt werden.Vollständige Definition ansehen → teams support this by producing clean, well-documented privilege logs quickly, since delay itself can look like obstruction.

🎬 [VIDEO: "GDPR and Legal Professional Privilege Explained" — youtube.com — search for recent UK law firm compliance webinars covering SAR and privilege interaction, several bar associations and law societies post free recordings]

Key Takeaways

• Law firms operate under two systems at once: data protection law (GDPR, CCPA) and legal professional privilege. When they collide, privilege usually limits, but does not eliminate, disclosure obligations.
• Use the three-bucket framework: must share (valid court order, statutory notice), can share (SAR and similar rights requests, subject to privilege redactions), cannot share (privileged material with no valid compulsion).
• A SAR response requires document-by-document privilege review, not a blanket refusal or blanket handover, and firms must log the reasoning behind every redaction.
• Good data governancedata governanceData Governance umfasst die Regeln, Rollen und Prozesse, die sicherstellen, dass Daten in einer Organisation korrekt, sicher, klar definiert und verantwortungsvoll genutzt werden.Vollständige Definition ansehen → (data mapping, privilege tagging, access logs, retention discipline) is what makes a lawful, timely response possible under real deadlines like GDPR's one-month SAR window.
• Genuine conflicts between a regulator's disclosure demand and privilege should be resolved by asserting privilege formally and, if needed, letting a court decide, not by an individual partner's unilateral call.