How CD Law uses personal data about our clients, the people connected with them, prospective clients and the other parties to our matters
| About this notice | Detail |
|---|---|
| Who we are | CD Law Ltd, a company registered in England and Wales (company number 13142036). CD Law and Cyber Data Law are trading names of CD Law Ltd. Authorised and regulated as a licensed body (ABS) by the Solicitors Regulation Authority, number 822435 |
| Our address | 28 Saddleworth Business Centre, Huddersfield Road, Delph, Oldham, OL3 5DF |
| Our role | We are the controller of the personal data described in this notice. We are registered with the Information Commission (the ICO), registration number ZB296573 |
| Who this notice is for | Our clients, and the directors, officers, owners, employees and contacts of our business clients. People and organisations who approach us about instructing us. Other parties named in a matter, such as counterparties. People who contact us |
| Version | Version 1.4, 9 October 2026. It replaces the privacy information in clause 13 of our earlier terms of business |
Data protection law requires us to tell you how and why we use personal data about you, and what rights you have. We act for business clients only, so most of the personal data we hold is about people in their working lives: the directors, officers, owners and staff of our clients, and the people they deal with.
If you are a client, please pass this notice to the directors, owners and staff whose details you give us, so that they know how we use them.
Your right to object
Where we use your personal data on the basis of our legitimate interests or a recognised legitimate interest, including the checks we make before we act (section 4), you have the right to object at any time, on grounds relating to your particular situation (UK GDPR Article 21, which covers both). A director will consider your objection, and we will stop unless we have compelling legitimate grounds that override your interests, or we need the data for a legal claim. You can also object at any time to direct marketing, and we will stop. To object, contact us as shown in section 9.
| Category | Examples |
|---|---|
| Contact and identity details | Name, job title, business address, email address, telephone number. Date of birth and identity documents where we need them to confirm who someone is |
| Company and ownership details | Directors, officers and people who own or control a client, as shown on official registers or given to us by the client |
| Screening results | The results of the identity, conflict, sanctions and public record checks described in section 4 |
| Matter information | Information about the matter you instruct us on, including personal data in documents you send us. This may include special category data or criminal offence data where the matter needs it |
| Billing and correspondence | Invoices, payment records and our emails, letters and notes of calls and meetings |
| Marketing preferences | Whether you want to receive our updates and invitations |
What you must give us. We need your name, contact details and, where we ask for them, identity details, so that we can confirm who we act for, as our professional rules require. You do not have to give them, but if you do not, we cannot take your instructions.
Most of it comes from you, or from the client you work for. We also collect personal data from official public sources (Companies House, the UK Sanctions List, the Insolvency Register, the Financial Conduct Authority register, Find Case Law and other court sources), from reputable news sources when we screen a prospective client (section 4), and from the other parties and advisers in a matter.
Before we accept a new client or a new matter, we check who we would be acting for and whether we can act. A director of the firm decides which checks are made and on whom, and carries them out by hand. The checks are:
(a) identity and registered details of the client, and who its directors, officers and owners are
(b) a conflict check against our own records and the other parties to the matter
(c) a check of the UK Sanctions List for the client, its directors and owners, and the counterparties
(d) public office held, to identify politically exposed persons. We record the office only, never political views or party
(e) news and litigation records on the client, its directors and its owners, only to detect fraud, sanctions evasion or other crime in which the firm could be used. This is not a general search into anyone's reputation
No AI in these checks. We carry out these checks by hand. We do not use our AI system for them, and information about alleged or proven offences is never put into it. The results are kept in a restricted folder that is never connected to our AI system. Any download or note made during a check is deleted when the check is complete. If that changes, we will update this notice first. The decision whether to act is always made by a director. We do not make decisions about anyone based solely on automated processing.
These checks can find information about alleged or proven offences. We treat that as criminal offence data and handle it under our Appropriate Policy Document, which we will give you on request.
| Purpose | Lawful basis (UK GDPR Article 6(1)) |
|---|---|
| Providing legal services under our contract with the client | Contract (b), where you are the client. Legitimate interests (f) where we act for a company and use details of its people, our interest being to deliver the work we are instructed to do |
| Identity, conflict, public office, news and litigation checks (section 4) | Legitimate interests (f). Our interests are knowing who we act for, not acting where there is a conflict, and detecting fraud, sanctions evasion or other crime in which the firm could be used. We have carried out a written legitimate interests assessment, which you can ask to see |
| Sanctions checks | Recognised legitimate interest (ea), under the condition in Annex 1 paragraph 5 of the UK GDPR (crime): processing necessary for detecting, investigating or preventing crime. Dealing with a person on the UK Sanctions List can be a criminal offence |
| Reports to the Office of Financial Sanctions Implementation (OFSI) or other authorities where the law requires | Legal obligation (c) |
| Keeping records we must keep under our professional rules and tax law, and dealing with our regulator and insurers | Legal obligation (c), and legitimate interests (f) in protecting the firm and meeting our insurers' requirements |
| Dealing with complaints and legal claims | Legitimate interests (f), and legal obligation (c) where our professional rules require it |
| Sending updates about the law, our services and our events | Legitimate interests (f), or consent where the law requires it. You can opt out at any time |
Where we hold special category data or criminal offence data for a matter, we rely on UK GDPR Article 9(2)(f) (legal claims) and Data Protection Act 2018 Schedule 1 paragraph 33 (legal claims, legal advice and legal rights), or on another condition that applies to that matter. Criminal offence data found in the checks in section 4 is handled under Schedule 1 paragraph 10 (preventing or detecting unlawful acts), as our Appropriate Policy Document explains.
We share personal data only where we need to:
(a) Anthropic (Anthropic Ireland, Limited), which provides the AI system we use, as our processor. Anthropic is not permitted by contract to train its models on our content. When we use its web search, the search terms go to the web search providers Anthropic engages as its subprocessors, currently Brave Search and TurboPuffer, both in the United States (Anthropic's published list, checked 7 October 2026). We use the AI system only for business documents and business communications, in which client staff appear as business contacts. We do not put special category data, criminal offence data, or the personal data of our clients' customers or other individuals into it. That work is done by hand
(b) our other IT, email and document storage providers, as our processors
(c) barristers, experts and other advisers engaged on a matter, and the other parties and their advisers where the matter needs it
(d) our regulator (the Solicitors Regulation Authority), the Legal Ombudsman, our professional indemnity insurers and brokers, and our auditors
(e) law enforcement and other authorities, including OFSI, where the law requires it
We never sell personal data, and we do not share it with other organisations for their own marketing.
Anthropic and some of its suppliers process data in the United States and other countries. These transfers are covered by the European Commission's standard contractual clauses with the UK International Data Transfer Addendum, in Anthropic's Data Processing Addendum. Our other providers, including Microsoft and DocuSign, may also process data outside the UK. Where they do, we rely on the safeguards in our contracts with them. You can ask us for a copy of these safeguards.
| Record | How long |
|---|---|
| Matter files, including the checks made before we acted | 6 years from the date of our final bill (or from closing the matter if there is no final bill), or longer if a claim is made or likely |
| Checks on a prospective client we did not act for | 12 months from our decision not to act, or from our last contact where no decision is made, unless needed for a legal claim or a report to an authority |
| A possible sanctions match reported to OFSI | For as long as the report or any enquiry needs, and then for 6 years |
| Search results from the checks in section 4 that we do not use | Not kept. Any download or note made during a check is deleted when the check is complete. The checks are made by hand, so nothing from them is in our AI system |
| Business documents and communications in our AI system (section 6(a)) | We normally delete each session in the app within 30 days of the session ending. A fragment of the text can remain in the app's local store on our encrypted computer. Anthropic's published terms say it removes deleted conversations within a further 30 days, or up to 2 years for content flagged under its usage policy |
| Backups | Our own files are backed up every day to an encrypted drive that we hold, with no cloud copy. Seven daily backups are kept and the oldest is deleted each day, so a file we delete leaves our backups within 7 days. The backups do not include our AI system's own data |
| Marketing list | Until you opt out, or for 24 months with no engagement from you, whichever is sooner. We then keep a note so that we do not contact you again |
You have the right to:
(a) ask for a copy of your personal data (a subject access request)
(b) have inaccurate data corrected
(c) have data erased in some circumstances
(d) have the use of your data restricted, for example while you dispute its accuracy or while we consider an objection, so that we only store it
(e) receive data you gave us in a portable form, where the processing is based on contract or consent
(f) object (Article 21), as set out in the box at section 1
(g) withdraw consent at any time, where we rely on consent
Some rights do not apply in some circumstances, for example where the law protects legal professional privilege or the prevention of crime. If we cannot meet a request, we will tell you why, unless the law prevents it.
To make a request, write to Emma Green, Managing Director, at our address above or at info (at) cyberdatalaw.co.uk, marked "data protection request".
If you are a counterparty, another party to a matter, or a director or owner of a prospective client, we may hold your details without having collected them from you. We may not tell you directly where your details must stay confidential because of our professional duty of confidentiality to our client or legal professional privilege, where telling you would involve disproportionate effort or would seriously impair the purpose of the check, or where the law allows us not to, for example to avoid prejudicing the prevention of crime. Where we are required to tell you, we do so within one month of obtaining your details, at our first contact with you, or when we first disclose your details to someone else, whichever is soonest. This notice is published so that you can find out what we do.
You have the right to complain to us if you are unhappy with how we use your personal data, and we would like you to do so first, so that we can try to put it right. Email John Green, Director and Principal Solicitor, at john.green (at) cyberdatalaw.co.uk, write to him at our address above, or call 01625 724704. We will acknowledge your complaint within 30 days, look into it, keep you informed, and tell you the outcome without undue delay.
You also have the right to complain to the Information Commission (the ICO), the UK regulator for data protection: online at ico.org.uk, by telephone on 0303 123 1113, or by post to the ICO, 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester M1 7BL.
We review this notice at least once a year and whenever our use of personal data changes. The version and date are shown at the top.