What is Personal Data? 

 

Personal data means any information relating to an identified or identifiable individual. This includes:

 

• Names and contact details

• Date of birth and identification documents

• Case and legal matter information

• Financial information

• Communications (including emails, calls, and correspondence)

 

In the course of providing criminal defence services, we may also process:

 

• Special category data (e.g. health information) and

• Criminal offence data (e.g. allegations, charges, convictions)

 

Whose Personal Data Do We Process? 

 

We process personal data relating to:

• Clients and former clients;

• Prospective clients;

• Witnesses and third parties involved in cases;

• Family members or associates of clients;

• Opposing parties;

• Barristers, experts and professional contacts;

• Staff, consultants and job applicants;

• Suppliers and service providers.

 

How We Collect Personal Data

 

We collect personal data in a number of ways, including:

 

• Directly from you (e.g. during instructions, meetings, calls, or correspondence)

• From third parties such as:

  • Police

  • Courts and tribunals

  • The Legal Aid Agency

  • Barristers, experts and other legal professionals

• From documents and evidence relevant to your case

 

In some circumstances, meetings or calls may be recorded or transcribed using secure technology to ensure accuracy and effective case management.

 

We may also collect limited information from publicly available sources where necessary.

​

Cookies for recording web traffic

Our website uses cookies and similar technologies to distinguish you from other users, improve your experience, and help us understand how our website is used.

 

We use a tool from Google called Google Analytics to collect information about how visitors interact with our website. This includes information such as pages visited, time spent on the site, and general location data. This information is aggregated and does not directly identify individuals.

 

Where required, we will obtain your consent before placing non-essential cookies on your device.

 

You can control and manage cookies through your browser settings, including deleting existing cookies and blocking future cookies. Please note that restricting cookies may affect the functionality of our website.

 

Please see our Cookie Policy.

 

How We Use Personal Data 

 

We use personal data to:

 

• Provide legal advice and representation in criminal matters

• Apply for and manage Legal Aid funding

• Prepare and conduct legal proceedings

• Communicate with clients, courts, experts and relevant parties

• Comply with legal and regulatory obligations

• Manage our business operations, including IT and administration

 

We handle all information in accordance with our strict duties of confidentiality and legal professional privilege.

 

We do not use personal data for marketing purposes.

 

Lawful Basis for Processing 

 

We process personal data under the following lawful bases:

 

• Contract – to provide legal services to you

• Legal obligation – to comply with regulatory and legal requirements

• Administration of justice – for legal proceedings and representation

• Legitimate interests – to manage our practice efficiently

 

Where we process special category or criminal offence data, we do so in accordance with:

• Article 9 and Article 10 UK GDPR

• Schedule 1 of the Data Protection Act 2018

 

This includes processing necessary for:

• Legal claims

• Legal advice

• The administration of justice

 

Use of Artificial Intelligence and Digital Tools 

 

We may use secure digital tools, including artificial intelligence (“AI”), to assist with:

 

• Document preparation

• Transcription of meetings and calls

• Case management and administrative support

 

All outputs are reviewed by our team, and:

 

• Your data remains confidential and protected by legal privilege

• AI tools are used in a secure and controlled environment

• Your data is not used to train external AI models

• No decisions are made solely by automated systems

 

Who We Share Personal Data With 

 

Where necessary, we may share personal data with:

 

• Courts and tribunals

• Police and law enforcement agencies

• The Legal Aid Agency

• Barristers and legal counsel

• Expert witnesses

• IT providers and secure hosting services

• Regulatory bodies (including the Solicitors Regulation Authority)

 

All sharing is carried out only where necessary and subject to confidentiality, legal privilege, and appropriate safeguards.

 

International Transfers 

 

Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, including:

 

• UK adequacy regulations

• The UK International Data Transfer Agreement (IDTA) or equivalent safeguards

 

Data Storage and Retention 

 

We store personal data securely using trusted systems and providers.

 

In accordance with regulatory requirements, including those of the Solicitors Regulation Authority, we retain files:

 

• Typically for a minimum of 6 years after a matter concludes

• Longer where required for legal, regulatory or professional reasons

 

After the retention period:

 

• Paper files are securely destroyed

• Electronic records are securely deleted or anonymised

 

Your Rights 

 

You have the following rights, subject to legal limitations:

 

• To access your personal data

• To request correction of inaccurate or incomplete data

• To request erasure of your data

• To request restriction of processing

• To object to processing

• To request transfer of your data to another organisation (data portability)

 

To exercise your rights, please contact us using the details above.

 

We may require proof of identity before responding to your request.

 

We will respond within one month, although this may be extended where permitted by law.

 

Please note that we may be unable to comply fully with a request where we are required to retain information for legal or regulatory purposes, including our obligations as a law firm.

 

Automated Decision-Making 

 

We do not make decisions based solely on automated processing that produce legal or similarly significant effects. 

 

Data Breaches 

 

We take the security of personal data seriously and have measures in place to protect it from unauthorised access, loss, misuse or alteration.

 

In the event of a personal data breach, we will:

 

• assess the nature and impact of the breach

• take appropriate steps to contain and mitigate any risks

• notify the Information Commissioner’s Office (ICO) where required

• notify affected individuals where the breach is likely to result in a high risk to their rights and freedoms

 

Contact and Complaints 

 

If you have any concerns about how we handle your personal data, please contact us using the following details: Data Protection Manager, Hallinan Blackburn Gittings & Nott, 2nd Floor Alexandra House, 55A Catherine Place, London, SW1E 6DY or email to solicitors@hallinans.co.uk

 

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) - website: www.ico.org.uk.