Data Protection

Our approach

This page explains, in plain English, how we approach data protection when supporting law firms with onboarding administration. It is an informational statement of our intended practice. It is not a certification, and it does not guarantee compliance or claim any accredited standard.

Connected Onboarding provides outsourced administrative and operational client-onboarding support to law firms in England and Wales.

Connected Onboarding is not a law firm, is not authorised or regulated to carry out reserved legal activities, and does not provide legal advice. The instructing law firm remains responsible for all legal work, supervision, regulatory compliance, risk assessments, anti-money-laundering decisions and client-acceptance decisions.

Roles and responsibilities

• For our own business contacts, website enquiries and portal accounts, we generally act as a data controller
• For information handled while carrying out onboarding administration for a law firm, the firm is generally the controller and we act as a processor
• The instructing firm remains responsible for compliance decisions, risk assessments, supervision and client acceptance

The precise role depends on the service and the written agreement in place.

Processing under documented instructions

When we act as a processor, we process personal information only on the documented instructions of the instructing law firm, for the purposes agreed in writing, and for the agreed duration. If an instruction appears to conflict with data-protection law, we will raise it with the firm rather than act on it.

Confidentiality

Everyone working on a firm's matters is subject to confidentiality obligations. Client information is used only for the agreed administrative purpose and is not disclosed to anyone outside the agreed authorised contacts without instruction.

Access controls

• Access is limited to the people who need it for the agreed work
• Role-based permissions are applied within the Connected Onboarding portal
• Each law firm's records are separated so one firm cannot see another firm's data
• Activity is recorded so changes can be traced

Data minimisation

We aim to request only the information the firm has told us is needed for the onboarding step in question, and to avoid collecting or retaining more than is necessary.

Retention and deletion

Records handled for a law firm are retained and deleted in line with that firm's documented instructions and retention policy. Our own business records are kept only as long as needed for the purpose or for legal and accounting obligations.

Incident reporting

If we become aware of a personal-data breach affecting information we handle for a firm, we will notify the firm without undue delay, provide the information available to us, and support the firm's assessment and any reporting it decides to make to the Information Commissioner's Office or affected individuals.

Supplier management

We use a limited set of suppliers, such as hosting, database, email delivery and scheduling providers. We aim to check that each supplier offers appropriate protections and to put written terms in place before personal information is shared. Suppliers are reviewed if the service or the information involved changes.

Staff awareness and training

People working with client information receive guidance covering confidentiality, secure handling, phishing awareness, escalation routes and what to do if something goes wrong.

Data-subject requests

If we receive a request from an individual about information we hold for a law firm, we will pass it to the firm promptly and assist the firm in responding. Requests about our own records can be sent to the contact below.

International transfers

Where a supplier processes information outside the United Kingdom, we take steps to ensure an appropriate safeguard is in place, such as UK adequacy regulations or the International Data Transfer Agreement or Addendum.

Supporting your due diligence

We are happy to support a firm's supplier due-diligence process by completing the firm's questionnaire, agreeing a data-processing agreement and confirming the technical and organisational measures that apply to the agreed scope of work.

Contact

Data-protection enquiries: hello@connectedconveyancing.co.uk

Telephone: 07356 285287

We have not appointed a statutory Data Protection Officer. If that changes, the details will be published here.