An email arrives at twenty to six on a Friday from a client whose matter closed eighteen months ago. She wants a copy of everything the firm holds about her, she has sent it to the general enquiries address, addressed to nobody in particular. Nobody opens it until Monday, by which point three days of a one month deadline have gone.
That deadline is the part firms most often get wrong, because they assume the clock starts when the right person sees the request. It does not. A person asking for their own personal data need not name the right, write to a data protection officer, or put the request in any particular form. Time runs from the moment it reaches the firm, whichever inbox it lands in. Under UK data protection law the response falls due within one month of receipt. You can extend that by two further months where the request is complex or where the person has made a number of requests, but you have to tell them you are extending, and explain why, inside the original month. You cannot charge for responding unless the request is manifestly unfounded or excessive, and that bar sits high.
Log it, scope it, and know where the data sits
The first fix costs nothing. Date stamp receipt centrally, so that one record shows when the request arrived rather than when somebody noticed it, and make sure everyone who works a shared inbox flags anything reading like a request for personal information. Verify identity in proportion to the risk, which for a former client whose file you hold is light rather than a certified passport copy. Where the wording is unclear you can ask what the person is looking for, which often narrows the work, but a clarification question asked to buy time will read as a stalling tactic later.
Then there is the question of where the data sits, which wants answering before a request arrives. Personal data about one individual will be in the case management system, in several fee earners' mailboxes, in the accounts ledger, in the risk and complaints file if they ever raised a concern, in the archive, and in whatever paper still sits in storage. Firms that have written that list down respond in weeks. Firms that have not spend the first fortnight arguing about who holds what.
The review, and what you hold back
The review turns on a distinction that gets blurred. A right of access gives a person their personal data. It does not give them their file. The two overlap heavily without being the same thing, and a request for the papers themselves raises separate questions of who owns the documents and whether the firm has a lien over them. Answer the request that has been made.
Material covered by legal professional privilege is exempt from disclosure, and the law requires care where releasing a document would reveal information about somebody other than the person asking, which in a family or employment matter covers much of the file. Someone qualified has to make those calls document by document, and the reason for each withholding needs recording at the time rather than months later when a regulator asks. A request of this kind is often the opening move in a complaint or a claim, so the tone of the covering letter carries as much weight as the contents of the disclosure, because it is the first thing anybody reviewing the firm's conduct reads.
The expensive part is the search rather than the judgement. Somebody has to find every matter, document and item of correspondence mentioning one named individual, including the matters nobody remembered they appeared in. The Bracton AI Assistant reads across the whole caseload rather than one open file, working through the interface your case management system already provides, so it surfaces every mention of a named person wherever it sits in LEAP, Clio, Proclaim or whatever you run. It marks what looks privileged and what carries another person's information, so a fee earner rules on the material that needs a decision rather than on all of it. Nothing leaves the firm without a qualified fee earner approving it, and the audit trail records what went out, what was held back and why, which is what the firm needs if the person complains to the regulator. The same reading sits inside Bracton, the case and client management platform, for a firm that wants it as its system rather than as an addition to one. Processing runs on United Kingdom infrastructure and client data never trains a model.
Seeing that on your own matters carries more weight than reading about it. The first written exercise on your own records is not a disclosure exercise, it reads your client ledgers, cash book and bank statements against the SRA Accounts Rules and tells you what it found. That is the same reading applied to a narrower set of documents, and the quickest way to see whether it holds up on your firm: book a client account review.