Data protection for the lawyer who practises alone: information, register and officer

A lawyer who practises on their own account is, for data protection purposes, the controller of the data of their clients and the other people who appear in their files. Organic Law 3/2018 of 5 December on Personal Data Protection and guarantee of digital rights, published in BOE no. 294 of 6 December 2018, supplements the General Data Protection Regulation with rules that directly affect the solo firm.

We review four of them: information to the client, the controller's measures, the register of activities and the data protection officer.

1. Informing the client

Article 11 of the organic law allows the duty to inform to be met by providing basic information and referring to the rest. Under its paragraph 2, that basic information must include, at least:

• The identity of the controller and, where applicable, their representative.
• The purpose of the processing.
• The possibility of exercising the rights in Articles 15 to 22 of the General Data Protection Regulation.

In practice, the natural place for this information is the engagement letter. The Organic Law on the Right of Defence includes among its contents the handling of the client's data, as we explain in the summary of the Organic Law on the Right of Defence.

2. Technical and organisational measures

Article 28 of the organic law obliges controllers and processors to determine the appropriate technical and organisational measures to ensure and demonstrate that processing complies with the rules.

For a lawyer working alone, this translates into concrete decisions: how files are stored, who has access to the computer and email, how backups are made and which tools are used. The key is in the word demonstrate: doing it right is not enough, you must be able to prove it.

Artificial intelligence tools are a good example. Before entering a client's data into an external tool, it is wise to check where it is processed and for what. We cover this in the editorial on AI policy at the law firm.

3. The register of processing activities

Article 31.1 of the organic law establishes that controllers and processors must keep the register of processing activities referred to in Article 30 of the General Data Protection Regulation.

A simple register for a solo firm can be organised by activity:

The content that must appear in the register is set by Article 30 of the General Data Protection Regulation, to which the organic law refers, and it is wise to review it in its text. The table only suggests a way to organise the activities of a small firm.

4. Is a data protection officer needed?

Article 34.1 of the organic law lists the entities that must appoint a data protection officer, in addition to the cases in Article 37.1 of the General Regulation. That list includes professional associations and their general councils, but lawyers and firms do not appear.

That does not rule out a firm having to appoint one if it falls under any of the cases in the General Regulation, which must be analysed case by case. And Article 34.2 allows appointing one voluntarily.

If one is appointed, Article 34.3 obliges the appointment, designation or removal to be notified to the Spanish Data Protection Agency, or the competent regional authority, within ten days.

Checklist

1. Include the basic information in the engagement letter and on the website.
2. Draw up the register of activities and review it when something relevant changes.
3. Document the security measures: access, backups, encryption and tools.
4. Analyse whether any case in the General Regulation requires appointing an officer.
5. Separate each client's data and funds, consistent with the rules on client funds.

More guides in Solo and small-firm lawyers.