Legal Services
Becoming a client opens a checks file: identity, credit and money-laundering results, held apart from your case. You can also be on file without ever hiring the firm, named in someone else's case. Most firms name no retention period, and a possible future claim keeps it longer.
The read at a glance
The file holds facts you told only your solicitor.
A leak exposes your legal matters, some of the most sensitive facts about you.
Case files are kept for years to decades under professional and limitation rules.
Instructing a firm requires identity and anti-money-laundering checks.
Industry profile reviewed 23 August 2026. Also machine-readable via the free API.
If it leaks
Case files hold the worst week of someone's life in detail. In one ransomware attack court bundles reached the dark web: medical records, witness statements, and the addresses of witnesses and victims.
What repeats in the policies
Becoming a client opens a checks file
To take you on, firms commonly run identity, fraud, credit and money-laundering checks and hold what they find in a file kept apart from your case. Anti-money-laundering rules in the UK require that file be kept five years after the relationship ends, and then deleted, unless the firm judges it still needed for a legal claim.
You can be on file without ever hiring them
A client can hand a firm your information as part of a case: an opposing party, a witness, someone named in a dispute. Those case files commonly sit outside the public privacy policy, and requests over them get pointed back at the client rather than the firm holding your data. Under UK law, where legal privilege applies, a firm can be exempt from telling you it holds your information at all.
No number, and a claim can keep it longer
Most firms name no figure at all. Your data stays as long as necessary, and a possible future legal claim is given as the reason to keep it longer still. Where a firm does publish a number it can reach seven years, and cover even people who only enquired and never hired them.
What a company here typically holds
Worked out from the industry, not from any one company. What you actually handed over is yours to record.
What this can reveal about you
Built only from what this kind of service actually collects. A dimension that the data does not support is not listed.
Money and net worth Likely
Estate and dispute matters lay out your assets.
Health Possible
Personal-injury and family matters reveal it.
What lawfully stays after you leave
Two kinds of hold. Law sets it: a statute makes them keep it. They set it: a ground the company grants itself.
Records tied to a live or potential dispute They set it the limitation period of the claim
They can keep records to defend a live or possible legal claim.
Identity / anti-money-laundering records Law sets it about 5 years
Money-laundering rules require ID and transaction records after an account closes.
Tax and accounting records Law sets it about 6 years
Tax and company law makes them keep billing and payment records.
Who wants this data
When a firm's files are breached, the people exposed often include those who never chose the firm. In one UK case a criminal-defence firm was hit by ransomware and court bundles landed on the dark web: medical files, witness statements, and the names and addresses of witnesses and victims. A separate leak from a single offshore firm ran past eleven million records.
Sold or shared Unlikely
Privilege and confidentiality bar the sale of your file.
AI training Low
Case files are confidential, so training use is limited.
Even anonymised, this can still be you
A case file names you, and the matter itself is often enough to identify you on its own.
Name, date of birth, postcode Typical
Fifteen demographic attributes re-identify 99.98% of Americans in a released dataset (Rocher, Hendrickx and de Montjoye, Nature Communications, 2019); date of birth, postcode, and sex alone did it for most people in the first study of the problem (Sweeney, 2000).
Payment patterns Typical
Four card transactions identify 90% of people in payment data (de Montjoye et al., Science, 2015).
How you write Typical
Language models infer where a person lives, their income, and their sex from their writing alone, at near-human accuracy and at scale (Staab et al., ICLR 2024).
Face and voice Typical
A face, voice, or fingerprint template identifies a person directly; there is nothing left to anonymise, and it cannot be reissued like a password.
The studies Estimating the success of re-identifications in incomplete datasets using generative models (Nature Communications 10, 3069, 2019)·Simple Demographics Often Identify People Uniquely (Carnegie Mellon University, Data Privacy Working Paper 3, 2000)·Unique in the shopping mall: On the reidentifiability of credit card metadata (Science 347 (6221), 2015)·Beyond Memorization: Violating Privacy via Inference with Large Language Models (ICLR 2024, 2024)
The wording that does the work
Clauses that recur across this industry, and what each one actually permits.
“to provide and improve our services”
The catch-all purpose. Analytics, profiling, personalisation and AI training all fit under it. When they want to do something new with your data, this sentence usually already allows it.
The move An objection tells them to use your data to run the service and nothing more.
“we do not sell your personal information”
Usually this means no cash changes hands. Your data can still go to ad networks, analytics firms and partners, because they count that as sharing rather than selling.
The move Use the do-not-sell switch where there is one, and put an objection in writing as well.
“service providers, partners, and affiliates”
This is how your data leaves with no name attached. Recipients are described by what they do rather than named, and you cannot send a request to a company you cannot name.
The move An access request can ask for recipients by name rather than by category, and UK and EU law put that choice with you.
“aggregated or de-identified information”
Taking your name off does not take away the pattern, and the pattern often still points at you. Policies give themselves free use of this data with no end date, on the basis that it is no longer about you.
The move If a deletion comes back as 'anonymised', keep the reply. It usually means de-identified, and it is their claim, not a fact you can check.
“retained as long as necessary, or as required by law”
They can keep it for legal duties, tax rules, fraud prevention, possible lawsuits and their own business reasons. None of those has a firm end date, so deletion turns into something you have to argue for.
The move Which reasons apply to you, and how long each runs, is a request of its own.
“you grant us a licence to use your content”
This is a contract term rather than a data setting, so a privacy request cannot undo it. A careful version ends when your account does. A broad one can be passed on, never expires and survives deletion.
The move Their terms say whether the licence ends when the account does. Close the account and log the date here.
“to establish, exercise or defend legal claims”
Retention with no end point, tied to a claim the firm only has to think possible. The same words are also used to refuse deletion, on the basis that the data is still needed for a claim that may never come.
The move Which claim is keeping your data, and whether it is live, is theirs to answer.
“is not covered by this privacy policy”
The files that hold the most about you, the case records, are placed outside the notice you are reading. Requests over them are sent to the client who supplied the data, not the firm holding it.
The move Which of them answers for the case file, the firm or its client, is theirs to name.
“unless a longer retention period is required or permitted by law”
The law is named here only as a reason to hold data longer, never to cut it short. Permitted is looser than required, so anything the law allows can become a reason to keep it.
The move What the law demands, and what it merely allows, is theirs to spell out.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply.