Becoming a client opens a checks file: identity, credit and money-laundering results held apart from your case, and you can be on file without ever hiring the firm, named in someone else's matter. Most firms name no period, and a possible future claim keeps it longer.
Privileged, deeply sensitive records. Keep the record.
Case files are kept for years to decades under professional and limitation rules.
Instructing a firm requires identity and anti-money-laundering checks.
Industry profile reviewed 23 August 2026. Also machine-readable via the free API.
Case files hold the worst week of someone's life in detail. In one ransomware attack court bundles reached the dark web: medical records, witness statements, and the addresses of witnesses and victims.
Becoming a client opens a checks file
To take you on, firms commonly run identity, fraud, credit and money-laundering checks and hold what they find in a file kept apart from your case. Anti-money-laundering rules in the UK require that file be kept five years after the relationship ends, and then deleted, unless the firm judges it still needed for a legal claim.
You can be on file without ever hiring them
A client can hand a firm your information as part of a matter: an opposing party, a witness, someone named in a dispute. Those records, the case files, commonly sit outside the public privacy policy, and requests over them are pointed back at the client, not the firm holding your data. Under UK data-protection law, where legal privilege applies, a firm can be exempt from telling you it holds your information at all.
No number, and a claim can keep it longer
Most firms name no figure at all: your data stays "as long as necessary," and a possible future legal claim is cited as reason to keep it longer still. Where a firm does publish a number, it can reach seven years, and cover even people who only enquired and never hired them.
Worked out from the industry, not from any one company. What you actually handed over is yours to record.
Built only from what this kind of service actually collects. A dimension that the data does not support is not listed.
Estate and dispute matters lay out your assets.
Personal-injury and family matters reveal it.
Two kinds of hold. LAW SETS IT: a statute makes them keep it. THEY SET IT: a ground the company grants itself.
They can keep records to defend a live or possible legal claim.
Money-laundering rules require ID and transaction records after an account closes.
Tax and company law makes them keep billing and payment records.
When a firm's files are breached, the people exposed often include those who never chose the firm. In one UK case a criminal-defence firm was hit by ransomware and court bundles landed on the dark web: medical files, witness statements, and the names and addresses of witnesses and victims. A separate leak from a single offshore firm ran past eleven million records.
Bound by privilege and confidentiality; not sold.
Confidential and narrow; limited training use.
Anonymised is their word. A case file names you, and the matter itself is often uniquely identifying.
Fifteen demographic attributes re-identify 99.98% of Americans in a released dataset (Rocher, Hendrickx and de Montjoye, Nature Communications, 2019); date of birth, postcode, and sex alone did it for most people in the first study of the problem (Sweeney, 2000).
Four card transactions identify 90% of people in payment data (de Montjoye et al., Science, 2015).
Language models infer where a person lives, their income, and their sex from their writing alone, at near-human accuracy and at scale (Staab et al., ICLR 2024).
A face, voice, or fingerprint template identifies a person directly; there is nothing left to anonymise, and it cannot be reissued like a password.
THE STUDIES Estimating the success of re-identifications in incomplete datasets using generative models (Nature Communications 10, 3069, 2019)·Simple Demographics Often Identify People Uniquely (Carnegie Mellon University, Data Privacy Working Paper 3, 2000)·Unique in the shopping mall: On the reidentifiability of credit card metadata (Science 347 (6221), 2015)·Beyond Memorization: Violating Privacy via Inference with Large Language Models (ICLR 2024, 2024)
Clauses that recur across this industry, and what each one actually permits.
“to provide and improve our services”
The catch-all purpose. Analytics, profiling, personalisation, and increasingly AI training can all ride under it. When they want to do something new with your data, this sentence usually already covers it.
THE MOVE An objection draws the line: use your data to run the service, not to improve, target, or train on it.
“we do not sell your personal information”
Often technically true, and still misleading. It usually means no cash changes hands. Data can still flow to ad networks, analytics firms, and partners: on their definition, sharing is not selling.
THE MOVE Flip the do-not-sell switch where one exists. The written objection on top of it goes on your record.
“service providers, partners, and affiliates”
How data leaves the building with no name attached. Recipients are listed by what they do, never who they are. You cannot send a request to a company you cannot name, which is the point.
THE MOVE An access request can ask for the recipients by name, not just the categories. UK and EU law put that choice with you. The reply, or the silence, goes on your record.
“aggregated or de-identified information”
Stripping the name does not strip the pattern, and the pattern often still points at you. Policies grant themselves free, indefinite use of this data because in their telling it is no longer about you.
THE MOVE If a deletion comes back as 'anonymised', keep the reply. It is their claim, not a fact you can check.
“retained as long as necessary, or as required by law”
They can keep it for: legal duties, tax rules, fraud prevention, possible lawsuits, their own business reasons. None of them carries a firm end date. Deletion becomes a negotiation, not an event.
THE MOVE Which reasons apply to you, and how long each runs, is a request of its own. Their reply goes on your record.
“you grant us a licence to use your content”
A contract term, not a data setting, so a privacy request cannot undo it. The careful version ends with your account. The broad version can be passed on, never expires, and survives deletion.
THE MOVE Whether the licence ends with the account is written in their terms, not yours. Closing the account goes on your record.
“to establish, exercise or defend legal claims”
Retention with no end point, keyed to a lawsuit the firm only has to think possible. The same words double as a reason to refuse deletion: they still need it, they say, for a claim that may never come.
THE MOVE Which claim is keeping your data, and whether it is live, is theirs to answer. Their reply goes on your record.
“is not covered by this privacy policy”
The files that hold the most about you, the case records, are placed outside the notice you are reading. Requests over them are sent to the client who supplied the data, not the firm holding it.
THE MOVE Which of them answers for the case file, the firm or its client, is theirs to name. The reply, or the silence, goes on your record.
“unless a longer retention period is required or permitted by law”
A one-way ratchet: the law is named only to hold data longer, never to cut it short. "Permitted" is looser than "required," so anything the law allows can become a reason to keep it.
THE MOVE What the law here demands, as against what it merely allows, is theirs to spell out. Their reply goes on your record.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply. Start your record →