LOCS:23 Qualified Consultancy

In February 2024, the Legal Services Operational Privacy Certification Scheme, or LOCS:23 , was approved by the Information Commissioner’s Office ( ICO ). This new certification scheme is aimed at legal service providers who operate in the UK, or deal with clients in the UK. – this includes law firms, solicitors, in-house lawyers, barristers, other providers of legal services and their supply chain partners who process the personal data of clients.

Processors and sub-processors within scope include, for example:

• Software providers
• Software-as-a-service ( SAAS ) providers
• Infrastructure-as-a-service ( IAAS ) providers
• Platform-as-a-service ( PAAS ) providers
• External consultants
• Service providers (e.g. translation, transcription and off-site storage)
• Third-party legal service providers (e.g. barristers, law firms and notaries)

The LOCS:23 scheme addresses data protection compliance when processing personal data contained in the “Client File”. This includes data collected through the whole lifecycle of a client relationship – from marketing, the initial engagement with a client and providing advice, to closing and archiving the file.

• LOCS:23 is currently the only ICO-approved certification scheme for legal service providers.
• Reassure your clients, stakeholders and other users of legal services that your organisation is compliant with the UK GDPR:
  
  
  • Your policies, processes and data protection training programme have been approved and/or certified by an independent organisation to ensure you process personal data in your client files in a compliant manner.
  • They can be confident that personal data provided will be protected, kept secure, processed fairly and only kept as long as is necessary.
  • You recognise data subject rights and have the processes to enable them.
  • Your breach response processes have been assessed to confirm that they have appropriate management and remediation controls so that relevant individuals are notified as soon as possible, and potential harm is minimised.
  • Your data-sharing processes have been assessed to ensure that personal data is only shared where it is lawful to do so and with the required protections in place. You maintain consistent standards through the legal supply chain.
  • You promote best practice and ensure that your vendors and service providers do the same.
    
• Gain competitive advantage and simplify procurement and tender processes. Certification will give confidence to users of legal services. It should also reduce time spent on lengthy data protection and third-party supplier questionnaires during their procurement processes. Even where not mandated, having the standard in place will ensure competitive advantage over other legal service providers and their supply chain who have not achieved the standard.
  
• Maintain consistent standards through the legal industry. This LOCS:23 standard is expected to become an industry norm, and a requirement of public-sector organisations and larger corporate players commissioning legal services.
  
• Simplify compliance with other standards such as Lexcel, ISO 27001, Cyber Essentials and Cyber Essentials Plus by having achieved an approved, measurable and auditable level of compliance with an ICO-approved data protection standard.
  
• Reduce penalties or enforcement action. Despite all your hard work, if a breach occurs, certification is likely to be taken into account as a mitigating factor, if you followed the scheme requirements and took all reasonable steps to prevent non-compliance.
  
• Stay up to date with best practice. The LOCS:23 standard is updated with emerging ICO guidance and input from LOCS:23 fellows.
  
• Meet GDPR Article 28 requirements when appointing a processor or sub-processor.
  
• Ensures that the territorial scope of UK GDPR is recognised by non-UK-based legal service providers and their vendors/service providers.
  
• Assist compliance with international data transfer rules. The certification may be referred to as a “supplemental measure” when assessing any cross-border transfers.
  
• Reassure professional indemnity insurers of your high standard of compliance, hoping to achieve reduced or lower levels of premium.
  
• Take steps to protect your organisation from cyberattacks and reduce liability. Recently, there has been a huge increase in cyberattacks on legal service providers and their suppliers. Many firms handle large amounts of special category personal data (e.g. health and criminal conviction data), or highly confidential commercial and financial information. This makes firms and their supply chain targets for cyberattacks. Becoming LOCS:23 Ready doesn’t stop attackers, but it should reduce their chances of success – through implementing a full suite of security measures, carrying out training and testing in line with the LOCS:23 scheme. It should also help you to deal with and mitigate potential liability claims following such incidents, demonstrating that you had taken all reasonable data protection compliance steps to help avoid the incident occurring.

The process can follow various paths and we are happy to tailor our approach to suit you:

• Becoming “LOCS:23 Ready” by us as a LOCS:23 Qualified Consultancy.

  We will complete a gap analysis of your organisation against the LOCS:23 standard, highlighting any remedial work required. If you pass, we can issue “LOCS:23 Ready” status, which will show on the LOCS:23 register, and enable you to tell clients that you have demonstrated appropriate compliance with the UK GDPR.

  This will help you on your journey to full certification by ADISA if you decide to go down that route (see below). This route is less expensive and less labour-intensive for you. You may decide that achieving LOCS:23 Ready status is sufficient to meet your compliance aims.

• Becoming “LOCS:23 Certified” by ADISA.

  If you decide to proceed through to the full certification by ADISA, you will need to make an application to ADISA. ADISA will request information on your organisation, including evidence of your own audit against the LOCS:23 standard. Before you submit your application to ADISA, we can help with that initial audit by completing a gap analysis and helping you to complete any remedial work that may be identified.

  ADISA will then complete an onsite visit, where they will dive deeper into how you have embedded the standard into your organisation’s compliance. They will recommend remedial work where appropriate. If you are successful, you will receive a certificate from ADISA and you will also appear in the national public register of LOCS:23 certified bodies. You can see who has already been certified here .

• Becoming “LOCS:23 SFE Approved” by us as a LOCS:23 Qualified Consultancy.

  If you are a small firm, we can assess your data protection compliance against the streamlined “LOCS:23 SFE” standard.

  This is not approved by the ICO, or approved independently by ADISA, but mirrors much of the main LOCS:23 standard. This may suit you if you wish to keep compliance costs low, and still benefit from setting up your compliance structure in a standard format, which is easily comparable across the industry – and will facilitate a move to the full standard in the future.

Our first step involves discussing your current level of data protection compliance. We work with you to review your documentation and training programme.

Next, we identify any gaps between your current data protection measures and the requirements of the LOCS:23 Standard. We conduct a review of all relevant documents, including policies, processes and details of your training programme.

Areas under scrutiny include:

• Your data governance model.
• Data subject rights.
• Technical and operational controls to protect data, including Data Protection Impact Assessments (DPIAs), Records of Processing Activities (ROPAs) and breach notification processes.
• Protections and safeguards in your supply chain.
• Additional safeguards for third-party cross-border data sharing.

We have long-standing expertise in performing audits and gap analysis (see here) as well as over 20 years’ experience of working with legal service providers. We can help identify what is needed to meet the LOCS:23 standard, as well as identifying wider best practice.

• Help you to plan how to tackle the gaps and prioritise the actions needed.
• Help you to understand any further best practice measures you may wish to put in place.
• We have a long-standing and proven track record in working with legal service providers and organisations of all shapes and sizes, from owner managed businesses to large multinationals, ensuring that they can identify their compliance gaps and build successful accountability and compliance programmes – see here for more detail.
• To plug gaps or evidence compliance, we can also help with all of the following and more:
  • Creating data protection policies and procedures.
  • Appropriate transparency and privacy notices.
  • Data processor agreements.
  • Breach-handling processes.
  • Data-sharing arrangements.
  • Compliant marketing processes.
  • Compliant use of Artificial Intelligence (AI) and Automated Decision Making.
  • Data Protection Impact Assessments (DPIAs) – creating DPIA processes, and advice on completing them.
  • Compliant international data transfers.
  • Appropriate handling of DSARS and other individual rights requests.
  • Compliant use of social media and adtech.
  • Records of Processing Activities (ROPAs), Data Retention policies and other records.

The LOCS:23 standard requires you to demonstrate that you are monitoring the implementation of LOCS:23 controls through the use of regular audits. We can help you carry out those audits at the outset and then annually, to check that you are continuing to meet required standards.

Following a successful audit, a LOCS:23 Approved Implementor at Pritchetts Law, itself a LOCS:23 Qualified Consultancy, will award you ‘LOCS:23 Ready’ status. This will allow you to use the official LOCS:23 Ready logo.

• If you decide to proceed to full ADISA certification, we can help you with your application, and your LOCS:23 Ready status should help to streamline the work involved at this stage. For example, larger law firms will be billed by ADISA on a time spent basis. If you have already achieved the LOCS:23 Ready status, this should significantly reduce those costs.
• If you achieve the full ADISA LOCS:23 certification as either a “Certified Data Controller” or a “Certified Data Processor”, it will last for 3 years before you need to recertify.
• To achieve re-certification, you will be expected to audit the organisation annually to ensure adequate training, policies and processes are in place. We can assist you to ensure that these audit and other processes are up to date, as well as preparing for any future recertification process.

There may be crossover among the LOCS:23 Standard and other relevant standards such as ISO 27001, Cyber Essentials, Cyber Essentials Plus and Lexcel. We can help you to identify where this is the case so that you avoid unnecessary duplication work and costs.