GDPR & Data Protection Services
Audit, compliance, policy drafting and training support for law firms.
RACO provides specialist GDPR and data protection support for law firms, covering independent audits, policy drafting, staff training, website compliance and ongoing annual support.
Our services are designed to help firms meet their obligations under the UK GDPR, Data Protection Act 2018 and Data (Use and Access) Act 2025, while ensuring data protection controls are practical, documented and maintained.
Whether your firm requires a standalone audit, updated website documentation, staff training or a complete annual compliance service, we provide proportionate support aligned to how your firm operates.
Enquire Today
View Brochure
GDPR & Data Protection Services for Law Firms
RACO provides a full range of GDPR and data protection audit, compliance and training services for law firms. Services can be taken individually or combined into a comprehensive annual subscription package, allowing firms to address specific compliance gaps or implement a complete data protection framework.
Our support includes:
- Independent GDPR and data protection audits
- Bespoke policies, controls and procedures
- Website and client-facing documentation
- GDPR and data protection training
- DUAA website compliance support
- Breach advice and ICO reporting guidance
- Subject Access Request support
- Ongoing annual compliance management
The service is designed to help firm owners and managers evidence compliance, strengthen internal controls and ensure staff understand their responsibilities when handling personal data.
Who is this service designed for?
Our GDPR and data protection services are suitable for:
- Law firms reviewing their current data protection arrangements
- Firms requiring updated GDPR, DUAA or website documentation
- Practice managers responsible for internal compliance
- Data Compliance Managers and Officers
- Senior management teams seeking independent audit and assurance
- Firms requiring ongoing support with breaches, SARs or ICO engagement
Enquire Today
Download the Full Service Brochure
For more information and costings
Our UK GDPR & Data Protection Services
An overview of each component can be found below. Click the links to find out more information about each service, and their inclusions.
Each component can be performed individually if you need light support, or we can offer a full comprehensive service covering all bases and ensuring your firms’ compliance.
GDPR & Data Protection Audit
Independent audit of your firm’s data protection framework to assess compliance with UK GDPR and the Data Protection Act 2018. Identifies gaps, risks and areas for improvement, with a detailed report and practical recommendations to ensure systems, controls and policies are fit for purpose.
GDPR Policy, Controls & Procedures Suite
A comprehensive suite of bespoke GDPR and data protection policies, controls and procedures, covering both internal compliance frameworks and client-facing documentation. Designed to reflect how your firm operates while ensuring compliance with UK GDPR, the Data Protection Act 2018 and DUAA requirements.
GDPR & Data Protection Training
Practical, tailored training for staff, compliance officers and senior management, covering data protection principles, roles and responsibilities, breach management, Subject Access Requests and ICO engagement. Sessions are adapted to your firm’s needs and delivered without minimum delegate requirements.
DUAA Website Compliance Package
Targeted support to ensure your website and client-facing documentation meet current data protection requirements under the Data (Use and Access) Act 2025. Covers key areas such as cookie policies, complaints handling and DSAR guidance to address immediate compliance gaps.
Full GDPR & Data Protection Compliance Service
An annual subscription service providing ongoing management and oversight of your firm’s data protection compliance. Includes policy maintenance, breach support, register management, training, auditing and ICO reporting, ensuring your firm remains compliant on an ongoing basis.
Download the Full Service Brochure
For more information and costings
GDPR & Data Protection Audit
The Regulation and Compliance Office (RACO) offers specialist GDPR auditing services designed to assess a law firm’s data protection practices and compliance with the UK GDPR and Data Protection Act 2018.
The Information Commissioner’s Office (ICO) advises that audits are a key part of assisting organisations in understanding and meeting their data protection obligations to confirm that controls are fit for purpose and that policies and procedures effectively support and document compliance.
It is considered best practice to perform an audit to ensure there is ongoing focus on protecting and managing customer’s data and that the systems and staff are compliant with the regulations and enable a firm to respond to any internal or external changes.
Our UK GDPR and Data Protection Audit will provide the firm’s management with the confidence of knowing that it is compliant with the requirements of the regulation and can demonstrate such compliance. We will identify any issues or concerns along with knowledge gaps and provide solutions and proposals to rectify these.
A full report will be issued to the firm, which will be followed up with a discussion of any recommendations and actions that are made. We will identify any issues or concerns along with knowledge gaps and provide solutions and proposals to rectify these. For detailed information on this service and costings, download our brochure.
Standalone price: £2,400 + VAT
The following key areas will be considered as part of the audit:
- NAll policies to ensure they are up to date with the latest regulations and legislation.
- NData Retention approach and management
- NSystem security
- NInternal data storage processes
- NExternal arrangements for data storage processes
- NData management control
- NData Portability
- NCyber Crime Protection and Awareness
- NRemote working management
- NTerms and Conditions
- NData Controller/Processor arrangements and agreements
- NContracts
- NCustomer Notices
- NInternal systems and controls
- NStaff Notices
- NReporting
- NBreach Management & Storage
- NSubject Access Request Management
- NICO Reports and Engagement
GDPR & Data Protection Policy, Controls & Procedures Suite
A comprehensive set of bespoke data protection policies, controls and procedures ensuring your firm meets its legal obligations under UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025 (DUAA). Policies are drafted to reflect how your firm actually operates and cover both internal compliance infrastructure and client-facing website documentation.
For detailed information on this service, please get in touch with our team to discuss your requirements.
Standalone price: £1,200 + VAT – does not include other services
Internal Policies & Controls
- NGDPR and DUAA Policy
- NData Retention Policy
- NBring Your Own Device Policy
- NIT and Cybersecurity Policy
- NInformation Security Policy
- NData Protection Impact Assessment Template
- NData Protection Privacy Notices (Employees and Recruitment)
- NData Notices (Employees)
- NDSAR Notices
Website & Client-Facing Documents
- NPrivacy Policy
- NCookie Policy
- NWebsite Terms and Conditions
- NData Notices (Clients)
GDPR & Data Protection Training
Tailored training for all staff, Data Compliance Managers and Officers, and senior management. Sessions cover UK GDPR and Data Protection Act 2018 principles, roles and responsibilities, data management and retention, breach management and reporting, Subject Access Requests, ICO engagement, and system safeguards. All sessions are tailored to the needs of your firm with no minimum number of delegates.
For detailed information on the training available, and to book one of these causes, please see full details on our Training page.
From £800 + VAT (half-day session)
GDPR & Data Protection Training
DUAA Website Compliance Package
With updates to data protection law already in effect under the Data (Use and Access) Act 2025, many firms’ websites are no longer compliant. This package, delivered jointly with FireTap Legal Marketing, addresses the practical changes firms need to make now, including cookie consent and website policy, complaint handling procedures, and DSAR guidance.
Includes:
- Updated data protection complaints policy
- Cookie policy review and updated cookie policy
- DSAR guidance note
From £500 + VAT
Full GDPR Data Protection and Compliance Service – Annual Subscription
Our GDPR & Data Protection Compliance Service has been designed to provide law firms with an effective solution for the management and control of compliance surrounding data its use, management and storage to ensure that a business is and remains compliant with the GPR and Data Protection Act 2018. Our service is an annual subscription that provides firms with ongoing support from our compliance team and ensures your firm has in place appropriate and compliant Policies, Controls and Procedures (PCP’s) that are maintained by us.
Staying compliant with the GDPR and Data Protection Acts requires constant management. Our service will ensure internal officers have additional support to ensure a business remains compliant.
From £3,000 + VAT — Annual cost
Our GDPR and Data Protection Compliance services include:
- NBreach Advice & Guidance
- NRegister Management
- NPolicies, Controls and Procedures
- NPolicy Drafting & Maintenance
- NGeneral Terms & Conditions & Contracts
- NWebsite Policies & Documentation
- NTraining for Data Protection Officers & Staff
- NIndependent Auditing
- NICO Breach Reporting
- NSubject Access Request Responses & Management
Contact Our Team
To ask any questions about the Regulation and Compliance Office and how we can support your Law Firm, please call us on 0203 985 8550, complete the online enquiry form below, or email us info@regulationandcomplianceoffice.co.uk