Information Management and Technology
Information Management and Technology tests how confidentiality and data obligations survive digitisation: access control, retention, vendor risk, breach response, and the careful use of tools such as cloud storage and generative AI. The recurring theme is that technology changes the medium, not the duty.
Data protection principles
- Process personal data lawfully, for specified purposes, minimising what you collect, keeping it accurate, retaining it only as long as necessary, and securing it.
- Know the lawful basis for each processing activity and be able to explain it.
- Individuals have rights of access, correction, and in some cases erasure; you need a process with deadlines, not an ad hoc response.
Security and access
- Role-based access: staff see only the matters they work on. Least privilege limits the blast radius of any breach.
- Multi-factor authentication, encryption at rest and in transit, and device management are baseline controls.
- Vendor due diligence: a cloud provider is a processor acting on your instructions, but you remain accountable to the client and the regulator for the choice.
Retention and disclosure
- Retention schedules specify what is kept and for how long; a legal hold suspends deletion once litigation or investigation is reasonably anticipated.
- Deleted data is not automatically gone: backups, sync services, and metadata copies persist.
- Disclosure and e-discovery obligations require defensible search methodology and documented preservation steps.
Worked example
A fee earner's mailbox is compromised by a phishing email and a client's transaction documents are exposed. The correct sequence: contain (reset credentials, revoke sessions, isolate devices), assess what data and whose data was involved, restore secure access with MFA enforced, notify the insurer and affected clients as required, report to the data authority within the applicable deadline if the threshold is met, then run a root cause review covering training and mail filtering.
Traps that cost marks
- Assuming the cloud vendor carries the regulatory responsibility.
- Believing a deletion request removes every copy including backups.
- Allowing AI tools to process client data without checking the terms and confidentiality position.
- Delaying breach notification while completing a full investigation.