What it means for a UK law firm
Data residency matters to UK law firms because personal data in client files is protected by UK GDPR and the Data Protection Act 2018. Transfers of personal data outside the UK must meet the rules in Chapter V of UK GDPR, for example because the destination is approved by UK regulations or because appropriate safeguards are in place. The Data (Use and Access) Act 2025 amended these transfer rules, so firms should check the current text and the ICO's guidance on international transfers.
Data residency for AI has two parts: where documents are stored, and where the AI model processes prompts and responses. The two are often in different places, and a firm should know both.
Data residency can also be a contractual question. Some clients' terms of engagement or panel terms restrict where their data may be held, so firms should check those terms before adopting a tool.
Example
Illustrative scenario
A firm's client terms require it to tell the client about any processing of client data outside the UK. Before rolling out an AI tool, the firm records where documents are stored and where AI processing happens, and updates its privacy notice and client terms where needed.
How Chancery handles it
Chancery stores data in Microsoft Azure UK South, and AI processing takes place within Microsoft's EU data zone; see Security.
Related terms
- Client confidentiality
- Zero data retention (ZDR)
- Model training on client data
- Legal professional privilege