The recent update to the Core Practice Management Standards (CPMS) requires CQS firms to have a policy in place in relation to Information management and security (s3.2).
Policy documents can be time-consuming and difficult to prepare.
52 sections in the current version.
The Information Management and Security Policy includes reference to:
...as well as other formalities and general obligations as required under 3.2 of the CPMS.
Own an earlier version? Buy only the paragraphs that have changed. Each paragraph arrives by email as a PDF as soon as you pay.
Additional section Introduces controls for approved conveyancing portals, authorised information sharing and timely downloading of documents. It also assigns responsibility for document review and portal notifications, reflecting the proposed Conveyancing Protocol.
The SRA’s warning notice last month highlights inaccurate AI-generated material, inadequate supervision and the disclosure of confidential client information to systems without appropriate safeguards. Firms with existing AI governance provisions should update them to refer expressly to the warning notice and confirm that AI use does not displace individual professional responsibility or the requirement for human verification
The use or wearing of audio/video-capable smart eyewear, covert devices, or unapproved wearable technology is strictly prohibited during all client meetings, internal discussions, and on firm premises without express prior written authorisation. Any unauthorised recording produced during the course of firm business constitutes a material breach of confidentiality and data security protocols.
Generative AI introduces severe data security and professional conduct risks that require urgent updates to your firm's internal procedures particularly your Information Management and Security Policy
To mitigate escalating AI-generated spoofing risks, these updated procedures prohibit altering bank details based solely on telephone or video calls. Mandatory three-factor verification,utilising secure portals, physical mail, and OTP-verified callbacks, is now required to ensure robust transactional security.
Explicit prohibition copying and pasting client data or confidential documents into public AI tools (like ChatGPT or Gemini Free.This is crucial given public tools retain data for training, which constitutes a breach of client confidentiality and a GDPR violation
Buying 7 or more paragraphs? The full current policy costs the same or less at £475.00 + VAT.
Sample template bundles do not include a template to show the structure of the residential conveyancing department at a firm. The data protection policy template covers the requirements of CQS, however it is the responsibility of the firm to ensure it is compliant with the requirements of the General Data Protection Regulation.