Privacy Policy

Privacy Policy

Giles Powell, Barrister, Advocate and Mediator · Last updated: 26 September 2026 

In order to provide legal advice, representation and mediation services I need to collect and hold personal information. This may be your personal data or information relating to other people involved in a matter, such as opponents, witnesses and experts. I take care to protect that information and to handle it in a way that respects your rights. This privacy policy explains what information I collect, how I use and share it, how long I keep it, and the rights you have in relation to it.

1. Data Controller

I, Giles Powell, practising at Tyrrhyddid Chambers, am the data controller for the personal data I hold and process as a barrister and mediator. I am registered with the Information Commissioner's Office (ICO) under registration number C1468335. If you need to contact me about your data or this policy, you can reach me by email at gilespowell@gilespowell.co.uk or by telephone on 07903 830083.

2. Information I Collect

When providing legal services I may collect some or all of the following personal information:

1. personal details
2. family details
3. lifestyle and social circumstances
4. goods and services
5. financial details
6. education, training and employment details
7. physical or mental health details
8. racial or ethnic origin
9. political opinions
10. religious, philosophical or other beliefs
11. trade union membership
12. sex life or sexual orientation
13. genetic data
14. biometric data for the purpose of uniquely identifying a natural person
15. criminal proceedings, outcomes and sentences, and related security measures
16. other personal data relevant to instructions to provide legal services, including data specific to the instructions in question.

Categories 7 to 14 are special categories of personal data and category 15 is criminal offence data; together I refer to these below as "sensitive data".

Information collected from other sources. Most of the information I hold is provided to me, or gathered by me, in the course of your case. I may also obtain the same categories of information from other sources, including instructing solicitors and other legal professionals, experts and other witnesses, members of the public, your family and friends, courts and tribunals, investigators, prosecution bodies, government departments and regulators, and publicly available registers, searches and media.

Whether you have to provide information. If I have been instructed by you or on your behalf, your personal information has to be provided so that I can advise or represent you, comply with my professional obligations and keep accounting records.

3. Why I Use Your Information

I may use your personal information for the following purposes:

1. to provide legal services, including legal advice and representation in courts, tribunals, arbitrations and mediations
2. to keep accounting records and carry out office administration
3. to take or defend legal or regulatory proceedings or to exercise a lien
4. to respond to or make complaints
5. to check for potential conflicts of interest in relation to future cases
6. to promote and market my services
7. to carry out anti-money laundering and terrorist financing checks
8. to train pupils and other barristers and when providing work-shadowing opportunities
9. to respond to requests for references
10. when procuring goods and services
11. to publish legal judgments and decisions of courts and tribunals
12. as otherwise required or permitted by law.

4. My Lawful Basis For Using Your Information

The UK General Data Protection Regulation (UK GDPR) requires me to have a lawful basis for processing personal data. I rely on the following:

• Performance of a contract. If you are a client, processing is necessary to perform my contract to provide legal services, or to take steps at your request before entering into that contract.
• Legal obligation. Some processing is necessary to comply with legal and regulatory obligations, for example anti-money laundering checks, tax returns and my obligations to the Bar Standards Board.
• Legitimate interests. For information that is not sensitive data, I rely on my legitimate interests, or those of a third party, in the efficient conduct of my practice, including conflict checking, practice management, accounting and debt recovery, the defence of complaints and claims, professional development, and marketing to existing contacts, except where those interests are overridden by your interests, rights or freedoms.
• Public interest. The publication of judgments and decisions of courts and tribunals.
• Consent. I rely on your consent for the two purposes described in section 9 below.

Sensitive data. Where I process special category data or criminal offence data (categories 7 to 15 above), I do so because it is necessary for the establishment, exercise or defence of legal claims, or for the giving of legal advice, under Article 9(2)(f) and Article 10 of the UK GDPR and paragraph 33 of Schedule 1 to the Data Protection Act 2018. Processing on this basis does not depend on your consent and continues for as long as it is necessary for your matter and my professional and legal obligations. On occasion I may also process sensitive data where it is necessary for reasons of substantial public interest, such as preventing or detecting unlawful acts, or where you have given your explicit consent for a specific purpose.

5. Who I Share Your Information With

If you are a client, some of the information you provide will be protected by legal professional privilege unless and until it becomes public in the course of proceedings or otherwise. As a barrister I have an obligation to keep your information confidential, except where it becomes public or is disclosed as part of the case or proceedings.

It may be necessary to share your information with:

• data processors who provide services to my practice, including IT support, email and data storage providers, artificial intelligence service providers (currently Anthropic) and the provider of analytics, maps and translation for my website (Google)
• instructing solicitors and other legal professionals involved in your case, including opposing counsel for the purposes of resolving the case
• pupils and mini-pupils under my training
• experts and other witnesses
• prosecution authorities
• courts and tribunals, including the judiciary and court staff
• lay clients and opposing parties
• family and associates of the person whose personal information I am processing
• in the event of a complaint, the Bar Standards Board, the Legal Ombudsman and my legal advisers
• other regulatory authorities
• current, past or prospective employers, and education and examining bodies
• professional advisers and trade bodies, including my accountant, the Bar Council and the Bar Mutual Indemnity Fund (my professional indemnity insurers)
• legal directories and any panel or tendering body, for the purposes of professional development
• the intended recipient, where you have asked me to provide a reference
• the general public, in relation to the publication of judgments and decisions of courts and tribunals
• any other person, where I ask for and you give your consent to the sharing.

I may be required to provide your information to regulators such as the Bar Standards Board, the Financial Conduct Authority or the ICO. In the case of the ICO, there is a risk that your information may lawfully be disclosed by them for the purposes of other civil or criminal proceedings, without my consent or yours, including privileged information. I may also be required to disclose your information to the police or intelligence services where required or permitted by law or by court order.

Transfers outside the UK. Most of my processing takes place in the UK. My email is hosted by IONOS on Microsoft Exchange servers in IONOS data centres in the United Kingdom and the European Union, which the UK recognises as providing adequate protection. My documents are held on my own systems in the United Kingdom and on Microsoft OneDrive in Microsoft data centres in the United Kingdom, with remote support access from other countries under the UK International Data Transfer Addendum. My artificial intelligence assistant, provided by Anthropic, processes data in the United States under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, approved by the Information Commissioner. Google processes website analytics and map requests in the United States and is certified under the UK Extension to the EU-US Data Privacy Framework, which the UK Government has approved as providing adequate protection. Where your matter involves parties, courts or tribunals outside the UK, it may be necessary to transfer information to them for the purposes of the proceedings. A copy of the safeguards I rely on is available on request.

6. Use Of Artificial Intelligence

Like most professional practices, I use technology to help me work efficiently. This includes Claude, an AI assistant provided by Anthropic, which helps me research, analyse and draft documents in the course of providing legal services. Case material, which may include your personal data, is processed by Anthropic on my behalf under a written data processing agreement that prohibits use of the data for any purpose other than providing the service to me, including training AI models. Data is transferred to Anthropic's servers in the United States under the UK International Data Transfer Addendum approved by the Information Commissioner. I have carried out a data protection impact assessment of this processing, which concluded that the risk to individuals is low with the safeguards in place. Everything the AI produces is reviewed by me before it is used, and every decision about your matter is mine; I do not make decisions about you by automated means. Material is deleted from the service when a matter closes. If you have questions about this, or would prefer that your case be handled without AI tools, please contact me.

7. How Long I Keep Your Information

I will normally keep your information:

• until at least one year after the expiry of any relevant limitation period, which will usually mean 15 years from the date of the last item of work, as recommended by the Bar Mutual Indemnity Fund. This is because the information may be needed for potential legal proceedings or a complaint. At that point further retention is reviewed and the data is marked for deletion, or for retention for a further period only where it is needed for legal proceedings, regulatory matters or an active complaint. Deletion is carried out without further notice as soon as reasonably practicable after the data is marked for deletion.
• for conflict-checking purposes, for the rest of my career, limited to your name and contact details, the name of the case and the case reference. This does not include any sensitive data.
• for anti-money laundering purposes, until five years after the completion of the transaction or the end of the business relationship, whichever is later.
• for marketing purposes, as described in section 8.

Where I have used my AI assistant on your matter, the copy of your material held on that service is deleted when the matter closes; my own file is retained for the periods above. I may retain pleadings and other documents I have drafted, in anonymised form, for training and legal research.

I will delete or anonymise your information earlier at your request unless there is an unresolved issue such as a claim or complaint, I am legally required to keep it, or there are overriding legitimate reasons to do so.

8. Marketing

I may send occasional updates about my practice, such as news of seminars, articles or changes to the services I offer, to people I have worked with or who have expressed an interest in my work.

Where you are an existing or former client, or a solicitor or other professional who has instructed me, I rely on my legitimate interests in maintaining professional relationships as the basis for this. Where you have not instructed me, I will only send you marketing if you have asked to receive it, and I rely on your consent.

I keep marketing contact details for as long as the relationship is active and for up to two years after my last contact with you, after which I delete them unless you have asked to continue receiving updates.

You can opt out at any time by emailing gilespowell@gilespowell.co.uk or by using the unsubscribe link in any message. I will stop sending marketing as soon as I receive your request, though it may take a few days to take effect. Opting out of marketing does not affect correspondence about any matter on which you have instructed me.

9. Consent

I rely on your consent to sending you marketing material (section 8), and using anonymised or suitably redacted material from your matter for the training of pupils and other barristers (purpose 8 in section 3). I will ask for that consent separately and will not treat your instructions to act as consent to either.

You may withdraw consent for either purpose at any time by emailing gilespowell@gilespowell.co.uk. Withdrawal does not affect the lawfulness of anything done before it, and it does not affect the processing I carry out on other bases, including the conduct of your case, my professional record-keeping and any fees you may owe me.

10. Your Rights

The UK GDPR gives you rights over your personal data. Subject to the limits that apply to legal professional privilege and to my professional obligations, you have the right to:

• ask for access to the personal data I hold about you and a copy of it
• ask me to correct any inaccuracies
• ask me to delete your data, or to restrict how I use it
• object to processing based on my legitimate interests, and to direct marketing at any time
• receive the data you have provided to me in a portable format
• withdraw any consent you have given.

To exercise any of these rights, contact me at gilespowell@gilespowell.co.uk. I will respond within one month, or tell you if I need longer for a complex request. I may need to confirm your identity before acting on a request.

11. Complaints

If you are unhappy with how I have handled your personal data, please contact me first at gilespowell@gilespowell.co.uk and I will do my best to resolve it; I acknowledge complaints within 30 days. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, and you may seek compensation through the courts for any damage or distress caused by a breach of data protection law.

12. Cookies and Website Tools

Cookies are small text files placed on your device when you visit a website. This site uses the following:

Essential cookies. Set by IONOS, which hosts this site, to make it work: for example to remember your cookie choices and to keep the site secure. These do not need your consent and cannot be switched off.

Google Analytics  (cookies named _ga and ga, expiring after two years). These collect anonymous statistics about how visitors use this site, such as which pages are viewed and for how long, so that I can improve it. IP addresses are anonymised, the data is not used by Google for its own purposes, and it is not shared with any other service. You can object to these cookies at any time by clicking the link below, which switches Google Analytics off for your browser, or by installing Google's opt-out browser add-on at tools.google.com/dlpage/gaoptout. Objecting does not affect your use of the site.