Lawful Bases for Processing Client Records in a Documentation Engagement

An engagement typically combines contractual processing (the work the client has instructed), legal obligation processing (regulatory record-keeping), legitimate interests (internal quality assurance), and occasionally consent (for activities the client could reasonably refuse). Applying a single basis across all of it is convenient and incorrect.

The file lists each processing activity separately with its basis and the source of that basis. Where the same data is processed under more than one basis for different purposes, the dual treatment is documented rather than collapsed for tidiness.

Most of the substantive work — handling the records the client has supplied, producing the deliverables they have engaged us to produce — sits under contract. The processing is necessary to perform the contract; the basis is straightforward; the documentation requirement is brief but real.

The contract basis is recorded with reference to the engagement letter that establishes it. Where an activity falls outside the scope of the engagement letter, contract is not the available basis, and the file looks elsewhere rather than stretching it.

Retention under the Money Laundering Regulations and similar regimes is not a matter of legitimate interest or consent. It is required, and the processing necessary to comply is held under the legal obligation basis. Pretending otherwise wastes a stronger basis on a question the firm did not actually have a choice on.

Each legal obligation basis is recorded with the specific regulation that creates it. The retention period, the format requirement and the production obligation all flow from a documented source rather than firm policy alone.

Some activities — internal quality review, anti-fraud checks, secure record-keeping beyond the regulatory minimum — sit naturally under legitimate interests. The basis is available but conditional: it requires a balancing test that demonstrates the interest does not override the client's rights and reasonable expectations.

The balancing test is documented at the activity level, not asserted generically. Where the activity could reasonably be expected to surprise the client, the conclusion of the test reflects that and either narrows the activity, adds safeguards, or moves the processing to a different basis.

Consent under UK GDPR is a high bar: it must be specific, informed, freely given and as easy to withdraw as it was to provide. It is the wrong basis for activities the client realistically cannot say no to without losing the service entirely, because such consent is not freely given and will not survive scrutiny.

Consent is used only for ancillary activities — marketing communications, non-essential cookies, optional enrichment — where refusal does not undermine the engagement. The consent record captures what was asked, how it was asked, and how withdrawal works in practice.