A subject access request has landed
We check the deadline, scope the search and prepare a response that discloses what it should and withholds what it can.
Our data protection solicitors turn UK GDPR into practical steps for your business: privacy notices, data processing agreements, subject access requests and breach response, handled by a solicitor who knows how you operate.
Most UK GDPR problems don't start with a breach. They start with a contract, a customer email or a new tool. These are the ones we see most weeks at Lawyerly.
We check the deadline, scope the search and prepare a response that discloses what it should and withholds what it can.
We review or draft the Data Processing Agreement, check the transfer terms and make sure you are not taking on liability that belongs to the other side.
We help you contain it, decide within 72 hours whether the ICO needs to know, and handle the notification and the people affected.
data protection solutions
Data protection is not a one-off project. Every new hire, supplier, marketing campaign and software tool changes what personal data you hold and why. We build a compliance position that fits the size of your business, then keep it current as you grow.
When something does go wrong, whether that is a complaint, an access request or a breach, you already have a solicitor who knows your data and can act the same day.
We map what personal data you hold, where it flows and which lawful basis you rely on, then set out the gaps in a plain, prioritised list.
Privacy notices, cookie policies, data processing agreements, retention schedules and staff data policies, drafted for how your business actually works rather than downloaded from a template.
We handle subject access requests, erasure requests and complaints on your behalf, and manage ICO notifications and communications with affected individuals if a breach occurs.
With Lawyerly, it stops being a worry, and becomes an advantage.
We pair you with one of our qualified solicitors whose expertise and experience fits your business.
Work with your legal professional through our online Client Hub. Wherever you are, whenever you need us.
Pay a monthly subscription or a fixed fee for one-off work. The price is always agreed before we start.
Our commercial solicitors have worked at top-tier law firms and global legal departments, the kind of senior legal team most SMEs can't justify building in-house.
Legal Service Director
Legal Service Director
SRA No. 634623
Patricia is a corporate and commercial solicitor whose practice centres on mergers and acquisitions, early-stage investment rounds (particularly angel and pre-seed), and the commercial agreements that underpin high-growth businesses. Trained at DLA Piper and seasoned through a range of in-house counsel roles, she has advised FTSE100 corporations, public bodies, and high-profile individuals.
As Senior Solicitor and Legal Services Director at Lawyerly, Patricia leads service delivery for a client base weighted toward tech and AI. She guides founders and investors through funding rounds, structures strategic acquisitions, and negotiates the subscription agreements, technology licences, and partnership arrangements that scale-ups depend on. Her fluency in data privacy, IP, and regulatory matters means she can drive the full range of workstreams that tech deals demand, keeping transactions moving and valuations protected.
Qualifications
LLB (Hons); LPC MSc in Law, Business and Management
Commercial Solicitor
Commercial Solicitor
SRA No. 576972
James is a commercial and corporate solicitor whose practice centres on commercial contracts, technology and intellectual property, and disputes, sharpened by a keen commercial sense for how the law plays out in business reality. He has practised at Pinsent Masons, EY Law, and across a range of in-house roles, leading on SaaS and software licensing negotiations, M&A due diligence, and commercial litigation alongside international stakeholders on high-value, complex matters.
As Commercial Solicitor at Lawyerly, James brings that range to SMEs that need serious commercial advice without the complexity of a traditional firm relationship. He negotiates and manages contracts, advises on technology and IP, and helps clients pre-empt the disputes that derail growth. His particular fluency in contract management and technology law means he can tighten commercial frameworks and reduce legal risk as businesses scale.
Qualifications
LLB (Hons); LPC (Commendation)
Commercial Solicitor
Commercial Solicitor
SRA No. 839517
Ashrelle is a commercial solicitor who built her practice at Browne Jacobson LLP, a leading UK national law firm, advising private and public sector clients on contracts, IP, and procurement. Her experience extends into real estate, clinical negligence, employment, and government infrastructure, giving her a breadth few solicitors at her level can offer.
As Commercial Solicitor at Lawyerly, Ashrelle focuses on practical commercial advice for growing businesses, building the long-term client relationships that turn legal counsel into trusted partnership. She is as comfortable reviewing a software agreement as steering a complex procurement, and her employment expertise lets her advise on the people-side issues that sit alongside the commercial ones, keeping clients covered across the full picture of their business as it scales.
Qualifications
LLB (Hons); LPC LLM
Co-Founder & Director
Co-Founder & Director
Jackie has spent 20 years rethinking how legal services reach the people and businesses that need them. Before co-founding Lawyerly, she built and led one of Africa's largest alternative legal organisations, growing it to over 300 people and earning recognition across legal service, technology, innovation, and dispute resolution. She holds a PhD, awarded with the Top Achiever distinction, and has been named one of the top five women in legal tech.
As Co-Founder of Lawyerly, Jackie sets the strategic direction. Her work is guided by a single conviction: the law should work for people, not the other way around. Two decades of designing legal models that put commercial reality and client need ahead of legal tradition keep Lawyerly's service practical, human, and valuable for the businesses it works with.
Qualifications
LLB; MPhil (Cum Laude); PhD (Top Achiever Award); Key Regulatory Compliance Certifications
Co-Founder
Co-Founder
Willem began his career with a foundation in law before moving into business and communication. He led two advertising agencies through significant digital change and spent years as a digital publisher before moving into the international development sector, working on programmes across South East Asia and Sub-Saharan Africa.
At Lawyerly, he brings a marketer's instinct for clarity and a strategist's eye for how organisations grow. His training spans AI business strategy at MIT alongside formal studies in law and marketing, which means he thinks carefully about how legal services need to evolve to meet the real needs of modern businesses.
Qualifications
BA Law; AI Business Strategy (MIT); Nomadic Marketing (UCT)
Director
Director
Jan began his career in law before broadening into corporate strategy and technology. He holds a Master's in Corporate Law and an MBA, and later completed a Master's in Applied Data Science, driven by a conviction that the legal profession could do far more with the data it generates. That combination of legal, commercial, and analytical training has shaped a career spent rethinking how legal services are designed and delivered, with a particular focus on projects that use data and digital tools to improve legal processes.
As Director at Lawyerly, Jan brings data analytics, financial management, and strategy to the firm. His blend of legal grounding, commercial instinct, and technical fluency means Lawyerly's growth is guided by someone who understands the practice as deeply as the business behind it.
Qualifications
LLB; LLM; MBA; MSc
Answers to the questions we hear most often, on how the subscription works, what it covers and how we charge.
Everything a growing business needs to comply with UK GDPR and the Data Protection Act 2018 without hiring a specialist. That covers auditing what personal data you hold, drafting privacy notices, cookie policies and data processing agreements, advising on lawful bases and international transfers, handling subject access requests and complaints, and managing your response if a breach occurs. Subscribers also get ongoing advice as new tools, suppliers and marketing campaigns come along, which is where most compliance gaps open up.
Data protection support is included in our subscription plans, or you can instruct us on a fixed fee for a one-off piece of work, such as a privacy notice, a DPA review or a full data protection audit. The fee is always agreed before we start, so there is no hourly-rate surprise from us.
Yes. UK GDPR applies to any organisation that processes personal data, whatever its size, and most businesses also have to pay the ICO's data protection fee. Some record-keeping duties are lighter for businesses with fewer than 250 staff, but the core obligations, including a lawful basis for processing, transparency, security and responding to individuals' rights, apply to everyone. For most SMEs, compliance comes down to a handful of well-drafted documents and sensible habits, not a full-time department.
Only in specific cases: public authorities, organisations whose core activities involve large-scale, regular and systematic monitoring of individuals, or large-scale processing of special category or criminal offence data. Most SMEs fall outside those categories, but every business still needs someone accountable for data protection. Many of our clients use us as that point of contact, so they have a solicitor on hand when a question or a request comes in, without paying for a full-time hire.
Within one month of receiving it, which can be extended by up to two further months where requests are complex or numerous. Under the Data (Use and Access) Act 2025 you only need to carry out reasonable and proportionate searches, and the clock pauses while you verify the requester's identity or wait for clarification. We help you scope the search, apply the exemptions properly and get the response out on time, so a routine request does not turn into a complaint to the ICO.
Contain it first, then call us. Not every breach has to be reported, but where there is a risk to individuals the ICO must be notified within 72 hours of you becoming aware, and the people affected must be told without undue delay if that risk is high. We help you assess the risk, decide whether to notify, draft the notification and manage communications with customers and staff, so a bad day does not become a regulatory problem.
Learn how our services can benefit you by scheduling a call with one of our team members.
Willem van der Merwe
Co-Founder
Co-Founder
Willem began his career with a foundation in law before moving into business and communication. He led two advertising agencies through significant digital change and spent years as a digital publisher before moving into the international development sector, working on programmes across South East Asia and Sub-Saharan Africa.
At Lawyerly, he brings a marketer's instinct for clarity and a strategist's eye for how organisations grow. His training spans AI business strategy at MIT alongside formal studies in law and marketing, which means he thinks carefully about how legal services need to evolve to meet the real needs of modern businesses.
Qualifications
BA Law; AI Business Strategy (MIT); Nomadic Marketing (UCT)