Corries Mazur Policy

CORRIES SOLICITORS LTD

MASTER COMPLIANCE MANUAL: DATA PROTECTION (UK GDPR), DELEGATION & SRA SUPERVISION POLICY
• Document Control: Version 1.0 (2026)
• Regulatory Compliance: SRA Standards & Regulations (Rules 3.5, 3.6, 7.7, 7.8); UK GDPR & Data Protection Act 2018; Legal Services Act 2007
• Case Law Precedent: Mazur & Stuart v Charles Russell Speechlys LLP & Ors [2023]
• SRA Registration Number: 424101
• Firm Office Address: Melroses Yard, Walmgate, York, YO1 9XF

1. PURPOSE AND GOVERNANCE STATEMENT
Corries Solicitors Ltd is committed to delivering high-quality legal services while maintaining the highest standards of data protection, client confidentiality, and regulatory compliance.
This document sets out the firm’s mandatory operational framework governing:
1. The handling and resolution of Data Protection (UK GDPR) complaints.
2. The rules on delegation and supervision under the SRA Code of Conduct and the High Court ruling in Mazur.
3. The internal evidentiary requirements needed to withstand legal challenges regarding the conduct of litigation.

2. ROLES, AUTHORITY & DELEGATION MATRIX (MAZUR COMPLIANT)
In accordance with the Mazur decision, non-authorised personnel (such as paralegals, trainees, legal assistants, and legal executives without independent practice rights) may perform litigation and data handling tasks only where an authorised solicitor exercises active direction, management, supervision, and control.
At Corries all non regulated staff are managed by a solicitor. All cases are handled by and worked with in compliance with the SRA guidance on cases following the Mazur decision.

The SRA has published guidance which our firm complies with. To see the full SRA guidance click here https://www.sra.org.uk/solicitors/guidance/effective-supervision-guidance/

┌─────────────────────────────────────────────────────────┐
│ AUTHORISED SOLICITOR / DPO / COLP
│ • Retains ultimate legal liability & case strategy
│ • Conducts reserved litigation acts & final sign-offs
│ • Approves external personal data releases
└────────────────────────────┬────────────────────────────┘
│
▼ (Documented Active Supervision)
┌─────────────────────────────────────────────────────────┐
│ UNAUTHORISED STAFF / JUNIOR FEE-EARNERS
│ • May draft pleadings and preliminary correspondence
│ • May collate evidence, disclosure bundles, and client data
│ • May perform administrative & case management tasks
└─────────────────────────────────────────────────────────┘
Allocation of Responsibilities:
Activity Category Specific Actions / Tasks Permitted Personnel Required Supervision Control
Reserved Litigation Acts Issuing proceedings, signing Statements of Truth/Pleadings, accepting formal settlement offers, court advocacy. Authorised Solicitors / CILEX (with Practice Rights) Direct Execution / Mandatory Approval: Must be performed or explicitly signed off by an Authorised Solicitor.
Delegated Litigation Work Some preliminary drafting of pleadings, collating witness statements, preparing court bundles, routine client communications. Unauthorised Fee-Earners / Paralegals / Trainees Pre-Action Audit: Authorised Solicitor will review, approve, and record sign-off in the Case Management System (CMS).
Data Protection Administration Responding to Subject Access Requests (SARs), processing deletion requests, managing data complaints. Data Protection Officer (DPO) / Nominated Compliance Staff Direct DPO Oversight: Third-party data releases and statutory responses must be authorized by the DPO.

3. EVIDENTIARY SAFEGUARDS: PREVENTING & WITHSTANDING COURT CHALLENGES
When opponents or courts challenge whether litigation was conducted unlawfully by an unqualified staff member under the Mazur principles, Corries Solicitors Ltd relies on five mandatory internal controls to provide concrete proof of valid solicitor supervision:
1. Contemporaneous Audit Trail: Every file on the Case Management System (CMS) will maintain a digital, time-stamped log showing who drafted a document and which authorised solicitor reviewed and approved it. This shall be recorded on the proclaim management system on each occasion.
2. Clear Client Transparency: Client engagement letters, status updates, and formal correspondence must clearly state the name of the Authorised Solicitor who holds ultimate responsibility for the case, alongside any junior fee-earner assisting on daily tasks.
3. Hard System Sign-Off Restrictions: CMS administrative measures prevent unauthorised fee-earners from issuing court documents, serving pleadings, or transmitting external data bundles without an authorised digital sign-off from a supervisor.
4. Proportional Ratios: Supervisors are capped on the number of delegated files they oversee to ensure genuine "direction, management, and control" is physically achievable and legally defensible. At Corries there is a modest number of staff and the non regulated staff are amply supervised.
5. Mandatory Red-Flag Escalation: Unauthorised staff must log an immediate escalation event to their supervisor whenever non-standard legal issues, complex data access requests, or unexpected procedural challenges arise.

4. INCIDENT CONTAINMENT & DUAL REGULATORY REPORTING
Where a data security failure or supervision breach occurs, Corries Solicitors Ltd enforces a strict dual-reporting framework:
Incident Type Internal Immediate Action External Regulatory Reporting
Personal Data Breach (e.g., misdirected medical records, unauthorized disclosure) Immediately contain the breach; notify the DPO (Howard Bonnett) within 2 hours. ICO Notification: Required within 72 hours under Art. 33 UK GDPR if the breach presents a risk to individuals' rights and freedoms.
Systemic Supervision Failure (e.g., paralegal acting without solicitor oversight) Apply an immediate file freeze; notify COLP and Directors. SRA Self-Report: Mandatory reporting under SRA Code of Conduct Rules 7.7 and 7.8 if a serious breach of regulatory standards occurs.

5. POLICY ACKNOWLEDGMENT AND TRAINING
All fee-earning staff, paralegals, trainees, and administrative personnel at Corries Solicitors Ltd are required to:
1. Undergo annual training on UK GDPR Compliance and SRA Delegation Rules (Mazur Standard).
2. Sign a formal written undertaking acknowledging the limits of their legal authority and committing to strict compliance with the supervision and escalation protocols established in this manual.