Guidance

Legal services advisory AI Growth Lab: privacy notice

Updated 27 August 2026

We are committed to protecting your personal data and are providing this privacy notice in line with our data protection obligations under the UK General Data Protection Regulation (GDPR) and Data Protection Act 2018. This notice sets out how we will use your personal data and your rights.

The Department for Business, Innovation, Science and Trade (BIST) has opened applications through an online portal to participate in the advisory AI Growth Lab in legal services. This is being supported by the Solicitors Regulation Authority (SRA), Information Commissioner’s Office (ICO), Legal Services Board (LSB), and Council for Licensed Conveyancers (CLC).

BIST, SRA, ICO, LSB, and CLC are joint data controllers for this application process. There is more information about the role of joint data controllers on the ICO website.

Flexigrant is acting as a data processor to collect application responses. The Flexigrant privacy notice explains how they collect, safeguard and process your data.

Your data

We will process the following personal data, which you may choose to provide:

• names
• contact details

The application form may also collect limited technical information necessary for the secure operation of the platform, such as IP address and browser information.

Applicants should avoid including personal data relating to customers, clients, employees or other third parties in free-text responses unless strictly necessary. Where such information is provided, BIST may remove or redact it where appropriate.

Purpose

We process personal data for the purposes of:

• administering applications to the advisory AI Growth Lab in legal services
• assessing eligibility and suitability for participation
• contacting applicants about their application and participation in the programme

Where appropriate, anonymised or aggregated information may be shared with government departments, regulators, or delivery partners involved in the design, operation or evaluation of the advisory AI Growth Lab.

Legal basis for processing

The legal basis for processing personal data is Article 6(1)(e) UK GDPR, which states that processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. This includes supporting the government’s work to promote innovation, responsible AI adoption and effective regulation.

Recipients

Your personal data may be accessed by:

• authorised officials within BIST and the Ministry of Justice (MoJ)
• authorised representatives of SRA, ICO, LSB, and CLC, as the regulators participating in the advisory AI Growth Lab, where necessary to assess, support or advise on your use case
• contracted service providers supporting the administration of the programme

Any publication of findings, case studies, lessons learned or reports arising from the advisory AI Growth Lab will normally use anonymised or aggregated information unless we seek your organisation’s permission to identify you.

Your data may be analysed and summarised using technology, such as artificial intelligence (AI), to help us to handle responses efficiently and accurately. We may also use your data to ensure that we improve how we process responses as we develop our products. This may include your personal data if you choose to disclose personal information in your response. For the purposes of this activity, BIST will be the data controller.

We will not:

• sell or rent your data to third parties
• share your data with third parties for marketing purposes

We will share your data if we are required to do so by law. For example, by court order, or to prevent fraud or other crime.

Retention

Personal data collected through the application process will be retained for up to 2 years following the closure of the advisory AI Growth Lab in legal services, or for longer where required by law or government record-keeping requirements.

International transfers

Your personal data will be processed in the UK and the European Economic Area (EEA). Where your personal data is processed in the EEA, the UK Adequacy Regulations safeguards will be in place. They provide protections equivalent to the UK for people’s rights and freedoms about their personal data.

Your rights

You have the right to:

• request information about how your personal data is processed, and to request a copy of that personal data
• request that any inaccuracies in your personal data are rectified without delay
• request that any incomplete personal data is completed, including by means of a supplementary statement
• request that your personal data are erased if there is no longer a justification for it to be processed
• in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted
• object to the processing of your personal data

To exercise your rights, contact the Data Protection Officer.

Contact details

You can contact the BIST Data Protection Officer at:

Data Protection Officer
Department for Business, Innovation, Science and Trade
Old Admiralty Building
Admiralty Place
London
SW1A 2DY

Email: data.protection@businessandtrade.gov.uk

You can contact the SRA Data Protection Officer at:

SRA Information Compliance
The Cube
199 Wharfside Street
Birmingham
B1 1RN
DX 720293 BIRMINGHAM 47

Email: SRAInformationCompliance@sra.org.uk

You can contact the ICO Data Protection Officer at:

Data Protection Officer
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline telephone number: 0303 123 1113

You can contact the LSB Data Protection Officer at:

LSB Data Protection Officer
Legal Services Board
2 Redman Place
London
E20 1JQ

Email: boardsecretary@legalservicesboard.org.uk

You can contact the CLC Data Protection Officer at:

The Data Protection Officer
CLC
WeWork
120 Moorgate
London
EC2M 6UR

Email: privacy@clc-uk.org

Complaints 

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an UK independent regulator. The Information Commissioner can be contacted at:

Information Commissioner’s Office 
Wycliffe House 
Water Lane 
Wilmslow 
Cheshire 
SK9 5AF

Telephone: 0303 123 1113

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Updates to this notice

If this privacy notice changes in any way, we will place an updated version on this page. Regularly reviewing this page ensures you are always aware of what information we collect, how we use it, and under what circumstances we will share it with other parties. The ‘last updated’ date at the bottom of this page will also change.

If these changes affect how your personal data is processed, we will take reasonable steps to let you know.

Last updated: 27 August 2026.