This policy is maintained by Adam Rose and Michele Morgan. Last reviewed in August 2026.
We respect your rights to data protection and privacy
This notice only applies to the processing of personal data directly provided by you or collected as a result of visiting this website. If we process your personal data in a different context or circumstances (for instance if you instruct us and become our client), a separate notice (available here) will apply.
Who are we?
We are Mishcon de Reya LLP, a limited liability partnership, incorporated in England (number OC399969), whose registered office is at Africa House, 70 Kingsway, London, WC2B 6AH. We are a body corporate which has members rather than partners. We are authorised and regulated by the Solicitors Regulation Authority under SRA number 624547. We also operate a Singapore branch office under licence from the Legal Services Regulatory Authority, licence number LSRA/FLP/ 2020/00001. We also operate an office in Dubai, United Arab Emirates: [Mishcon de Reya (Dubai) [Ltd/LLP], a [DWTC-registered entity, registration number (•), regulated by (•)] / [branch of Mishcon de Reya LLP licensed in (•)]] (our “UAE office”). Where our UAE office processes your personal data, the additional information in the UAE, DIFC and ADGM section of this notice applies.
We are committed to protecting the privacy of our users. Where we refer to "data protection law", we primarily mean the UK GDPR, the EU GDPR, the Data Protection Act 2018 and the Singapore Personal Data Protection Act 2012, as appropriate.
For the purposes of data protection law, when we process personal data, we ordinarily do so as a controller (we are registered as a fee-payer with the Information Commissioner under registration number ZA144945).
What personal data do we collect?
As a result of your visiting this website, we may collect or otherwise process your personal data in the following ways:
- When you provide your personal data on a contact form.
- When you contact us by other means, such as email, telephone or fax
- In the form of information provided by your web browser, through the use of cookies or similar software (for details about our use of such software, please see our Cookies page)
What is our basis for processing your personal data?
Any personal data that you give to us may be retained by us to provide a requested service, or for our legitimate interests as a business. You do not have to give us any of your personal data in order to use most of the website or associated online systems. However, if you wish to take advantage of some of the more special personalised services that we offer on our website, you will need to provide certain information.
In general, our legal basis for processing your personal data is that it is in our legitimate interests (and, indeed, in some cases, yours) to do so, although we would refrain from doing so if our legitimate interests were overridden by your interests or fundamental rights and freedoms. We have an interest in operating our business in the most customer-focused and professional way, and our processing of your personal data is done in accordance with this.
Who might access or receive your personal data?
Recipients of personal data provided as a result of your visiting this website will generally only consist of our employees. In certain circumstances we may be compelled to provide information we hold to third parties, such as regulatory or law enforcement bodies. We would only do so in compliance with the law, and where strictly necessary.
Marketing
We would like to keep you informed about Mishcon de Reya: our events, seminars and training, newsletters, briefings, legal updates and details of our services. We do this in two ways:
- Where you subscribe. If you sign up through our Subscribe page or otherwise ask to receive updates from us, we will send you the updates you have selected on the basis of your consent. You can change your preferences or unsubscribe at any time using the link in every email, through the Subscribe page, or by emailing crm@mishcon.com.
- Where we already know you. If you are an existing or former client, or a business contact who has dealt with us (for example, you have attended one of our events, exchanged details with us, or worked with us on a matter), we may send you updates and invitations we think are relevant to your work, relying on our legitimate interest in maintaining professional relationships and promoting our services. We will only do this where the law of your location permits it, we will always tell you who we are, and every message will include a simple, free way to opt out. If you are located in onshore United Arab Emirates (outside the DIFC and ADGM), we will only send you electronic marketing with your consent: see the UAE, DIFC and ADGM section of this notice.
You have the right to object to direct marketing at any time. If you do, we will stop. We keep a record of opt-outs (a suppression record) so that we do not contact you again in error: that limited record is kept on the basis of our legal obligations and legitimate interests.
General
Personal data provided or collected as a result of visiting our website may be shared within the Mishcon de Reya group, including with our UAE office where relevant to your relationship with us (for example, where you subscribe to updates relating to our Middle East practice or attend one of our events in the region). Where we transfer your personal data internationally, we will do so in line with our obligations under Chapter V of the UK GDPR or the EU GDPR (as appropriate), relying on an adequacy decision where available or, where not, on standard contractual clauses (with supplementary measures where appropriate) or an appropriate derogation. Transfers from our UAE office are addressed in the UAE, DIFC and ADGM section of this notice.
We do not make automated decisions, as referred to in Article 22 of the UK GDPR and Article 22 of the GDPR.
Your rights
If you wish to make a subject access request at any time, please email us on DSAR@mishcon.com and your request will be dealt with expeditiously.
You also have the right, in certain circumstances:
- to request from us rectification or erasure of personal data;
- to request from us restriction of processing concerning you;
- to object to our processing of the data;
- to data portability; and
- to complain to the Information Commissioner's Office (or, in some circumstances, a supervisory authority in an EU member state) about the manner in which we process your personal data.
If you have a complaint about the handling of your personal data, or feel that we have infringed your rights in relation to your personal data, please submit your complaint, and we will handle the complaint in accordance with our obligations under section 164A of the Data Protection Act 2018.
Additional information for the UAE, the DIFC and the ADGM
This section applies where our UAE office processes your personal data, or where you are located in the United Arab Emirates. Three data protection regimes operate in the UAE: the federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) (the “UAE PDPL”) applies in onshore UAE; the DIFC Data Protection Law (DIFC Law No. 5 of 2020, as amended) applies to entities in the Dubai International Financial Centre; and the ADGM Data Protection Regulations 2021 apply to entities in the Abu Dhabi Global Market. Which regime applies depends on where the relevant Mishcon entity and processing sit, and on your location.
Who is the controller? [Mishcon de Reya (Dubai) [Ltd/LLP]] is the controller of personal data processed in the context of our UAE office, [together with / alongside] Mishcon de Reya LLP where data is shared within our group. Our UAE office is [registered in the DIFC], and its processing is governed primarily by the DIFC Data Protection Law.
What is our basis for processing? As set out above, we process your personal data for marketing on the basis of your consent where you have subscribed, or on the basis of our legitimate interests where you are an existing client or business contact and the law of your location permits this. If you are located in onshore UAE, we will only send you electronic marketing with your consent, and you may withdraw that consent at any time, free of charge, as easily as you gave it.
Your rights. In addition to the rights described above, if the DIFC Data Protection Law, the ADGM Data Protection Regulations or the UAE PDPL applies to our processing of your personal data, you have rights of access, rectification, erasure, restriction, objection (including an unconditional right to object to direct marketing at any time) and data portability, and the right to withdraw consent, in each case as provided under the applicable law. To exercise any of these rights, contact DSAR@mishcon.com.
International transfers. Personal data processed by our UAE office may be transferred to Mishcon de Reya LLP in the United Kingdom and to our other offices and service providers. Transfers from the DIFC are made in accordance with Part 4 of the DIFC Data Protection Law, relying on the DIFC Commissioner’s adequacy recognition of the destination (including, at the date of this notice, the United Kingdom) or, where the destination is not recognised as adequate, on the standard contractual clauses issued under the DIFC Data Protection Regulations or another lawful transfer mechanism. Any transfers subject to the ADGM Data Protection Regulations or the UAE PDPL are made in accordance with the transfer provisions of those regimes.
Complaints. You may complain to the DIFC Commissioner of Data Protection (dp.difc.ae), the ADGM Office of Data Protection, or the UAE Data Office [/ the Federal Authority for Artificial Intelligence and Data], depending on which regime applies to the processing concerned, in addition to the complaint routes described above.
Contacting us about your information
If you have any questions or concerns regarding your personal data or how it is used, please contact us.
To help us keep your personal data up-to-date, you should let us know should any of your contact details change, or if you notice any inaccuracies in them. You can do this directly via email. From time to time we may contact you to confirm that the data we hold for you is correct.
Explanatory note: this Privacy Notice is in place to inform you, in line with our general obligations, and in particular in line with Article 13 of the UK GDPR, of the processing by us of your personal data. It isn't a contractual document, so we don't ask you to "agree" to it, or claim that by reading it you are taken to have agreed to it.
Please note that where we are offering goods or services to individuals in the European Union we will also be subject to the GDPR itself (not just the UK GDPR). In those cases you would also have the right to make a complaint, under Article 77, to another GDPR supervisory authority..
Where our UAE office processes your personal data, this notice is also intended to satisfy Article 29 of the DIFC Data Protection Law, section 13 of the ADGM Data Protection Regulations 2021 and Article 13 of the UAE Federal Personal Data Protection Law.