One of the key issues facing any firm that intends to roll out a CRM system to many users is that complete, undisciplined freedom to amend, modify or delete personal data could compromise the value and integrity of the data and also could be deemed to be inconsistent with many of the principles of the Data Protection Act. This article intends to prompt debate in this area by identifying a number of key practices that seem to be common within firms seeking to answer the question: Are law firms breaking the law in respect of data protection?

Who owns data protection in your firm?