Privacy notice

Legal 500 Privacy notice

Last updated: 26 October 2026  

1. Introduction

This privacy notice (the “Privacy Notice”) explains how Legalease Limited (trading as “Legal 500”) processes your personal data in connection with: 

• • the use of our website at https://www.legal500.com/ and all other Legal 500 applications and websites (the “Site”); 

• • the provision of our services, including the subscription services that we make available via the Site and any other services that we make available whether through our Site or otherwise (the “Services”); 

• • our research and rankings activities, including the collection of references and feedback, the ranking of legal professionals and law firms, and the publication of our rankings and editorial commentary (our “Research and Rankings”); and 

• • other interactions that individuals have with our business, including those who (i) work for businesses that we provide Services to or for businesses that provide goods or services to us; (ii) attend events that we host; (iii) visit our premises; or (iv) apply to work for us. 

Please take a moment to read this Privacy Notice as it provides you with important information about your personal data, including the rights you have in relation to it. Your access to and use of our Site is also subject to our Terms of Use.

Any changes we make to this Privacy Notice will be posted on our Site, including to reflect any changes to our use of personal data or to comply with applicable law or regulatory requirements. Where possible we may notify you of these changes by email, but we encourage you to check this page regularly to keep up to date. 

2. About us  

The Site, our Services and our Research and Rankings are made available or carried out by Legalease Limited (“we”, “us” or “our”).  

We are a company registered in England and Wales (No: 02427356) and have our registered office at 188 Fleet Street, London, United Kingdom, EC4A 2AG. We are registered as a controller with the Information Commission’s Office (Registration No: ZA524165). 

We are the controller of personal data for the activities described in this Privacy Notice.  

Please contact us using our contact details in the How to contact us section. 

3. How to contact us 

If you want more information or have any questions about our processing of your personal data or this Privacy Notice you can contact us using the following methods: 

• • Email

• • Post. 188 Fleet Street, London, United Kingdom, EC4A 2AG 

4. Our Data Protection Officer 

We have appointed a Data Protection Officer (DPO). You can also contact our DPO directly using the following methods: 

• • Online 

• • Post. Data Protection Officer, Legal 500, 188 Fleet Street, London, United Kingdom, EC4A 2AG. 

5. How we collect and receive personal data 

We collect and receive personal data through the following methods: 

• • Personal data you provide to us. You may give us your personal data directly, for example, when you use or purchase our Services, respond to our research surveys or interview requests, provide feedback about legal professionals or law firms, contact us with enquiries, complete forms on our Site, subscribe to receive our marketing communications or provide feedback to us about our Site or Services. 

• • Personal data we collect automatically, including through cookies and other similar technologies. When you access and use our Site or interact with our emails, we may collect Technical Data and Usage Data automatically, including through our use of cookies and other similar technologies. For more information about this data, please see our Processing Activities Schedule. For more information about our use of cookies and other similar technologies, please see the Cookies section. 

• • Personal data we receive from third parties. We may receive personal data from third parties. Such third parties may include event suppliers and organisations we work with, analytics providers, data suppliers, third-party directories and, in connection with our Research and Rankings, law firms and legal professionals (for example, when they nominate you as a referee or include information about you in a submission) and referees (when they provide feedback about you). 

• • Personal data that is publicly available. We may collect personal data that is available from public sources (including law firm websites, legal directories, professional networking platforms such as LinkedIn, court records, and media publications) or that you or a third party may otherwise make publicly available (for example, through articles you have written, posts on social media platforms, or speeches at events). 

6. Personal data we control 

We may process or otherwise be a controller of the following personal data: 

• • Identity Data. Name (first, middle, and last); and title. 

• • Contact Data. Email address; telephone number; social media handle; and postal/delivery address. 

• • Registration Data. Username; password; security questions and answers; and any other personal data that you may provide to register an account with us. 

• • Professional Data. Job title; organisation that you represent; practice areas or areas of expertise; seniority; professional experience and qualifications; and any other professional information that you or a third party (such as your organisation or a nominating law firm) provides to us in connection with our Services or our Research and Rankings. 

• • Research Data. Information collected or generated in connection with our Research and Rankings, including feedback and commentary provided by referees about legal professionals and law firms; information about legal professionals contained in law firm submissions; nominations and recommendations; and our editorial assessments and rankings. 

• • Image Data. Photos or video recordings that feature you or your likeness, which we take or obtain when you visit our premises or when you attend events that we host, which we obtain from publicly available sources (such as law firm websites and professional directories), or which are provided to us by you or a third party (such as your organisation or a nominating law firm) in connection with our Services or our Research and Rankings (including for your profile in our rankings and guides). 

• • Transaction Data. Details of Services purchased from us or services that we may purchase from you or the organisation that you work for, including payment information (such as payment card details, bank account details and billing address). 

• • Profile Data. Date of birth; gender; personal pronouns; country of residence; nationality; information about your interests, affiliations and preferences, including any dietary requirements; other information that you supply in connection with your use of our Site or social media pages, or in your interactions with us (including in relation to your provision of feedback or responses to our customer or event surveys and records of attendance at an event); and the content of any communications when you contact us. 

• • Usage Data. Data observed or collected in relation to browsing activity on our Site or interaction with our emails. This may include information about pageviews and browsing sessions (including when sessions started and ended); information about the webpage or other source that users were previously on before reaching our Site; and information about content you have viewed or engaged with (such as readership, views and interactions with articles and other materials). Usage Data may also include data observed or collected in relation to other interactions we may have with you, such as attendance at our events, including information about sessions attended and networking interactions. 

• • Technical Data. IP address; details of part of the Site that you are viewing, such as full web page URL; browser type, device type and operating system and any other information available to us about the device you are using; location data, including the geographic location (which may be approximate, like the city or region you are in, or more precise) of a device derived from IP address, GPS signals or information about a device’s connection with local Wi-Fi equipment; diagnostic data (including crash logs, launch time, hang rate and energy use, and any other data collected for technical diagnostics purposes), and any relevant unique identifiers assigned to a device or browser (including cookie identifiers). 

• • Social Media Data. Information that is logged by third-party providers of social media platforms in relation to events that users take in relation to our social media pages or content. Events can include views, clicks, following or unfollowing, and any other types of interaction with our page or content, and the data that is recorded by the third-party providers of social media platforms may include information about the person taking the action and the device they are using, such as social media handles, the date and time of the event, the country/city (derived from IP address or social media profiles) of the user, age/gender information and the type of device used. Unless specified otherwise in this Privacy Notice, this personal data is not shared with us, but third-party social media providers may use it to provide us with anonymous and aggregate statistics about our social media pages and content, and we may be a joint controller of this personal data, as described in the Social media pages and insights and Social Media Partners sections. 

• • Incident Data. Information about any injury that you suffer or incident you may be involved in (including witness) at an event hosted by us or if you visit our premises, including any personal data you or others provide (including any factual description and opinions); details of any injury suffered; actions taken by us or others in response to the incident or injury, including details of any medical assistance or treatment that has been provided or advised (e.g. first aid applied, onsite paramedic or paramedic technician attended, advised to visit hospital, hospitalised); and any other personal data collected during the process of completing our incident report. 

• • Communications Data. Preferences, including any opt-out or suppression records, in relation to our marketing communications and, where applicable, communications relating to our Services and Research and Rankings. 

• • Recruitment Data. Profile Data (to the extent that it is relevant to our recruitment activities or you volunteer it during our recruitment process), together with other information including details of your eligibility to work (including documents and information that we may collect to verify this); your work preferences (including areas and dates where you are available for work); skills, qualifications, training and work history; any personal data which appears in your curriculum vitae or application; and any other personal data that you volunteer during our recruitment process. 

Please note, in connection with our Research and Rankings, we do not intentionally collect special category data (sometimes referred to as "sensitive personal data"), such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, or data concerning health, sex life or sexual orientation, or personal data relating to criminal convictions or offences. However, we may incidentally receive such data if it is included in Research Data. Where we receive such data, we will handle it in accordance with applicable data protection law and, where appropriate, delete it. 

7. Our processing activities 

We process your personal data for the following purposes: 

• • to provide you with our Site; 

• • to provide you with Services; 

• • to conduct our Research and Rankings; 

• • to deal with customer services and enquiries, carry out surveys and obtain feedback, and to manage public relations;  

• • to carry out insight, analytics, data improvement, and personalisation;  

• • to carry out marketing activities;  

• • for recruitment purposes; and 

• • for business administration and legal compliance purposes, including to exercise or defend legal claims. 

For more information about our processing activities, including the personal data that is processed in connection with those activities, please see our Processing Activities Schedule. 

8. Cookies 

We use cookies, web beacons, pixel tags and other similar technologies (“Cookies”) to operate and secure our Site, analyse its use, improve its functionality and personalise content and user experiences, as described in the Processing Activities Schedule. 

For further information about the Cookies we use, including their purposes, categories and durations, and how you can manage your consent to non-essential Cookies, please see our separate Cookies Policy and Cookie Preferences Centre. 

In some cases, the Cookies that we use may be provided by a third party. Information about you may be shared with the relevant third party and used in accordance with their privacy notice. 

In addition, where we use Cookies relating to services provided by Google, Google has published information about how it uses personal data in connection with its services here. Google also provides further information about: 

• • How it uses personal data in connection with Google Analytics here. If you do not want your personal data to be used for the purposes of Google Analytics, you can install the Google Analytics opt-out browser add-on (but please note that this will only work on certain browsers) which is available here. 

You can also manage your Cookie preferences using functionality provided by your browser, but please be aware that to use some parts of our Site you will need to allow essential Cookies. If you block essential Cookies, some parts of our Site may not work properly, or you may not be able to access our Site. 

For more general information about Cookies and managing Cookies, including blocking or deleting cookies for a wide variety of browsers, visit All About Cookies. 

9. Use of artificial intelligence 

We may use artificial intelligence (AI) technologies provided by third parties to process personal data in connection with our Site and our Services. We use AI to help us analyse and organise information, and to support content editing and quality assurance. All editorial and rankings decisions remain the responsibility of our editorial team, and any AI-assisted outputs are subject to human review and approval. We do not permit personal data to be used to train third-party AI models. We do not make decisions about individuals based solely on automated processing where those decisions produce legal or similarly significant effects. 

10. Sharing personal data 

We only share personal data with third parties or other entities within our group of companies when we are legally permitted to do so. When we share personal data with others, we put contractual arrangements and security mechanisms in place to protect the personal data and to maintain the confidentiality and security of it. 

The circumstances where we may share personal data are set out below:  

• • Content contributors. Where you access certain content on our Site, with your consent, we may share your personal data with the contributors (or the enterprise subscribers) whose content you access. This enables contributors to understand who is reading their content and to measure the reach of their publications. Once your personal data is shared with contributors, they or the organisation they represent become a controller of that data and will use it in accordance with their own privacy notice. We recommend that you review and familiarise yourself with the privacy notice of the relevant contributor or their organisation before providing your consent, to understand how they will use your data. 

• • Publication of our Research and Rankings. We publish our rankings, profiles and editorial commentary about legal professionals and law firms on our Site and in our other publications, which are available to the public. 

• • Third-party suppliers who provide applications/ functionality, data processing or IT services. We share personal data with third parties who support us in providing our Site and conducting our Research and Rankings, and help provide, run and manage our internal IT systems. Such third parties may include providers of information technology services, physical and cloud-based storage providers, cloud-based software-as-a-service providers, email delivery and campaign management services, identity management, website design, hosting and management, data analysis and insight, data back-up, and security services. These service providers may process personal data in countries around the world – see the International Transfers of Personal Data section for more information.  

• • Payment providers and banks. We share personal data with third parties who assist us with the processing of payments. 

• • Delivery and courier companies. We share personal data with suppliers who assist us in the delivery of documents, information and materials. 

• • Third-party marketing and customer relationship management specialists. We share personal data with specialist suppliers who assist us in managing our marketing database and activities, and sending out our marketing and account-related communications. 

• • Event partners and suppliers. When we run events, we will share personal data with third-party service providers that are assisting us with the operation and administration of that event. If we are running an event in partnership with other organisations, we will share personal data with such organisations for use in relation to the event. We may also share personal data with event sponsors, who may use it to contact you in relation to the event and to market their products and services to you. 

• • Recruitment agencies and related organisations. We share personal data with external recruiters and third-party providers that undertake background checks on our behalf. 

• • Auditors, lawyers, accountants and other professional advisers. We share personal data with professional services firms who advise and assist us in relation to the lawful and effective management of our organisation and in relation to any disputes we may become involved in. 

• • Law enforcement or other government and regulatory agencies and bodies. We share personal data with law enforcement or other government and regulatory agencies or other third parties as required by, and in accordance with, applicable law or regulation. 

• • Buyers and sellers. If we sell or buy any business or assets, or if we or substantially all of our assets are acquired by a third party, we may disclose personal data to the prospective seller or buyer, and personal data held by us may be one of the transferred assets. 

• • Other third parties. We may share personal data with other third parties where we are required or permitted to do so by applicable law or regulation, including in response to requests from third parties with authority to obtain disclosure of personal data (such as to check that we are complying with applicable law and regulation, to investigate an alleged crime, or to establish, exercise or defend legal rights). 

11. Your rights 

You have the following rights in relation to your personal data: 

• • Your right of access. If you ask us, we will confirm whether we are processing your personal data and, if so, provide you with a copy of that personal data (along with certain other details). If you require additional copies, we may charge a reasonable fee for producing those additional copies. 

• • Your right to rectification. If the personal data we hold about you is inaccurate or incomplete, you are entitled to have it rectified. If we have shared your personal data with others, we’ll let them know about the rectification where possible. If you ask us, where possible and lawful to do so, we will also tell you who we’ve shared your personal data with so that you can contact them. 

• • Your right to erasure. You can ask us to delete or remove your personal data in some circumstances, such as where we no longer need it or where you withdraw your consent (where applicable). If we have shared your personal data with others, we will let them know about the erasure where possible. If you ask us, where it is possible and lawful for us to do so, we will also tell you who we have shared your personal data with so that you can contact them directly. 

• • Your right to restrict processing. You can ask us to “block” or suppress the processing of your personal data in certain circumstances such as where you contest the accuracy of that personal data or you object to us processing it for a particular purpose. This may not mean that we will stop storing your personal data but, where we do keep it, we will tell you if we remove any restriction that we have placed on your personal data to stop us processing it further. If we’ve shared your personal data with others, we’ll let them know about the restriction where it is possible for us to do so. If you ask us, where it is possible and lawful for us to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly. 

• • Your right to data portability. You have the right, in certain circumstances, to obtain personal data you have provided to us (in a structured, commonly used and machine-readable format) and to reuse it elsewhere or to ask us to transfer it to your chosen third party. 

• • Your right to object. You can ask us to stop processing your personal data, and we will do so, if we are: (i) relying on our own or someone else’s legitimate interest to process your personal data, except if we can demonstrate compelling legal grounds for the processing; or (ii) processing your personal data for direct marketing purposes. 

• • Your rights in relation to automated decision-making. If we make a decision about you based solely on automated processing, including profiling, that has a legal or similarly significant effect on you, you have the right to obtain human involvement, express your point of view and contest the decision. For more information about how we use AI, please see the Use of artificial intelligence section. 

• • Your right to withdraw consent. If we rely on your consent (or explicit consent) as our legal basis for processing your personal data, you have the right to withdraw that consent at any time. You can exercise your right of withdrawal by contacting us using our contact details in the How to contact us section or by using any other opt-out mechanism we may provide, such as an unsubscribe link in an email. 

• • Your right to complain to us. If you believe that our processing of your personal data does not comply with applicable privacy laws or you otherwise have a concern about the way we have handled your personal data, you have the right to complain to us. If you wish to submit a complaint, please contact us using the contact details provided in the How to contact us section. Once we receive your complaint, we will acknowledge receipt within 30 days. We will then take appropriate steps to investigate the matters you have raised and will keep you informed of our progress. We will notify you of the outcome of your complaint without undue delay. 

• • Your right to complain to a supervisory authority. In addition to your right to complain to us, you have the right to complain to a supervisory authority if you believe our processing of your data does not comply with applicable data protection law. As we are incorporated in the United Kingdom, our main supervisory authority is the Information Commission’s Office (“ICO”). You can complain to the ICO by visiting https://ico.org.uk/make-a-complaint/. If you are located, or believe our infringement took place, in the European Economic Area, you can also complain to a national supervisory authority of the Member State in which you either reside or where the infringement took place. You can find a list of contact details for EEA supervisory authorities at https://www.edpb.europa.eu/about-edpb/board/members_en.  

12. Information security 

We are committed to keeping personal data secure and we have implemented information security policies, rules and technical and organisational measures to protect personal data under our control from unauthorised access, improper use or disclosure, unauthorised modification and unlawful destruction or accidental loss. In addition, our personnel and data processors (third parties that process personal data on our behalf) are obliged to respect the confidentiality of the personal data relating to personal data under our control. 

13. How long we keep your personal data 

We will only keep your personal data for as long as necessary for the purposes set out in this Privacy Notice.  

Generally, this means that we retain personal data for a period of six years from the end of the relevant relationship or activity, plus an additional one year to allow for any claims or enquiries that may arise following the expiry of the applicable limitation period. 

In connection with our Research and Rankings: 

• • Referee records, feedback and survey responses. We retain personal data for up to five years following your last substantive interaction with our research (or, for feedback and survey responses, after collection). 

• • Law firm submissions and historical rankings. We retain personal data for as long as reasonably necessary for research, verification and editorial purposes, and to maintain the accuracy, integrity and continuity of our historical research and editorial assessments. 

If you opt out of being contacted by us, we retain a minimal record (such as your email address and opt-out status) for as long as necessary to ensure you are not contacted again.  

We may retain anonymised information indefinitely where you cannot reasonably be identified. We will also retain personal data for longer where necessary to comply with our legal obligations, resolve disputes, or establish, exercise or defend legal claims. 

14. Third-party links and services  

This Privacy Notice only applies to personal data processed by us. Our Site may contain links to third-party websites, apps or services. We have no control over these third-party websites, apps or services and this Privacy Notice does not apply to your interaction with the relevant third parties. 

15. Personal data of minors  

Our Site, Services and Research and Rankings are not intended for use by, or targeted at, minors (individuals under the age of 18). However, this does not prevent minors from providing data to us. Where we do process personal data of minors, we will comply with all applicable laws and regulations relating to that processing.  

16. If you fail to provide your personal data  

Where we are required by law to collect personal data, or we need to collect personal data under the terms of a contract we have with you, and you fail to provide that personal data, we may not be able to fulfil any obligations that we owe to you, and we may not be able to enter into or perform a contract with you. This may apply where you do not provide personal data that we need to provide our Services, or to process an application to register an account. In these circumstances, we may have to cancel the provision of the relevant Services to you, in which case we will notify you. 

17. International transfers of personal data 

We may transfer personal data to third parties (as described in the Sharing personal data section) that are located in countries that do not have data protection laws that protect personal data to the same standard as the data protection laws that apply to us in the UK. These third countries may not give you the same rights as those described in the Your rights section and may not have a data protection supervisory authority to help you if you have any concerns.  

When transferring personal data to third countries, we usually rely on one of the following: 

• • Adequacy decisions: We may transfer your personal data to countries or organisations that have been deemed to provide an adequate level of protection for personal data by the European Commission, the UK Government, or any other relevant government body. This may include transfers to organisations that participate in the Data Privacy Framework listed here. 

• • Contractual safeguards: We may use specific contracts approved by the European Commission, the UK Government, or any other relevant governmental body to safeguard personal data. The contracts that we usually rely on are referred to as “Standard Contractual Clauses” or “SCCs”, although we may from time to time use other approved mechanisms. To find out more about the SCCs we use, please see here (UK) and here (EU). You can also contact us using the contact details set out in the How to contact us section.  

18. Social Media Partners 

This section provides information about third parties that may be a controller of your personal data in relation to certain activities described in this Privacy Notice, meaning that the third party may (alone or jointly with us) determine how and why they will use your personal data. 

• • Meta (Facebook and Instagram). Where we receive insights from Meta for the purposes described in the Social media pages and insights section, we are joint controllers with Meta in relation to Meta’s processing of their Social Media Data to provide those insights to us. When we refer to Meta, we mean Meta Platforms, Inc. if you are a UK resident, and Meta Platforms Ireland Limited if you are an EU resident. For more information, please see Meta’s Information about Page Insights Data here. For further information about how Meta uses your personal data in connection with these activities, including the legal basis Meta relies on and the ways to exercise your data subject rights in respect of Meta’s processing, please see Meta’s Privacy Policy at https://www.facebook.com/about/privacy. 

• • Google (YouTube). We receive YouTube insights from Google for the purposes described in the Social media pages and insights section. Google processes Social Media Data to provide those insights to us. For information about how Google uses your personal data to provide insights, including the legal basis Google relies on and the ways to exercise your data subject rights in respect of Google’s processing, please see Google’s Privacy Policy here. 

• • LinkedIn. Where we receive insights from LinkedIn for the purposes described in the Social media pages and insights section, we are joint controllers with LinkedIn in relation to LinkedIn’s processing of their Social Media Data to provide those insights to us. 

For further information about how LinkedIn uses your personal data in connection with these activities, including the legal basis LinkedIn relies on and the ways to exercise your data subject rights in respect of LinkedIn’s processing, please see LinkedIn’s Privacy Policy at https://www.linkedin.com/legal/privacy-policy.  

Processing Activities Schedule 

This Schedule sets out detailed information about the purposes for which we process the personal data described in the Personal data we control section and the lawful bases we rely on to do so. 

This Schedule is split into the following sections – please click on the link below to be taken to the relevant section: 
  

1. Website and online services 

2. Provision of Services  

3. Research and Rankings 

4. Customer relationships and communications 

5. Analytics, data improvement and personalisation 

6. Marketing 

7. Recruitment 

8. Business Administration, security and compliance 

1. Website and online services 

We use Cookies in connection with the operation, development and personalisation of our Site and the analysis of its use, as described in this section and Section 5 (Analytics, Data Improvement and Personalisation). Further information about these technologies, including when consent is required, is provided in the Cookies section and our separate Cookies Policy. 

2. Provision of services 

3. Research and rankings 

4. Customer relationships and communications 

 5. Analytics, data improvement and personalisation 

The activities described in this section may also support other purposes set out in this Schedule, including the provision and improvement of our Site and Services, customer relationship management, research, marketing and business development. 

 6. Marketing 

7. Recruitment 

8. Business administration, security and compliance