SRA’s diversity reporting requirements
The time has come again for all SRA-regulated firms to collate and submit their diversity data as part of the SRA reporting process. Firms will need to ask their staff to provide their diversity characteristics such as ethnicity, age, gender identity and educational background. This process is part of the SRA’s bi-annual collection of data from the firms it regulates. This data then feeds into an analysis and report by the SRA on diversity in the legal profession, and also the SRA’s law firm diversity tool (accessible here), which allows users to see the representation of various groups within partner, solicitor and other staff roles in law firms.
Firms will need to move quickly: the window for submitting the data to the SRA opens shortly on 9 June 2025 and will close four weeks later on 4 July 2025.
What do firms need to do?
SRA-regulated firms need to submit their data to the SRA and, in many cases, will also need to publish it on their website.
Given the time-consuming nature of the process and the many pitfalls which firms may encounter, it is important that all SRA-regulated firms take action as soon as possible.
Failure to provide the necessary data to the SRA before the deadline could lead to enforcement action and potentially sanctions such as a rebuke or a fine.
Collecting the data
There are a number of points to consider when collecting the data for your firm.
GDPR: The collection of diversity information will involve the processing of additional employee personal data, including “special category” (i.e. sensitive) personal data such as ethnicity and disability characteristics. As a result, there are a number of compliance issues that need to be addressed to ensure the data can be processed lawfully. We have summarised these below:
- Lawful basis – firms should decide on the lawful basis upon which they will carry out the processing. Legitimate interests or compliance with a legal obligation could be relevant. If relying on legitimate interests, a “legitimate interests assessment” should be carried out. Generally, there are issues with relying on consent in an employment context, and this should be avoided to the extent possible.
- Art. 9 GDPR condition – as special category data will be processed, an Article 9 condition needs to be in place. Depending on the condition relied upon, it may be necessary to put in place an “appropriate policy document” under the Data Protection Act 2018.
- Data Protection Impact Assessment (DPIA) – as the processing will likely involve collecting large amounts of special category data, firms should carry out a DPIA. This involves identifying the risks involved with the processing and the safeguards that can be put in place to mitigate those risks.
- Transparency – staff privacy notices should be updated to include details of the purposes of the processing and lawful basis upon which it is based, as well as the fact that data may be disclosed to the SRA, if this is not already in place.
- Security – firms should put in place controls to ensure that only members of staff who need to access it are granted access.
- Deletion protocol – firms should update their data deletion policy to account for this new collection of data.
- “Anonymisation” – firms should not assume that just because no directly identifiable information (such as names and email addresses) is included in responses, this makes them “anonymous”. Care should therefore be taken if publishing results to make sure these cannot be used to identify specific employees.
Identifying whose data should be collected: Firms should take care to ensure that they request all employees to complete the questionnaire, including those on maternity leave or on sickness absence leave, if they are in contact with the firm. Secondees should also be included, but not employees who are usually based outside England & Wales.
Categorising each person’s role: Each member of staff will need to be categorised as one or more of a large number of categories, such as solicitors, partners, legal executives, assistants, support staff, trainees and employed barristers. If you feel it would be unclear for those in certain roles, you may wish to clarify which category those job titles will fall into.
Using the data for global diversity surveys: It is increasingly common for global firms to aggregate diversity data across all offices. This will invariably require the transfer of personal data outside of the UK and potentially outside of Europe. It is crucial that the recipient of the data has arrangements in place to comply with the GDPR and the Data Protection Act.
The collection and compilation of the data can be outsourced, but firms should note that this also raises its own GDPR and regulatory issues.
Submitting the data to the SRA
The diversity information, once compiled, should be submitted to the SRA via the portal on its website.
Submitting the data to the SRA is a regulatory requirement under the Code of Conduct for Firms, and the SRA may take enforcement action if firms fail to do so by the 4 July deadline.
Publishing the data
SRA-regulated firms are expected to make their diversity data available to all employees and externally (subject to compliance with data protection legislation). The data may be published on the website, or placed on posters in break rooms, included in internal or external newsletters, bulletins, etc.
The SRA expects most firms to publish their diversity data on an anonymised basis, but many firms (or their UK offices of larger firms) will be too small to ensure that the data is truly anonymous. There is no need to make a formal application to the SRA to waive the publishing requirement if a decision is taken not to publish data for this reason, but it is important that the rationale for that decision is adequately recorded.
Next steps
Further information about the process can be found on the SRA’s website at: https://www.sra.org.uk/solicitors/resources/equality-diversity/your-data/. Fox Williams can also advise on the process.
Authors
Related legal expertise
Connect with us
