Information Security Policy

Last updated: 25 July 2026

Bentley Legal Support Services (“Bentley”, “we”, “us” or “our”) recognises that our work may involve confidential legal, personal, financial and commercially sensitive information.

We are committed to protecting information entrusted to us and maintaining appropriate safeguards throughout the lifecycle of an assignment.

1. Purpose

This policy sets out the principles Bentley follows to protect client, case, business and personal information against unauthorised access, loss, misuse, alteration or disclosure.

2. Scope

This policy applies to information handled by Bentley in connection with:

• Client instructions
• Process serving assignments
• Tracing and address verification
• Occupancy and property checks
• Field support
• Client communications
• Reports, photographs and location information
• Billing and business administration

It applies to information stored or handled in paper, electronic, photographic, mobile or other formats.

3. Information We Protect

Depending on the assignment, Bentley may handle:

• Names and addresses
• Contact information
• Legal and court documents
• Case-related information
• Photographs
• GPS or location information
• Attendance notes and reports
• Company and director information
• Payment and billing information
• Other confidential client information

4. Access Control

Access to information should be limited to people who need it for legitimate business or assignment-related purposes.

Accounts, systems and devices should be protected using appropriate passwords, authentication controls and access restrictions.

Access should be reviewed when responsibilities change or when a person no longer requires access.

5. Passwords and Authentication

Where supported, Bentley should use strong passwords and multi-factor authentication for business systems containing confidential or personal information.

Passwords must not be unnecessarily shared or stored in insecure locations.

6. Devices

Devices used to access Bentley information should be protected against unauthorised access.

Where appropriate, devices should use screen locks, strong authentication, current security updates and suitable security software.

Lost or stolen devices must be reported as soon as reasonably possible.

7. Mobile Working

Because fieldwork may require information to be accessed away from the office, additional care must be taken when using laptops, phones or other mobile devices in public places.

Confidential documents should not be left unattended in vehicles, public spaces or unsecured locations.

8. Paper Documents

Physical legal documents, notes and records must be stored securely and protected from unnecessary access.

Paper records should not be left visible or unattended where unauthorised individuals could access them.

Confidential documents that are no longer required should be securely destroyed in accordance with Bentley’s retention and destruction procedures.

9. Digital Documents

Electronic documents should be stored only in approved or appropriately secured systems.

Where appropriate, sensitive documents should be encrypted during storage or transmission.

Documents should not be copied to personal accounts or unauthorised storage services without a legitimate business reason and appropriate safeguards.

10. Email and Communications

Care must be taken when sending documents or personal information by email.

Before sending sensitive information, the intended recipient and email address should be checked carefully.

Where appropriate, secure document-sharing methods should be used instead of ordinary email attachments.

11. Photographs

Photographs taken during an assignment must be relevant to the agreed purpose and handled as confidential information where they contain personal or case-related information.

Photographs should be transferred to approved storage and deleted from devices when no longer required for the legitimate purpose for which they were collected, subject to applicable retention requirements.

12. GPS and Location Information

Where location or GPS information is collected as part of an assignment, it must be used only for legitimate purposes connected with the relevant service or business requirement.

Such information must be stored and retained securely.

13. Remote and Cloud Services

Where Bentley uses cloud storage, email, hosting, document management or other online services, reasonable steps should be taken to ensure that those services provide appropriate security and access controls.

Third-party services should be assessed in accordance with their role, the information involved and the risks associated with the processing.

14. Software and Updates

Operating systems, applications, WordPress, plugins and other business software should be kept appropriately updated and supported where reasonably practical.

Known security vulnerabilities should be addressed in a timely manner.

15. Malware and Suspicious Activity

Staff and authorised users should exercise caution when opening unexpected attachments, links, downloads or messages.

Any suspected malware, phishing attempt, unauthorised access or unusual system activity should be reported promptly.

16. Client Confidentiality

Client information must not be disclosed to third parties unless disclosure is authorised, necessary to provide the agreed service, required by law or otherwise permitted by applicable requirements.

17. Information Sharing

Before sharing personal or confidential information, Bentley should consider:

• Who is receiving the information
• Why the information is being shared
• Whether the disclosure is necessary
• Whether the recipient is authorised
• Whether additional security measures are appropriate

18. Third-Party Providers

Where third parties process Bentley or client information, we will take reasonable steps to ensure that suitable contractual, security and confidentiality arrangements are in place where required.

19. Data Minimisation

Bentley should collect, access and retain only information that is reasonably necessary for the relevant assignment, business purpose or legal obligation.

Unnecessary copies of confidential or personal information should not be created or retained.

20. Information Retention

Information should be retained only for as long as reasonably necessary for the relevant purpose, taking account of legal, contractual, insurance, dispute-resolution and business requirements.

Detailed retention periods are set out in Bentley’s Data Retention and Destruction Policy.

21. Secure Disposal

When information is no longer required, it should be securely deleted, destroyed or otherwise disposed of in accordance with Bentley’s retention requirements.

Paper documents containing confidential information should be securely shredded or destroyed.

22. Personal Data Breaches

A personal data breach or other information-security incident may include:

• Lost or stolen documents
• Lost or stolen devices
• Information sent to the wrong recipient
• Unauthorised access
• Accidental disclosure
• Malware or ransomware
• Compromised accounts
• Unauthorised alteration or deletion of information

Any suspected incident should be reported to Bentley as soon as reasonably possible.

23. Incident Response

Where an information-security incident occurs, Bentley will take reasonable steps to:

• Contain the incident
• Protect affected information
• Establish what happened
• Assess the potential impact
• Take appropriate corrective action
• Determine whether notification is required
• Record the incident and actions taken

Where a personal data breach is subject to notification requirements, Bentley will follow applicable legal and regulatory requirements.

24. Access After an Assignment Ends

Access to client or assignment information should be removed or restricted when it is no longer required for the person’s role or the relevant assignment.

25. Confidentiality Obligations

Anyone authorised to access confidential or personal information on behalf of Bentley should understand their confidentiality responsibilities and comply with applicable policies and contractual obligations.

26. Training and Awareness

People handling client or personal information should receive appropriate guidance on confidentiality, information security, data protection and the secure handling of information relevant to their role.

27. Physical Security

Where Bentley maintains physical premises or stores documents, reasonable measures should be used to prevent unauthorised access.

Keys, access codes, documents and devices should be protected appropriately.

28. Business Continuity

Bentley will take reasonable steps to maintain access to essential business information and systems in the event of equipment failure, cyber incidents, loss of access or other disruption.

Where appropriate, important information should be backed up using secure and controlled methods.

29. Security Reviews

Bentley will review its information-security arrangements periodically and when significant changes occur to its services, technology, risks or legal requirements.

30. Responsibilities

Everyone with access to Bentley information is responsible for handling that information appropriately.

Management is responsible for maintaining suitable security arrangements, reviewing identified risks and taking reasonable action where weaknesses are identified.

31. No Unauthorised Use

Information obtained through Bentley’s services must not be used for personal, unrelated or unauthorised purposes.

32. Related Policies

This policy should be read together with Bentley’s:

Privacy Policy   |   Cookie Policy   |   Data Processing Addendum   |   Data Retention & Destruction Policy   |   Service Standards

33. Contact Us

Questions concerning information security should be directed to:

Bentley Legal Support Services
Email: enquiries@bentleylegal.co.uk
Telephone: +44-7890-197837
Website: www.bentleylegal.co.uk

34. Review of this Policy

This policy will be reviewed periodically and updated where necessary to reflect changes in technology, services, risks, business arrangements or applicable requirements.

This Information Security Policy is an operational framework and should be reviewed against Bentley Legal Support Services’ actual systems, devices, cloud providers, staff arrangements and security controls before formal adoption.