An associate deciding whether to answer an upward review honestly answers a different question first, which is who will see this. The quality of everything that follows depends on that answer. This is what SRA does with a response, what the firm receives, and where the protection ends.

Why the question is structural

When an associate assesses the partner who staffs their matters, approves their bonus and votes on their partnership, a diplomatic answer is the rational one if any route exists from the response back to them. Reassurance in an invitation email does not change that calculation. Neither do permissions inside a system the firm administers, because a reviewee can be assumed to have a route to data their own firm controls, whether or not they actually do.

What changes the calculation is where the responses sit. SRA collects, holds and processes them as an independent party, as processor under a data processing agreement in which the firm remains the controller. That is a contractual position rather than a policy statement.

What happens to a response

A response passes through four steps, each one part of the cycle rather than a setting that can be switched off to save time:

  • Responses go to SRA's systems, not the firm's. They do not enter the firm's estate in an identifying form at any point.
  • Results are compiled and reported in aggregate, so a finding describes a population rather than a person.
  • A reporting threshold is set for the firm before the cycle opens, against the size of each population being surveyed. Below it, a cut is reported in aggregate or withheld rather than estimated.
  • Every free-text response is reviewed for identifiability before it reaches a partner or the firm, because a comment can identify its author by role, matter or phrasing without naming anyone.

What the firm receives, and what it does not

The firm receives aggregate results at firm, practice group and individual reviewee level, participation rates by population, and any cut that clears the agreed threshold.

The firm does not receive which respondent gave which answer, whether a named individual participated, or any cut below the threshold. Those are not permissions that have been switched off. The firm has no system in which that data sits.

Where the protection ends

SRA does not identify a respondent to the firm. The single circumstance in which identity can be disclosed to anyone is where the law requires it, such as a court order or a lawful request from a public authority. Where the law permits notice, SRA gives it before disclosing, and discloses only what is legally required and nothing further.

The same position is set out in SRA's privacy notice and in the confidentiality pledge respondents read before they answer. Stating it is part of what makes the rest credible to the people being asked to participate.

Certification and internal handling

SRA is ISO 27001 certified. A SOC 2 Type I report is available to prospective clients under NDA. Processing is aligned to GDPR Article 28 and to the CCPA, with SRA as processor and the firm as controller.

Inside SRA, access is restricted to authorized personnel under confidentiality agreements, with role-based access control, audit logging on access and change, and anonymization logic tested as part of each cycle rather than at onboarding only.

What it changes for the firm

A review program adds a sensitive dataset to a firm's estate, at a point when that estate is already under pressure. Clio's 2024 Law Firm Data Security Report records 29% of firms reporting a security breach, and the American Bar Association found that 42% of firms with up to 100 lawyers had experienced one. Holding response data outside the firm removes that dataset from the firm's estate rather than hardening it.

The effect on the data itself is the reason firms buy the arrangement. When associates can see why identification is not available to the firm, written comments get longer and more specific, and scores stop clustering at the top of the scale.

References

  • Clio: How Law Firms Can Improve Data Security
  • American Bar Association: Keeping Your Firm Cyber Secure
  • Drata: Beginner's Guide to SOC 2 Compliance
  • Convergence Networks: Law Firm Data Compliance