SRA compliance for solicitors' client reviews

What to take away

SRA compliance is not a reason to avoid client reviews. It is a reason to agree and record the consent before a quote goes public.

What the SRA transparency rules require

Solicitors in England and Wales are regulated under the Solicitors Act 1974 and the SRA Standards and Regulations. Scotland and Northern Ireland each have their own regulator, so a firm with cross-border offices should check every regime it operates under.

The transparency rules, in force since 2018, require firms to publish prices for certain services, a complaints procedure that explains how a client can take a complaint to the Legal Ombudsman, and regulatory information such as the firm's SRA number. They say nothing about reviews.

That gap causes two opposite mistakes. Some firms assume reviews are banned outright. Others treat any warm quote as fair game. Neither reading survives contact with the confidentiality rules.

Where confidentiality bites

The confidentiality duty sits in paragraph 6.3 of the SRA Code of Conduct: you keep the affairs of current and former clients confidential unless disclosure is required or permitted by law or the client consents. A client can consent to disclosure, but consent must be informed and specific to what is published.

A quote about an employment tribunal win is not publishable simply because the name is missing. If the facts identify the client, and small professional markets make that likely, the duty still applies.

Other regulated sectors test the same ground. Healthcare reputation management under CQC rules shows how patient feedback is handled when a regulator examines the process as closely as the result.

A collecting workflow that keeps consent on file

Consent gathered after the event is weak. Build the request into file closure so the client is asked once, in a channel your compliance team can search later.

Two things decide whether the file stands up months later: the channel you ask through and what you write down. Ask through the same system you use for matter correspondence, so the request sits beside the file rather than in a marketing inbox, and record the client's name and matter number, the date and channel of the request, the exact wording approved, the platform named in the consent, and the date of any later withdrawal.

Where the review sits: platforms and software

The consent record is only half of the job, because the review itself usually lives on a platform the firm does not control. UK firms commonly collect client reviews through Google Business Profile, Trustpilot, Reviews.io or Feefo, and reputation-management software is often used to pull those reviews into one dashboard. Whichever route you take, the platform holds the review and the client's name, so the consent should name it and a withdrawal has to be actioned there as well as in your own records.

What you can publish, and what needs a rewrite

Use this as a first filter, before anything else. A thank-you quote that praises the service without touching the facts of the matter can usually be published as written, provided the client approved that wording. Anything that names or hints at the client's matter, repeats the detail of an outcome, or was written in exchange for a discount needs a compliance check before publication, not afterwards.

Outcome claims are the usual failure point. The SRA expects publicity to be accurate and not misleading, and a review that implies a guaranteed result misleads in the same way.

Paid or incentivised reviews sit under consumer law as well. The Digital Markets, Competition and Consumers Act 2024 brought fake and misleading reviews into the list of banned commercial practices, with the CMA as the enforcer.

Data protection duties when you hold review records

A review, the name beside it and the consent record are personal data. The ICO's UK GDPR guidance hub covers lawful bases, retention and the rights a client can exercise over that material.

Erasure and objection matter most here. If a client withdraws consent, the firm should pull the quote and be able to show when it did so.

Routing a disputed review through data protection sets out a worked sequence for that, from a frozen source record to deletion evidence.

This article is general guidance only. Anything involving a live dispute, or an SRA enquiry, needs a qualified solicitor.

Common questions

Do the SRA transparency rules require client reviews?

No. The rules are about published price information for certain services, a complaints procedure and regulatory details. Publishing reviews is optional.

Can we publish a review that names the client?

Only with consent that names the platform and the wording. Check whether the facts alone would identify the client in your market before you publish.

Can we offer a discount for leaving a review?

Consumer law bans fake and misleading reviews, and SRA publicity duties apply to any incentive you attach. Ask your compliance lead before running one.

How long should we keep review consent records?

There is no fixed period in the SRA rules or in UK GDPR. Keep the consent record while the quote is live and for a set period after removal that you can justify, and write that period into your retention schedule.