Skip to content

Clio and General Data Protection Regulation (GDPR)

What is GDPR?

The General Data Protection Regulation (GDPR) is a unified data protection law that came into effect on May 25, 2018, in the EU, replacing the European Data Protection Directive 95/46/EC.

The law strengthens the protection of personal data belonging to EU individuals and gives them more control over the use of their personal data within the EU and internationally. GDPR aims to unify the regulatory environment for businesses handling the personal data of EU individuals.

Who does GDPR affect?

GDPR applies to all businesses that process personal data for EU residents. Businesses can be defined as either a data controller or a data processor: a data controller collects and oversees the management of personal data, and data processor processes personal data on behalf of a data controller.

GDPR also expands the definition of “personal data” to include categories of information such as location data, online identifiers (such as an IP address), and other electronic metadata that was not included in previous data protection laws within the EU. Businesses that do not protect the personal data of EU individuals in accordance with GDPR rules are susceptible to significant fines.

How does Clio address GDPR?

We believe that GDPR is an important means to ensuring the rights of individuals to control access to their personal information, and we are committed to supporting our customers in meeting their GDPR requirements. We have updated our product and business operations to comply with GDPR guidelines, meeting our requirements as both a data controller and data processor. These updates are reflected in our Terms of Service and Privacy Policy:

Clio’s EU Terms of Service explicitly acknowledge our role as a data processor for law firms. Clio will continue to fulfill that role while providing tools and customer service to help law firms meet their responsibilities as data controllers. As part of our update to our Terms of Service, customers subject to our North American Terms of Service affected by GDPR can rely upon the Data Protection Addendum listed in Exhibit B to help meet their compliance documentation requirements.

Clio’s Privacy Policy also identifies how personal data is collected and kept secure, and how data subjects may contact Clio regarding their information.

Clio’s industry-leading security measures protect data stored within and transmitted from the Clio product. Clio also provides advanced security features to ensure customers are properly equipped to protect any data stored within Clio.

For general information on GDPR, please visit the Information Commissioner’s Office website.

These articles also provide information on how GDPR may impact your law firm: