Frequently Asked
Questions

MCW Lawyers is an integrated legal and cyber risk advisory firm. Unlike a traditional law firm that handles legal matters without deep technical cyber expertise, or a cyber consultancy that lacks qualified legal counsel, MCW Lawyers operates at the intersection of both disciplines. Every engagement is handled simultaneously by legal professionals and cyber risk specialists working as a unified team — ensuring that legal strategy and technical risk management are always aligned. This integrated approach eliminates the dangerous gaps that occur when two separate advisors must be coordinated during a fast-moving incident.

MCW Lawyers has been operating for over 15 years, since its founding in London. Over this period, we have handled more than 1,200 cases and built long-term advisory relationships with over 500 organisations across 40+ jurisdictions. The firm has grown continuously as the cyber-legal risk landscape has become increasingly complex, and we remain at the forefront of emerging regulatory and threat developments.

Yes. Our legal professionals are fully qualified solicitors and barristers authorised and regulated by the Solicitors Regulation Authority (SRA) in England and Wales. We are also registered with the Information Commissioner's Office (ICO) as required for handling personal data. Our cyber risk practice maintains industry certifications including CREST membership and ISO 27001:2022 certification.

We work with organisations of all sizes — from rapidly scaling technology start-ups to FTSE 100 corporations and multinational enterprises. Cyber legal risk does not discriminate by company size, and neither do we. Our engagement models are structured to be proportionate: smaller organisations typically engage us for project-based advisory or an on-call retainer, while larger enterprises benefit from embedded programme management.

When a cyber incident occurs — whether a ransomware attack, data breach, system intrusion, or insider threat — our incident response counsel provides immediate legal guidance. We direct forensic engagement to preserve legal privilege over findings, advise on notification timelines to regulators (ICO, FCA, etc.) and affected individuals, manage communications to minimise litigation exposure, liaise with law enforcement, and begin building the legal defence narrative from day one. Our average response time is under 15 minutes from first contact.

Yes. GDPR and UK GDPR apply to any organisation that processes the personal data of EU or UK residents — regardless of where that organisation is based. Many US, APAC, and Middle Eastern companies have GDPR obligations without realising it. We work with organisations globally to assess whether GDPR applies, and if so, to build compliant data processing frameworks, appoint appropriate representatives, and prepare for potential regulatory scrutiny. We also advise on CCPA, PDPA, APPI, and others.

Legal professional privilege (LPP) protects confidential communications between a client and their qualified legal advisor from disclosure — to regulators, courts, or opposing parties. When a cyber security assessment is conducted by a technical consultancy, the resulting report is typically discoverable in regulatory investigations. However, when the same assessment is conducted under the direction of qualified legal counsel, it attracts legal privilege and cannot be compelled for disclosure. This can be transformative in limiting regulatory liability following an incident. At MCW Lawyers, we structure all assessments and communications to maximise this protection.

Absolutely. Cyber insurance claims are notoriously complex and frequently disputed by underwriters. We provide independent, legally qualified support throughout the claims process — from initial notification to the underwriter through policy interpretation disputes to formal coverage litigation if required. We also assist organisations before a claim arises: reviewing existing policies to identify coverage gaps, advising on the adequacy of coverage relative to actual risk exposure, and working with brokers and underwriters during procurement to ensure policy wording aligns with your specific operational risk profile.

Our standard SLA for emergency engagements is a qualified legal advisor on the phone within 15 minutes of first contact, 24 hours a day, 7 days a week, 365 days a year. For retained clients, we maintain a standing brief on their organisation, industry, and risk profile — meaning when the call comes, we are already briefed and ready to act. Time is the most valuable resource in a cyber incident, and our processes are designed to eliminate every possible delay.

Most engagements begin with a confidential discovery call — typically 45–60 minutes — in which we listen to your situation, ask targeted questions about your industry, jurisdictions, and current risk exposure, and provide an initial assessment. From there, we propose a tailored engagement structure: a defined-scope project (e.g., a GDPR compliance audit), an ongoing advisory retainer, or an immediate incident response engagement. We operate transparent, fixed-fee arrangements for most project work, and clearly scoped retainer packages for ongoing relationships.

Confidentiality is foundational to everything we do. All communications with MCW Lawyers are protected by legal professional privilege and our professional conduct obligations as regulated legal practitioners. We operate secure, encrypted communication channels for all client interactions and documentation. Our internal information security programme is ISO 27001:2022 certified, and all staff are subject to strict confidentiality obligations. We do not reference client matters in any public material, and we will never disclose the existence of an engagement without your explicit written consent.

Yes — and this is one of the most critical times to engage qualified legal counsel. Many organisations experiencing an ongoing or recently discovered breach delay engaging legal advisors. In fact, early legal involvement limits exposure, shapes the response in a legally defensible way, and can mean the difference between a manageable incident and a full-scale regulatory enforcement action. We will work with whatever state your incident is in — whether it happened this morning or six months ago — and help you assess your current legal obligations, exposure, and best path forward.