Court of Appeal upholds data protection ruling in favour of law firm DWF, dismissing claimants' appeal in Yesim Kul and others v DWF Law LLP
The Court of Appeal has dismissed an appeal seeking to overturn a lower court ruling that cleared law firm DWF of data protection breaches, upholding the finding in favour of the defendant firm. The case, Yesim Kul and others v DWF Law LLP, was reported by Legal Futures as a bid to challenge the original ruling on data protection grounds that was rejected at appellate level. The claim arose from a witness statement DWF prepared in 2021, known as JS1, which analysed 372 road traffic claims, almost all of them brought by clients of North London firm Ersan & Co, and which was used to plead fundamental dishonesty in five low-value personal injury cases. Of the 137 claimants who originally brought data protection claims, all but three discontinued, and those three sought declarations and compliance orders under the Data Protection Act 2018 with no claim for compensation. Mrs Justice Eady dismissed the claim at first instance in July 2025, and on appeal Lord Justice Warby held that the appellants' argument on proportionality and pseudonymisation was a new case that had not been argued below.
Why this matters
A Court of Appeal ruling in favour of a defendant law firm in a data breach action is commercially significant for the legal profession: it reinforces that not every alleged data protection failing by a law firm will survive appellate scrutiny, and it may discourage speculative group claims against professional services firms where the evidence of actual breach is thin. The case also illustrates the growing willingness of claimants to pursue law firms directly for data protection breaches, a trend that has accelerated as firms hold increasing volumes of sensitive client and third-party data.
On the Ground
This ruling is directly relevant to data protection and professional liability practices. Law firms advising on client data governance will use the outcome to benchmark the evidential standard claimants must meet to establish a data protection breach against a professional services firm. Disputes and regulatory teams acting for law firms facing similar claims will review the judgment for procedural and substantive arguments that can be deployed in defence. A trainee would assist with disclosure review and categorisation of documents relevant to the data protection claim, prepare chronology summaries of the alleged breach timeline, and research the applicable data protection statutory framework to support skeleton argument drafting.
Interview prep
Question you might get
“What are the key legal issues a law firm faces when defending a data protection breach claim brought by individuals whose data it held?”
Sign up free to see the full answer
A model answer you can lift into an interview — how to frame this story for a partner.
Sign up freeSources
My notes
saved