We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

Mishcon de Reya LLP review

Advisory firm

A UK law firm with a data and cyber team, a breach response unit and an outsourced DPO service, for organisations facing an incident or needing a DPO.

Relevant if you face a cyber incident, or want an outsourced DPO from a law firm

Price Published
Indemnity cover Not published
How it uses AI Not published
Facts last checked

Not published means we did not find it on the firm's own pages.

Mishcon de Reya scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 4/5
Qualifications of the people who do the work 3/5
What it publishes about fees 2/5
Knowledge of your sector 4/5
Independence from what it sells 4/5
Who carries the risk if the advice is wrong 2/5

What Mishcon de Reya offers, and what it publishes

Mishcon is a full-service law firm whose data protection, privacy and cyber team is led by James Boyle, named Head of Data on 11 September 2025. It has an in-house cyber unit, MDR Cyber, and the firm says it is 'the only CREST accredited law firm in the UK'. It also sells Mishcon DPO, an outsourced DPO service.

Mishcon de Reya publishes one price: Mishcon DPO starts at £500 a month plus VAT. It does not publish fees for its data protection or cyber legal work. It does not publish its professional indemnity cover, or how it uses AI itself. We found no case studies or measured client results for the practice.

Legal 500 ranks its London team Tier 3. The Law Gazette reported on 5 January 2022 that the solicitors' regulator, the SRA, fined the firm £232,500 over anti-money-laundering failings. The SRA register showed no disciplinary decisions on 19 September 2026. The Solicitors Disciplinary Tribunal fined it £25,000 plus costs on 29 October 2021, over client account payments it self-reported.

Strengths

  • Named, senior practice leadership: James Boyle appointed Head of Data (Sep 2025), also named Legal 500 practice head for the London data protection/privacy/cybersecurity team
  • In-house MDR Cyber unit; firm states it is the only CREST-accredited law firm in the UK, evidencing real incident-response infrastructure
  • Ranked (Tier 3) in Legal 500 for Data protection, privacy and cybersecurity, London, with four named lawyers
  • Runs a distinct outsourced-DPO product (Mishcon DPO) with a published starting price, not just bespoke legal advice

Things to check

  • The SRA reportedly fined the firm £232,500 (reduced from £387,500) for anti-money-laundering due-diligence failings on property transactions.
  • The firm's London data protection, privacy and cybersecurity practice is ranked Tier 3, not Tier 1, in Legal 500.
  • Separately from the AML fine already on record, the Solicitors Disciplinary Tribunal fined the firm £25,000 (plus £32,500 costs) in 2021 for allowing its client account to be used as a banking facility for football-transfer-related payments made in 2011-2013, a distinct, closed disciplinary matter that the firm self-reported.

Common questions

Is Mishcon de Reya regulated?

Yes. It is authorised and regulated by the Solicitors Regulation Authority, SRA number 624547.

Does Mishcon de Reya publish its fees?

Only for Mishcon DPO, which starts at £500 a month plus VAT. We found no published fees for its data protection or cyber legal advice.

What help does it offer after a cyber incident?

It has an in-house cyber unit, MDR Cyber. When it named James Boyle Head of Data on 11 September 2025, the firm said it is 'the only CREST accredited law firm in the UK'.

Has Mishcon de Reya been disciplined?

Yes. The Law Gazette reported on 5 January 2022 that the SRA fined it £232,500, reduced from £387,500, over anti-money-laundering failings. The Solicitors Disciplinary Tribunal fined it £25,000 plus £32,500 costs on 29 October 2021, in a matter it self-reported. The SRA's register showed no decisions on 19 September 2026.

Evidence for each Mishcon de Reya score

Show our working

Notes behind each thing to check

  • The SRA reportedly fined the firm £232,500 (reduced from £387,500) for anti-money-laundering due-diligence failings on property transactions. (Law Gazette report (5 Jan 2022) of the SRA's decision; NB the SRA's own live public register for this firm shows no disciplinary decisions as of the 19 Sep 2026 check, consistent with the SRA not retaining all historical decisions indefinitely)
  • The firm's London data protection, privacy and cybersecurity practice is ranked Tier 3, not Tier 1, in Legal 500. (Legal 500 UK rankings page for Mishcon de Reya LLP, Data protection, privacy and cybersecurity, London, checked 19 Sep 2026)
  • Separately from the AML fine already on record, the Solicitors Disciplinary Tribunal fined the firm £25,000 (plus £32,500 costs) in 2021 for allowing its client account to be used as a banking facility for football-transfer-related payments made in 2011-2013, a distinct, closed disciplinary matter that the firm self-reported. (Solicitors Disciplinary Tribunal ruling, 29 October 2021, as reported by Legal Futures: https://www.legalfutures.co.uk/latest-news/mishcon-puts-listing-on-ice-as-tribunal-explains-firms-25000-fine (cross-checked against Law Gazette, Legal Cheek and Fountain Court Chambers coverage of the same tribunal case))
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 4/5 Firm states MDR Cyber is the only CREST-accredited cyber unit inside a UK law firm (11 Sep 2025 announcement), evidencing published incident-response capability
Qualifications of the people who do the work 3/5 Legal 500 ranks the London team Tier 3, naming James Boyle as practice head plus three other ranked lawyers, not a top-tier ranking
What it publishes about fees 2/5 Only the bolt-on Mishcon DPO product publishes a price (from £500/month); no fee information found published for core data-protection or cyber advisory work
Knowledge of your sector 4/5 Named Head of Data (Sep 2025), Tier 3 Legal 500 ranking, an in-house MDR Cyber breach unit and a dedicated outsourced-DPO product line together evidence a real practice
Independence from what it sells 4/5 Published services are legal advisory plus its own Mishcon DPO consultancy product, not resale of third-party compliance software, per its service and product pages
Who carries the risk if the advice is wrong 2/5 A sourced Jan 2022 press report of an SRA decision states a £232,500 fine for AML due-diligence failings, a professional-discipline record bearing on accountability

Sources for Mishcon de Reya

  • Mishcon de Reya LLP is an active limited liability partnership on the UK companies register. (Company number OC399969, incorporated 18 May 2015, status Active, registered office Africa House, 70 Kingsway, London WC2B 6AH) (Companies House, checked 19 September 2026)
  • The firm is authorised and regulated by the Solicitors Regulation Authority. (SRA number 624547) (sra.org.uk, checked 19 September 2026)
  • A Jan 2022 legal trade press report of an SRA decision states the SRA fined the firm over anti-money-laundering due-diligence failings. (£232,500 fine (reduced from £387,500), decision reported 5 January 2022, covering conduct in property transactions between 2015 and 2018) (lawgazette.co.uk, checked 19 September 2026)
  • Mishcon de Reya appointed a named Head of Data and describes a specific cyber accreditation. (James Boyle named Head of Data (announced 11 September 2025); firm states it is 'the only CREST accredited law firm in the UK') (mishcon.com, checked 19 September 2026)
  • Legal 500 ranks the firm's London data protection, privacy and cybersecurity team. (Tier 3 ranking; practice head James Boyle, plus Adam Rose, Filippo Noseda and Robert Griffiths named) (legal500.com, checked 19 September 2026)
  • The firm publishes pricing for its outsourced Data Protection Officer product. (Mishcon DPO priced 'From £500 per month (plus VAT)'; page also displays Cyber Essentials and CIPPE accreditation marks) (mishcon.com, checked 19 September 2026)
  • The Solicitors Disciplinary Tribunal fined Mishcon de Reya LLP £25,000 (plus £32,500 costs) after finding the firm breached the SRA Accounts Rules' banking-facility rule and Principle 8 of the SRA Principles 2011. The firm had admitted allowing payments totalling around £5m connected to five football transfers (2011-2013) to pass through its client account; the firm self-reported the matter in 2017-18, the SRA referred it to the Tribunal in July 2021, and the Tribunal ruled on 29 October 2021 (a co-respondent former partner was cleared of related personal allegations). (£25,000 fine + £32,500 costs (SDT, 29 Oct 2021)) (legalfutures.co.uk, checked 20 September 2026)
  • Trustpilot: Mishcon de Reya has an unclaimed Trustpilot profile with only 2 reviews (3.0/5 average): one 5-star review (April 2024) praising a responsive, thorough team, and one 1-star review (May 2026) from a reviewer alleging a family member defrauded them and disputing the firm's handling of a related negligence claim. Sample size is far too small to be a reliable signal either way. G2/Capterra/Clutch were not checked as this is a law firm, not a software product. (Trustpilot, checked 20 September 2026)

SRA-authorised and regulated, reference 624547 (stated on sra.org.uk) States it is the only CREST-accredited law firm in the UK, via its in-house MDR Cyber unit (stated on mishcon.com) Displays Cyber Essentials and CIPPE accreditation marks on its Mishcon DPO product page (mishcon.com)

After a breach or ICO contactFirst DPO or AI policyAfter a ransomware or security incident

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.