Protecting Client Confidentiality: Secure Document Sharing for Legal Practices

Every solicitor knows that client information is confidential. The difficulty is that confidentiality is rarely lost through a dramatic breach. It is lost through a wrong autocomplete on a Friday afternoon, an attachment sent to the wrong party, or a SharePoint link that was never switched off after completion. Good legal practice data security is mostly about making those everyday moments safe.

This guide explains the duty of confidentiality, how it differs from legal professional privilege, what UK GDPR expects of a practice holding client data, and how to compare the main ways of sharing documents. It then covers Microsoft 365 controls, retention, mis-sent email, subject access requests and supplier checks. For the wider picture, see our legal sector page, and for the cyber side, our guide to solicitors' cyber security and the SRA.

The duty of confidentiality and legal professional privilege

These ideas are often confused, and the difference shapes how you handle documents.

Duty of confidentiality

Paragraph 6.3 of the SRA Code of Conduct for Solicitors, RELs and RFLs requires you to keep the affairs of current and former clients confidential, except where the law requires or allows disclosure or the client consents. The duty continues after the retainer ends, which matters for archived files.

Legal professional privilege

Privilege is a legal protection that allows a client to withhold certain communications from disclosure. The Law Society describes two main types in its guidance on legal professional privilege:

• Legal advice privilege covers confidential communications between client and lawyer made mainly to seek or give legal advice, and documents that would reveal their content.
• Litigation privilege covers confidential communications between the client or lawyer and a third party, made mainly for existing, pending or reasonably contemplated adversarial litigation.

Privilege depends on confidentiality being maintained. The Law Society advises limiting email recipients and restricting access to privileged documents on shared systems. A practice that circulates advice widely, or leaves it open to anyone in a shared library, weakens the argument that it was kept confidential.

UK GDPR and the Data Protection Act for legal data

A legal practice is normally a data controller for client files, and it is also a data processor in some arrangements. Either way, the UK GDPR and the Data Protection Act 2018 apply to the personal data in those files, alongside your SRA duties. The Information Commissioner's Office (ICO) is the regulator for data protection.

Special category and criminal offence data

Many matters involve more sensitive information than ordinary contact details. The ICO lists the special categories as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data, sex life and sexual orientation. Family, employment, personal injury, clinical negligence, immigration and wills and probate work will regularly touch several of these.

The ICO treats data about criminal allegations, proceedings or convictions separately: it is not special category data, but it is covered by its own rules with similar safeguards. See the ICO's page on special category data for the full list.

What this means for systems

• Apply security appropriate to the risk, so sensitive matters get tighter access than routine ones.
• Record decisions about retention, access and suppliers so you can show your reasoning.

Our cyber security audit services often start with this mapping.

Secure document sharing options compared

Most practices use more than one method, often without a policy on which to use when. The table compares the four most common.

The aim is to write down which method applies to which type of information, so a trainee does not have to decide under pressure. Many practices use a portal or controlled SharePoint sharing for anything sensitive and keep ordinary email for routine updates.

If you already use Microsoft 365, the sharing controls in SharePoint and OneDrive are worth configuring properly before buying another tool. Our comparison of Teams and SharePoint explains where files actually live when staff collaborate, which is the first thing to understand.

Microsoft 365 sensitivity labels and data loss prevention

Microsoft Purview sensitivity labels classify content and apply protection that travels with it. According to Microsoft's documentation, labels can encrypt emails and documents, restrict what recipients can do (for example, view only), and add headers, footers or watermarks. Labels can also be applied to containers such as Teams, Microsoft 365 Groups and SharePoint sites, where they control privacy, external sharing and access from unmanaged devices.

For a legal practice, a short label set works better than a long one:

• General for non-client business information.
• Client confidential as the default for matter documents.
• Highly confidential for restricted matters, such as sensitive family, criminal or contentious employment files, with encryption and no external sharing.

Data loss prevention

Data loss prevention (DLP) policies detect sensitive content, such as client identifiers or bank details, and warn, block or log when someone tries to send or share it. Start in audit or warning mode so fee earners see the prompts and you learn what is normal before enforcing blocks. DLP that interrupts routine work gets bypassed, so tune it against real matter workflows.

Both features depend on your Microsoft 365 licensing and configuration, which varies by plan. Our Microsoft 365 support team can review what your current licences already include before you spend more.

Access control, ethical walls and information barriers

Paragraph 6.5 of the SRA Code says you must not act where a client's interest is adverse to that of another current or former client whose material confidential information you hold, unless effective measures mean there is no real risk of disclosure, or the other client gives informed consent in writing. Those measures are what practices call ethical walls or Chinese walls.

In practice, a wall needs to work at the system level as well as in policy documents:

• Matter-level permissions. Restrict the file, site or team to named individuals rather than the whole department.
• Remove inherited access. Check that partners, support staff and IT administrators are not reaching restricted files through group membership.
• Review leavers and movers. Access should change when someone changes team, not only when they leave.
• Keep evidence. Record who set up the wall, when, and who is behind it.

Microsoft Purview Information Barriers can block communication and collaboration between defined groups in Teams, SharePoint and OneDrive. Microsoft's documentation is clear on a limit that matters to law firms: information barriers do not restrict email, so Exchange mail flow rules are recommended for that. They also support only two-way restrictions. A wall built on information barriers alone is therefore incomplete.

Consider who holds administrator rights too. Our managed IT support service includes access reviews, and it is worth agreeing in advance how IT staff access to restricted matters is controlled and logged.

Retention, deletion and old client files

UK GDPR expects you not to keep personal data for longer than you need it. Legal practices also have good reasons to keep files for set periods: limitation, regulatory requirements, insurance and the possibility of a complaint. Reconciling the two needs a written retention schedule by matter type, agreed by the partners and applied in the systems, not just the filing room.

The schedule should cover more than the case management system. Copies tend to persist in:

• Mailboxes, including sent items and shared mailboxes
• Personal OneDrive folders and desktop downloads
• Teams chats and channel files
• Scanned archives and old file servers

Microsoft 365 retention labels and policies can help apply consistent rules to email and documents. Deletion should be recorded, and backups should have their own defined cycle so deleted data does not live on indefinitely. Where files are moved to the cloud, our cloud migration services include clearing out redundant data before it is migrated, which is cheaper than carrying it forward.

Mis-sent email and what to do when it happens

A wrong recipient, a wrong attachment or a reply-all that includes the other side is among the most likely confidentiality incidents in any practice.

Reducing the risk

• Switch on recipient warnings for external addresses and for domains that differ from the usual correspondent.
• Use a delay on outgoing email so a send can be recalled within seconds.
• Send sensitive documents through a portal or label-protected link, not as an attachment.

If it happens

1. Tell the person responsible for data protection straight away. Do not wait to see whether the recipient replies.
2. Ask the recipient in writing to delete the message and confirm they have not read, copied or forwarded it.
3. Record what was sent, to whom, and the people affected.
4. Assess the risk to individuals and decide whether the ICO must be told. The ICO's guidance on reporting a breach says that if a risk to people's rights and freedoms is likely, you must notify it as soon as possible and where feasible within 72 hours. Where the risk is high, you must also tell those affected without undue delay.
5. Consider whether your professional obligations to the client, and any SRA reporting duty, also apply.

Where you receive a document that was plainly sent to you in error, paragraph 6.4(d) of the SRA Code recognises that you need not disclose to your own client information in a privileged document you hold only because it was mistakenly disclosed. Take advice before relying on that.

Data subject access requests on client files

Clients, opposing parties, employees and other individuals can ask for a copy of the personal data you hold about them. Under the ICO's right of access guidance, you must respond without undue delay and at the latest within one month of receipt. You can extend by up to two further months if the request is complex or there are several requests from the same person, but you must tell them within the first month and explain why. Volume alone does not make a request complex.

The ICO guidance also allows you to ask for clarification where reasonably needed, which pauses the clock, and to carry out reasonable and proportionate searches where you hold a large amount of information. It was last updated on 8 December 2025, so check the current page for any further changes.

For a legal practice, the SAR itself is rarely the difficulty. The harder part is finding everything and then deciding what to withhold. Privileged material can be withheld, and information about other people may need redaction. That judgement belongs to a qualified person, but they can only exercise it if your systems let them search across email, case management and shared drives quickly.

Supplier due diligence for legal technology and IT providers

Anyone who processes client data on your behalf is part of your confidentiality chain: case management vendors, portal providers, e-signature tools, scanning bureaux, cloud backup providers and your IT supplier. Before you onboard or renew, ask:

• Where is data stored and processed, and are any sub-processors used?
• Does a written contract include UK GDPR data protection terms?
• What security certification do they hold, for example Cyber Essentials or ISO 27001?
• Who at the supplier can access client data, and is that access logged?
• What happens to your data on exit, and how is it returned or deleted?
• How and how quickly will they tell you about an incident?

Recent incidents show how a supplier weakness becomes your problem. Our analysis of supply chain risks from recent retail breaches shows why this belongs on the partners' agenda, not just IT's. If you want an independent view of your own controls, a Cyber Essentials assessment is a sensible baseline to ask suppliers about and to hold yourself to.

A practical plan for legal practice data security

Work through these steps in order, assigning each to a named person.

Conclusion: keeping client confidentiality practical

Strong legal practice data security does not require a large budget. It requires knowing where client data sits, choosing the right sharing method for each type of information, using the controls you probably already pay for in Microsoft 365, and keeping records that show you thought it through. That serves your SRA duties, your UK GDPR position and the privilege your clients rely on.

NetMonkeys is a Manchester-based Microsoft Solutions Partner and a specialist technology partner for legal practices. If you want a second pair of eyes on your sharing, access and retention set-up, see how we support solicitors or contact our team to talk it through.

Frequently asked questions