Confidentiality When Outsourcing Legal Work

A firm's duty of confidentiality does not thin out because work is outsourced. It travels with the file, which means the controls have to be verifiable before anything moves.

Agreement before access

A confidentiality agreement is executed before the first document is transferred — not alongside the first invoice. A provider willing to sign your firm's NDA rather than insisting on its own paper removes a week of negotiation. Where the engagement touches conflicts, run the conflict check before the file arrives.

Need-to-know staffing

Ask who will touch the matter and expect names, not a headcount. Access should be limited to the assigned team and revoked when the matter closes or the team changes, with the firm told when it does.

Matter segregation

Files kept per client and per matter, not pooled in a shared working area. Segregation is what makes a deletion request answerable.

The transfer channel is yours to choose

The firm nominates the channel — its own portal, a secure link, or the review platform. Email attachments should be the exception you authorise, not the default the provider assumes.

Retention and deletion

Ask for the retention period in writing and whether deletion on request is available. A provider who cannot say how long they keep material has not thought about it.

Publication and reuse

Client material should never appear in marketing, samples or case studies. Where a sample is needed, it should be redacted and unattributable, or synthetic.

Claims to be sceptical of

Treat certification claims as claims until you see the certificate. We describe the controls we actually operate and do not assert certifications we do not hold — the full position is on security and confidentiality, and the engagement sequence around it on how we work.