GDPR • Professional secrecy
GDPR and the lawyer's professional secrecy: protecting client data
A law firm's client data is protected twice over: by GDPR and by the lawyer's professional secrecy. A leak is not just a fine, it is a breach of ethics. Below you'll see how to protect the confidentiality of client data, without the jargon.
The essential measures (short answer)
- Set the legal basis for processing: performance of the legal services contract.
- Encrypt matter data at rest and in transit.
- Grant access rights by role: each person sees only the matters they work on.
- Keep an access log: who opened which matter and when.
- Define a matter retention period and respond to data-subject requests.
GDPR vs. professional secrecy
- Professional secrecy covers everything the lawyer learns in connection with the client's case.
- GDPR adds technical and organisational duties: appropriate security measures (Art. 32) and incident notification (Art. 33).
- A data subject's right of access cannot override professional secrecy toward third parties.
- A well-configured system respects both at the same time.
Table: requirement and how to meet it
Confidentiality requirements for a law firm
| Requirement | How to meet it |
|---|---|
| Legal basis | Legal services contract or a legal obligation |
| Security | Encryption, access log, backup |
| Access | Role-based rights, only assigned matters |
| Incidents | Notification within 72 hours |
Common mistakes
- Keeping matters in an unencrypted file, accessible to the whole team.
- Having no access log, so you cannot prove who read a matter.
- Using hosting services outside the EU, without adequate safeguards.
How 4lawyers helps
- Matters, clients and documents live in one system, not in files copied across several computers.
- Access requires a user account and is limited to the firm's team.
- Organisational measures (policies, retention periods, answering requests) remain the firm's responsibility as controller.