How do I keep client data confidential under GDPR and professional secrecy?

Q&A • Confidentiality and GDPR

How do I keep client data confidential under GDPR and professional secrecy?

A lawyer is doubly responsible for client data: through professional secrecy and through GDPR. Confidentiality is ensured both technically (individual accounts, limited access) and organizationally. Below are the concrete steps.

Short answer

  1. Limit case access by role — each lawyer sees only their own matters.
  2. Keep track of who works on each case.
  3. Do not send confidential documents over public chat channels.
  4. Keep documents for the legally required periods and delete what is no longer needed.
  5. Sign data processing agreements (DPA) with vendors that touch client data.

What the law says (briefly)

  • The lawyer's professional secrecy is absolute and unlimited in time (Law no. 51/1995, art. 11).
  • Client data are personal data processed on a legal basis, under GDPR (Regulation 2016/679).
  • The lawyer, as controller, keeps a record of processing activities and applies adequate technical measures.
  • A breach of confidentiality triggers disciplinary, civil and sometimes criminal liability.

Concrete protection measures

  • Role-based access (lawyer, associate, secretariat), not full access for everyone.
  • Strong passwords and individual accounts, never shared logins.
  • Ask software vendors for written guarantees on where data is stored and how it is secured.
  • A data retention and deletion policy, for the periods required by law.

Practical example

Example: in a firm with 5 lawyers, each one sees only the cases they work on, and the secretariat sees only contact details and deadlines, not the confidential content. Documents stay in the case, not in personal inboxes.

Common mistakes

  • All users have full access to every case, with no roles and no log.
  • Sending confidential documents over unencrypted email or public chat apps.
  • Keeping data you no longer have a basis to hold, after the case is closed.

How 4lawyers helps

  • Individual accounts for every member of the firm, with no shared logins.
  • Cases, clients and documents in one place, not in emails and USB sticks.
  • Deadlines and logged hours stay tied to the case, with no copies in separate files.

See also