Confidentiality Questions to Ask Before Outsourcing Legal or Financial Work
Legal and financial work both run on information a client or business would not want mishandled — case files, personal data, financial records, correspondence covered by privilege or confidentiality. Outsourcing any part of that work means extending trust to people outside the organisation, which makes it worth asking specific, practical questions before instructing anyone, rather than relying on general assurances.
Access: who can see what, and why
The starting question is not "is the provider trustworthy" but "who specifically has access, and to what." A provider working across many clients should be able to describe how access is restricted to the individuals actually working on your files, rather than shared broadly across a wider team by default. Worth asking directly: is access granted per engagement or per person, is it reviewed and removed when someone stops working on your account, and is there a record of who accessed what and when.
It is also worth understanding where information physically and technically resides — whose systems it sits in, whether it is copied into the provider's own tools or accessed only within yours, and what happens to any copies once the engagement ends.
Confidentiality: more than a clause
Most engagement letters include a confidentiality clause as standard, and it is easy to treat that as the whole answer. It is a starting point rather than a complete one. A confidentiality clause describes an obligation; it does not by itself describe the practical controls that make the obligation something more than a promise.
Worth asking: how is confidential information handled day to day, not just in principle — are documents shared through controlled channels rather than general email, are staff trained specifically on what confidentiality requires of them in practice, and is there a named person accountable if something goes wrong. A provider who can answer these in specific, practical terms is generally further ahead than one who simply points back to the contract.
Data protection: know what you're responsible for
UK GDPR and related data protection obligations apply to how personal data is handled throughout an engagement, and responsibility for that does not disappear simply because a task has been outsourced. Firms and businesses should establish, before any personal data changes hands, what role each party plays in relation to that data, what contractual terms are needed to reflect it, and what the provider's own data protection practices actually look like.
Rather than asserting specific rules here — data protection obligations are detailed, and the right answer depends on the exact nature of the data and the engagement — the more useful habit is to treat this as a question to work through properly with whoever advises the firm on compliance, before signing anything, rather than an assumption to make afterwards.
Questions worth putting directly to any provider
- Who has access to our information, and how is that access controlled and reviewed?
- Where does our data live, and what happens to it when the engagement ends?
- What specific, practical steps protect confidentiality day to day, beyond the contract wording?
- What is our respective position under data protection law for this engagement, and has that been reflected in the contract?
- What happens, and who is told, if something goes wrong?
A provider confident in its own practices should welcome these questions rather than treat them as an inconvenience. The quality of the answer usually says more than the reassurance that comes before it.
This article is general information, not legal or financial advice. Speak to a qualified professional about your circumstances.
Our Why Us page sets out how we approach confidential handling and controlled access across every engagement.