Client Confidentiality: Why Every Lawyer Should Stay on High Alert

Client confidentiality is a core tenet of the legal profession. Clients must trust that whatever they share with their solicitor stays between them. Otherwise, why would they share sensitive information? This makes perfect sense. Unfortunately, however, maintaining client confidentiality can be easier said than done.

Cyber attacks on law firms are increasing. Even the tightest-lipped solicitors are at risk of confidentiality breaches—unless they take the appropriate precautions. Such slip-ups can be incredibly damaging.

Not only do breaches erode trust between clients and their lawyers, but they can also negatively impact cases, ruin a firm’s reputation, and put solicitors in hot water. 

With cyber threats increasing and data breaches making headlines, safeguarding client confidentiality has never been more critical.

What information do lawyers need to keep confidential?

Lawyers have a duty of confidentiality, which applies to all confidential information they acquire about a client’s matters. This is known as lawyer professional privilege (LPP). 

As the Solicitors Regulation Authority (SRA) puts it, solicitors must:

Keep the affairs of current and former clients confidential unless disclosure is required or permitted by law or the client consents.

This duty continues even after the solicitor-client relationship ends. If a client passes away, confidentiality rights are transferred to their personal representatives. Law firms must have robust systems to ensure confidential information is always protected.

What doesn’t need to be confidential?

Confidentiality applies to all information regarding the retainer for which a firm is instructed. In other words, not all information.

Imagine walking out of court and your client steals a passerby’s handbag. In this event, providing information regarding the theft wouldn’t breach your duty of confidentiality, as it’s unrelated to the matter on which you were initially advising. 

What’s more, LPP doesn’t apply to communications made with the intention of the client committing a crime or fraud. In other words, if a client tells you they’re planning to commit a crime, you should feel no pressure to withhold this information from the authorities.

Client confidentiality in the information age

More information gets shared on social media and via apps each day. Every day:

• WhatsApp users send 100 billion messages 
• LinkedIn users send 2 million posts
• Instagram users post 95 million photos 

If you’re a lawyer, you need to take extra care when using social media. Your social media posts could inadvertently breach client confidentiality in many ways.

For instance, if you use Facebook to check in at a coffee shop during a client meeting, you could inadvertently disclose your client’s location as well. This may be an issue if your client wishes to remain anonymous or if they don’t want it to be known that they’re using legal representation.

Photos can also be problematic. You may be more mindful than lawyer and politician Kris Kobach, who accidentally revealed notes on proposed immigration policy in a photo with Donald Trump back in 2016. You should always be hyper-aware of what might be in the eye of a camera lens. Your daughter could take an impromptu photo while you’re catching up on some work at the dining room table; if there’s any sensitive information visible in the image, you need to make sure that photo doesn’t get posted online (and is deleted from her device).

It’s also worth noting that the need for confidentiality is reflected in law firm clients’ communication preferences. According to the Legal Trends Report, when it comes to key interaction points like viewing and sharing documents, in-person communication (71%) is again the most preferred option among consumers. In this case, there are also strong preferences for several other options. Email (63%) is a top choice, as well as secure client portals (60%).

Steps lawyers need to take to protect client confidentiality

Law firms do not need to abandon social media, but they must balance online engagement with their duty to protect client information. 

Here are practical steps every solicitor should take:

• Go private on Facebook and other platforms. Adjust privacy settings so only trusted contacts can view your personal information. For law firm marketing, use dedicated business pages and carefully review all shared content.
• Only use legal software that prioritises data security. Clio’s cloud-based practice management software is audited daily and uses advanced encryption to protect your firm’s data. Our hosting facilities meet top security certifications, and we continuously monitor for vulnerabilities, so your client information remains secure.
• Enable two-factor authentication on all accounts. This simple measure adds extra protection for your firm’s sensitive data.
• Be cautious with voice-activated devices and live microphones. Assume that conversations could be recorded without your knowledge and take steps to prevent accidental disclosures.

Preventing unauthorised access to client data is more than just shutting the door during meetings. Modern law firms must adopt digital tools and practices that keep confidential information safe.

However, don’t go overboard

LPP is vitally important—but it’s not an excuse to pursue strategic lawsuits against public participation (SLAPPs). In other words, to try and force others to keep your clients’ information confidential, too. 

The SRA regularly investigates such cases and has warned solicitors to:

Stop using terms in correspondence such as ‘private and confidential’ and ‘without prejudice’ unless there is a legal reason to do so.

They want to clamp down on solicitors throwing the term ‘confidential’ about in the hopes of quashing potentially embarrassing leaks.

Proceed with caution

Client confidentiality is a huge issue. Failure to protect your clients’ valuable information will land your firm in hot water, threaten a case’s outcome, and will erode any trust you’ve built. Indeed, solicitors must be more cautious than ever. A single photo uploaded to social media might spell disaster. Be careful about what you disclose, and if in doubt, check out the SRA guidance in full. 

How Clio helps law firms protect client confidentiality

Clio’s Practice Management Software is designed for solicitors who take confidentiality seriously. With bank-grade encryption, daily security audits, and compliance with SRA and GDPR standards, Clio gives law firms peace of mind. Features include:

• Secure document storage and sharing
• Encrypted client communications
• Automated access controls
• Two-factor authentication for all users
• Continuous monitoring for threats
• Clio Payments also ensures that client financial data is handled securely, with PCI-compliant payment processing and client accounting features that keep your firm compliant.

We published this blog post in May 2025. Last updated: May 28, 2025.

Posted in: Business