Client Confidentiality Checklist for Law Firms: Phones, Email, Cloud and the DPDP Act

A clerk at a three-advocate chamber in Thane leaves after six years. His phone holds two WhatsApp groups with clients, scanned vakalatnamas, photos of bank statements in a recovery matter and the evening cause list for every advocate. Nobody asks for the phone, because it is his. Nobody knows what is in the chats. This is a typical situation, not one firm’s story, and in our experience it is the most common way client data leaves a small Indian practice.

This guide answers one question: how does a law firm or independent advocate in India keep client information confidential across phones, email and cloud storage, in a way that also meets the DPDP Act? It starts with the duty itself, maps where data actually leaks, gives controls you can set up yourself this month, and ends with where a document vault or practice system makes the habits stick. It draws on what we see when we move chambers off WhatsApp, Gmail and pen drives into a case diary and document vault.

1. What is the confidentiality duty for advocates in India?

An advocate must not disclose what a client tells them in the course of the engagement, and must not let anyone in the office do so either. The duty comes from two places: the Bar Council of India’s rules on professional conduct, and the professional communications privilege in the evidence law, now section 132 of the Bharatiya Sakshya Adhiniyam 2023.

Under the heading “Duty to the Client”, Rule 17 of the BCI Rules on Standards of Professional Conduct and Etiquette says an advocate shall not, directly or indirectly, commit a breach of the obligations imposed by section 126 of the Indian Evidence Act, as reproduced by the Kerala Bar Council. Section 126 has since been carried into section 132 of the BSA. A government comparison of the old and new Acts shows the protection extending to interpreters and the clerks or employees of advocates, which matters for this article: your clerk’s phone is inside the duty.

The Supreme Court restated the privilege on 31 October 2025 in In re Summoning Advocates. According to the Supreme Court Observer summary, the Court held that police cannot summon an advocate merely to learn details of a client’s case unless an exception applies (such as communications in furtherance of an illegal purpose), that the privilege does not cover the mere production of documents, and that an advocate’s digital devices should be accessed only before the court and in the presence of the advocate and the client, partly to protect other clients’ information.

That last point is the practical one. If one phone holds every client’s chats, any examination of that phone exposes all of them. Separating matters, and separating work from personal life, is good security and good privilege hygiene at the same time.

2. Where client data actually leaks in Indian practices

In a typical Indian chamber, client data leaks through convenience, not crime: personal WhatsApp, phones shared between staff, a clerk’s home laptop, email forwarded to personal accounts, unencrypted pen drives and printouts left in court bags or sold as scrap. Each of these is fixable without new software.

When we map a chamber’s documents before building a document vault, we usually find the same matter in four or five places: a WhatsApp group, a junior’s Gmail, a folder on the office desktop, a pen drive for the typist and a paper file. The firm can rarely say which copy is current, and nobody can say who else has one.

Source: Infoways field experience setting up case diaries and document vaults for practices; illustrative, not a survey.

3. Controls for phones, laptops, email and cloud

The controls that prevent most leaks are basic: a strong screen lock and encryption on every device, two-step login on every account, firm-owned accounts for all work, no client files in personal chats, and remote wipe for lost phones. None needs a large budget; all need someone to check them.

Phones

• Screen lock with a six-digit PIN or longer, plus fingerprint or face unlock. Modern Android and iPhone devices encrypt storage once a lock is set; check it under security settings.
• Find-my-device switched on so a lost phone can be located, locked and wiped.
• A separate WhatsApp Business number for the firm, held on a firm phone or as a linked device, instead of each person’s personal number. Turn on two-step verification in WhatsApp settings.
• No client documents in the phone gallery. Save to the firm’s document store and delete local copies; switch off auto-download of media in work chats.
• Shared office phones get a lock too, and a written log of who holds the phone each day.

Laptops and desktops

• One login per person, never a shared “office” password. No family members on work machines.
• Disk encryption on: BitLocker or Device Encryption on Windows, FileVault on a Mac.
• Automatic updates and a working antivirus, including on the typist’s machine.
• Screens lock after five minutes, and in court or a client’s office, lock it yourself when you step away.
• USB ports used only with encrypted drives, and never for files from a print shop’s computer without a scan.

Email and cloud accounts

• Firm-owned work accounts on the firm’s own domain for every advocate, junior and clerk, so the firm can reset, suspend and recover them. Personal Gmail for client work is the single biggest gap we see.
• Two-step verification on every account, preferably with an authenticator app rather than SMS.
• Block or review auto-forwarding to outside addresses in the admin console.
• Check the recipient before sending; consider a short delay-send so mistaken emails can be recalled.
• Password-protect sensitive attachments and send the password by a different channel, or better, send a secure link (section 5).

Source: Infoways suggestion, aligned with the security safeguards listed in rule 6 of the DPDP Rules 2025 (MeitY gazette): encryption or masking, access control, logs and backups.

See also: If clients already send documents on WhatsApp, read how small businesses use WhatsApp Business with AI and UPI for what a firm number and linked devices can and cannot do.

4. Access by matter, and offboarding juniors and clerks

Give each person access only to the matters they work on, and remove all access on the day someone leaves. These two habits close the biggest gap in small practices, where everyone can see everything and accounts stay open for months after a junior moves on.

Access by matter is easy to describe and hard to do in WhatsApp and shared drives. In a folder system, it means one folder per matter (by client and CNR or matter number), shared only with the advocates, juniors and clerk on that matter. In a practice system, it means the matter record controls who sees its documents, and the system logs every download and share.

Conflicts make this more than tidiness. If a firm acts for different clients in related matters, or takes on a junior who previously worked for the other side, separation by matter is how you show that information did not cross.

Source: Infoways suggestion. The 90-day review assumes logs exist; the DPDP Rules 2025 expect logs to be kept, and the CERT-In Directions 2022 require 180 days of logs from entities they cover.

5. Backups and secure sharing links with expiry

Keep at least two copies of client files in separate places, one automatic and off the office premises, and test a restore every quarter. When you share files with clients or counsel, use links limited to named people that expire, not open links or email attachments.

Ransomware is listed among reportable incidents in the CERT-In Directions of April 2022, and for a chamber the impact is plain: drafts, scanned evidence and case diaries locked a day before a hearing. A backup that is connected to the same computer all the time can be encrypted along with it, so one copy should be offline or versioned in the cloud.

• Copy 1: the firm’s working store (server, NAS or business cloud), organised by matter.
• Copy 2: an automatic daily backup to a separate cloud account or an encrypted drive taken home weekly and kept offline.
• Restore test: every quarter, restore one complete matter onto another machine and open the latest draft.
• Sharing: links restricted to named email addresses, view-only where possible, with an expiry date (seven to thirty days is a sensible default); disable download for sensitive evidence.
• Receiving: give clients an upload link or a portal instead of asking them to email or WhatsApp documents.

6. What does the DPDP Act mean for law firms?

A law firm that decides why and how client personal data is used is a Data Fiduciary under the Digital Personal Data Protection Act 2023. When the Rules take full effect, expected around May 2027, the firm must give a plain notice, protect data with reasonable security safeguards including logs, report breaches to the Data Protection Board and affected people, and erase data when its purpose ends.

The Rules were notified on 14 November 2025 with an eighteen-month phased compliance period, according to the PIB explainer. The gazette text brings the notice, security, breach and retention rules into force eighteen months after publication, so around May 2027. That is enough time to fix habits, and not so much that a firm can ignore it.

Source: DPDP Rules 2025 (MeitY gazette) and PIB explainer, November 2025. Penalties per PIB: up to ₹250 crore for failing to keep reasonable security safeguards, up to ₹200 crore for not notifying a breach, up to ₹50 crore for other violations.

The legal-claims exemption, and why it does not excuse weak security

Section 17(1)(a) of the Act exempts processing that is necessary for enforcing any legal right or claim from most of Chapter II, Chapter III and section 16, but expressly keeps sub-sections (1) and (5) of section 8, as the Act’s text shows. Section 8(5) is the duty to take reasonable security safeguards. So even where litigation work is exempt from the consent and notice rules, the duty to protect the data stays.

How far “necessary for enforcing” stretches is untested, and a firm also processes data for advisory work, billing, staff records and enquiries that plainly fall outside it. Our view: do not plan around the exemption. Build the notice, security, breach and erasure routines for the whole practice, and let the advocates decide case by case where the exemption applies.

See also: The same DPDP duties apply to other professional practices; our guide on custom software vs off-the-shelf covers how to judge where a vendor stores your data before you sign.

7. Do law firms have to report cyber incidents to CERT-In?

Possibly. The CERT-In Directions of 28 April 2022 require service providers, intermediaries, data centres, body corporate and government organisations to report listed cyber incidents within six hours of noticing them. Whether a small law firm falls within “body corporate” for these Directions is not settled, so the safe course is to be able to report quickly if needed.

The Directions list incidents in Annexure I, including unauthorised access of IT systems or data, ransomware and other malicious code, data breach, data leak and unauthorised access to social media accounts. Reports go to incident@cert-in.org.in or the CERT-In helpline. The same Directions ask covered entities to keep logs of their ICT systems for a rolling 180 days within India and to synchronise system clocks with NTP servers of NIC or NPL, or servers traceable to them.

The scope question for advocates is real. The Directions do not define “body corporate”, while the IT Act’s own definition in the Explanation to section 43A includes a firm, sole proprietorship or association of individuals engaged in commercial or professional activities. We could not find official guidance on whether a solo advocate or a small partnership must report, so treat this as a question for the partners, not something we can settle.

In practice, the two regimes point the same way. A breach serious enough to concern CERT-In will almost always need a DPDP notice to the Board and clients once the Rules are in force. One incident plan that covers both, with the six-hour and 72-hour clocks written at the top, is enough for most chambers.

8. A 30-day implementation plan for a small chamber

A chamber of up to ten people can put the essentials in place in thirty days with no new software: list where data lives, lock devices and accounts, move work into firm accounts, organise by matter, then set up backups, offboarding and the incident plan. Most of the time goes into moving files, not into technology.

Source: Infoways suggestion, based on the controls and rules above. Larger firms should expect each stage to take longer.

9. What software helps, and what to check before you buy

Software helps where habits fail: a document vault that stores files by matter with access rules, a client portal that replaces WhatsApp forwards, logs that show who downloaded what, and accounts the firm can switch off in one click. It does not replace the device locks, two-step login and offboarding above.

For a solo advocate or a two-person chamber, firm accounts with folders per matter and expiring links are often enough. A ready-made case diary app suits most independent advocates and small chambers. A custom system earns its cost when several advocates, corporate clients or strict privilege needs make access by matter, full logs and a client portal essential.

Before you adopt any tool, including one we build, ask five questions. Where exactly is the data stored, and in which country? Who at the vendor can see client files? Can every matter and document be exported in a usable format if you leave? Does it log downloads and shares, and for how long? Will the vendor sign a written agreement covering security and breach notice, as rule 6 of the DPDP Rules expects for processors?

Our law firm software page describes the case diary, document vault with versions, client portal and access by matter that we build for chambers. We also keep firm websites to the particulars the Bar Council rules permit; nothing in this guide is about marketing a practice, which advocates may not do.

See also: For automating the routine parts of office work safely, such as reminders and document requests, see AI and automation for small businesses.

Where this advice breaks down

This checklist assumes a small or mid-sized practice with its own devices and accounts. Advocates who work mostly from a senior’s chamber, or juniors who use the senior’s systems, should follow that chamber’s rules first; adding a parallel system creates a second place for data to leak.

The legal points above come from rule text as reproduced by a Bar Council, a summary of the Supreme Court’s October 2025 judgment, the DPDP Act and Rules, and the CERT-In Directions, as of October 2026. Several were read in secondary sources, the DPDP Rules are not yet fully in force, and the scope of both the legal-claims exemption and “body corporate” for CERT-In is unsettled. Treat this as a planning checklist for office systems, not legal advice.

And no tool fixes a culture of forwarding. We have seen firms install a document vault and keep sharing drafts on WhatsApp because the senior partner did. Controls work only when the people at the top use them first.

Your data security checklist

The Thane clerk’s phone was never the real problem. The problem was that the firm’s client files lived on it, and that is something any chamber can change within a month.