Lawyers — GDPR: balancing compliance with professional secrecy

What does GDPR cover?

Both the GDPR and professional secrecy protect confidentiality. The GDPR adds further requirements: a register, information notices (in compliance with secrecy obligations), enhanced security, retention periods adapted to conservation obligations, and oversight of processors.

The sensitivity of case file data raises the level of security requirements.

Is the 'Lawyers' sector concerned?

All firms, regardless of size, are concerned as data controllers. Service providers (hosting, business software) are processors.

The appointment of a DPO depends on the size and nature of the organisation's activities, but formalised governance is recommended.

Detailed obligations

Sanctions & risks

GDPR fines of up to €20M or 4%, cumulative with disciplinary risk in the event of a confidentiality breach. A leak of case file data is a major incident.

Common mistakes in the sector

• 1Insufficient security. Under-protecting data in sensitive case files.
• 2Unmanaged service providers. Hosting without DPA or safeguards.
• 3Undefined retention periods. Retaining records without any limit.
• 4Missing register. Failing to document processing activities.

Practical case

A firm was exchanging case documents via unsecured messaging and hosting its data without a DPA. Achieving compliance involves encrypted communications, a governed hosting provider, a data retention policy, and a register.

Compliance roadmap

1. 1

   Map. Mapping processing activities.

2. 2

   Secure. Strengthen security and hosting.

3. 3

   Articulate. Balance information and secrecy.

4. 4

   Frame retention periods. Aligning with obligations.

5. 5

   Contractualise. Supervise service providers.

Frequently asked questions