Most data-protection breach reports from professional firms describe the same event: a document containing someone's personal data was sent to the wrong person, or to the right person by a method that could not be controlled afterwards. The law — GDPR in Europe, its UK twin, and the growing family of state and national privacy laws elsewhere — does not name a specific technology. It requires appropriate security and the ability to demonstrate it. Here is what that means for sharing.
What "appropriate" looks like in practice
- Confidentiality in transit and at rest. The file is encrypted while it travels and while it sits on a server.
- Access limited to the intended person. Something more than "whoever has the link".
- The ability to withdraw access. If the wrong person got it, or the engagement ended, you can close the door.
- A record. Who was given access to what, when, and what they did with it.
- Minimisation. Share the document, not the whole folder; share the fields relevant to the client, not the internal notes.
Scoring the usual methods
Email attachment. Encrypted in transit, usually. Not withdrawable. No record of what happened after delivery. Wrong-recipient risk. Fails on 2, 3 and 4.
Public cloud link ("anyone with the link"). Withdrawable, but no identity check and no per-person record. Fails on 2 and 4.
Password-protected PDF. Better than nothing; the password travels by the same channel as the file more often than anyone admits. Not withdrawable.
Client portal with verified access. The recipient proves who they are (a one-time code to their email, or a password shared separately), sees only what was shared, downloads are logged, and access can be revoked at any time. Satisfies all five.
Verified access, not just a link
The step that turns a link into a compliant share is verification at the moment of opening. A one-time code sent to the recipient's email confirms that the person opening the share controls that mailbox — the same principle e-signature platforms rely on. It is a small friction, and it is the difference between "we sent it" and "we know who received it".
Reverse direction: collecting documents
Clients sending you their ID, bank details or medical letters by email is the same problem in reverse. A file-request link — one that lets the client upload directly into their matter — keeps the document out of both inboxes and encrypts it on arrival.
The habit
Working documents go through the portal. Finished documents go as attachments — once, deliberately, from the matter so the sending is recorded. We compare the two models in more depth in the portal model vs the attachment model, and cover the mechanics in sharing files with clients without compromising security.
