In short: secure file sharing for law firms means that confidential client documents never travel as an open attachment or a forwardable link. The recipient is verified, access expires and can be revoked, and every share and download is logged. Professional rules increasingly put the choice of tools on the lawyer personally, and clients covered by NIS2 or DORA expect their law firm to prove how their documents are handled.
Updated on 6 November 2026
A medical record in a personal injury case. A data room during an acquisition. A settlement agreement for a departing executive. These documents are all covered by legal professional confidentiality, and they almost always leave the firm digitally. Yet many firms still send them by regular email, a consumer transfer service or a password-protected ZIP file. In this article, you will read what professional rules expect, why the bar is rising, and how to share client files securely in practice.
Why secure file sharing matters for law firms
Confidentiality is a core duty of the legal profession across Europe. In England and Wales, paragraph 6.3 of the SRA Code of Conduct requires solicitors to keep the affairs of current and former clients confidential (see the SRA guidance on confidentiality). In the Netherlands, confidentiality is one of the core values in the Advocatenwet, and Rule of Conduct 3 sets out how lawyers must apply it. Belgium and other EU countries have comparable rules on professional secrecy.
These duties do not stop at the send button. If a document reaches the wrong person, or a link is forwarded, the firm has to explain how that could happen.
Professional rules now cover your choice of tools
The Netherlands Bar Association (NOvA) is explicit. Since 1 January 2025, the explanatory notes to Rule of Conduct 3 state that lawyers are personally responsible for their choice of communication tools, the providers of those tools, data processing and data storage. In its guidance on digital resilience, the NOvA describes the risk of a lawyer falling victim to data theft as above average.
In other words: “our IT partner takes care of that” is no longer a sufficient answer. Regulators and courts look at the measures the firm itself has taken.
Three developments that raise the bar
1. Your clients face stricter supply chain requirements
Under NIS2, essential and important entities in sectors such as energy, healthcare, transport and digital infrastructure must manage cyber risks in their supply chain. In the Netherlands, NIS2 has applied through the Cybersecurity Act (Cyberbeveiligingswet) since 15 August 2026. Financial institutions face similar requirements under DORA.
A law firm is usually not covered by these rules itself, but it receives sensitive information from clients that are. That makes the firm part of their chain. Expect more security questionnaires, and questions such as: how do you share our documents, and can you show who accessed them? Read more on our NIS2 page.
2. Human error remains the biggest source of leaks
Not every breach is a sophisticated attack. In the first half of 2024, nearly one in five data breach notifications in the Netherlands involved email containing personal data, often simply sent to the wrong recipient, according to figures from Statistics Netherlands (CBS). In 88 percent of those notifications, no encryption or access restriction had been applied.
One wrongly autocompleted address can lead to a disciplinary complaint, a notification to the data protection authority and lost client trust. Mailboxes of Dutch law firms have also been misused for fraudulent payment requests. Read why emailing sensitive documents is so risky.
3. Clients expect a secure alternative to email
In a survey of 750 clients of Dutch law firms, 69 percent said a secure document portal was very important. More than half worried about a data breach at their firm, and 39 percent would consider switching after a breach, reports Advocatie. 81 percent feared that confidential information is not adequately protected when firms use generative AI. The NOvA recommends never entering client data into public AI models.
Sharing client files securely: three situations from practice
Medical records in a personal injury case
Health data is a special category of personal data under the GDPR. Share it only with the medical adviser or expert who needs it, verify the recipient and set an expiry date that matches the assignment.
A data room during an acquisition
Due diligence means large volumes of contracts and financial documents going to several parties. Give each party access only to what it needs, record who downloaded what and revoke access as soon as the deal closes or falls through. For large datasets, read how to send large files securely.
Litigation documents for experts and opposing counsel
Experts and opposing parties rarely have an account with your firm. A shared link without verification can be forwarded. With recipient verification by SMS or an authenticator app, you know the document reaches the right person. Read more about 2FA for secure file sharing.
Five questions to assess how your firm shares files
Secure sharing does not have to mean extra work. Use these five questions to assess your current practice:
- Do you know where your shared files are stored? In which country, with which provider and with which certification?
- Do you verify who opens a file? A link anyone can forward is not a confidential channel.
- Can you revoke access? For example when an assignment ends or a file was sent to the wrong person.
- Can you show afterwards what was shared? For a client audit, a complaint or a GDPR request.
- Does it fit the way your lawyers work? A solution outside Outlook will be bypassed.
Three times “no” or “I don’t know”? Then it is time to have that conversation within your firm.
What this means in practice
| What a law firm needs | How Msafe provides it |
|---|---|
| Knowing where data is stored | Developed and hosted in the Netherlands, ISO/IEC 27001:2022 certified |
| The right recipient | Recipients verify their identity with their phone number, so a document does not end up with the wrong person |
| Documents not available indefinitely | An expiry date per share and revocable access, for example when an assignment ends |
| Evidence afterwards | An exportable audit trail of uploads, downloads, shares and deletions |
| Large files without a USB stick | Files up to 1 TB as standard (larger on request), such as due diligence datasets and imaging |
| Working the way lawyers work | Share from Outlook and sign in with Microsoft Entra ID (Enterprise and Unlimited) |
How Msafe helps
Msafe Secure File Transfer is developed and hosted in the Netherlands and ISO/IEC 27001:2022 certified. Lawyers share files encrypted, recipients verify their identity with their phone number, and you decide how long a file stays available. Every upload, download and share is recorded in an exportable audit trail.
Msafe does not replace your email. It gives sensitive documents a channel that matches your confidentiality duties, for communication with clients, opposing parties and experts. For filings with the courts, use the official court channels in your jurisdiction; in the Netherlands, that is Secure Email with the Judiciary (Veilig mailen met de Rechtspraak).
Frequently asked questions about secure file sharing for law firms
Use a dedicated secure file sharing solution instead of email attachments or consumer transfer services. Look for recipient verification, encryption, expiry dates, revocable access and an audit trail that shows who opened which document and when.
No rule bans a specific service, but lawyers are responsible for choosing appropriate tools. A download link without recipient verification, revocable access or a record of who opened the file is hard to justify for documents covered by legal professional confidentiality.
Share only the documents the expert needs, verify the expert before access is granted, set an expiry date that matches the assignment and revoke access when the work is done. The audit trail then shows exactly what was shared.
Usually not directly. Many clients of law firms are covered by NIS2 or DORA, however. They must secure their supply chain and therefore set requirements for the firms that receive their sensitive information.
Since 1 January 2025, the explanatory notes to Rule of Conduct 3 of the Netherlands Bar Association state that lawyers are personally responsible for their choice of communication tools, providers, data processing and data storage. That responsibility cannot be shifted to an IT partner.
No. External recipients verify their identity with their phone number and then get access to the shared files.
Curious how your firm is doing? Schedule the free External Data Control Canvas: in 60 minutes, we map your external data flows, and within two business days you receive a scorecard with three priorities. Get in touch.
