Client papers and data breaches: a barrister's guide to prevention and response

A lever arch file left on a train. A laptop stolen from a car. An email with a client's medical report sent to the wrong solicitor. These are the data breaches that actually happen at the Bar, and most barristers know a colleague who has been through one. This guide covers how to handle client papers securely in day to day practice, and what to do, step by step, if something goes wrong.

Why papers are the biggest risk

Barristers carry their work with them. Papers travel between home, chambers, court and train, often in bags, on laptops and on phones. Every journey creates a risk. The material involved is frequently highly sensitive: family proceedings, criminal allegations, medical evidence and financial information. A single lost bundle can expose information about many people.

Handling paper documents

• Take only what you need. If you only need the trial bundle index and your notes, do not carry the full set of papers.
• Keep papers with you. Never leave bags unattended on public transport, in cafés or in court corridors. Do not leave papers in cars, even briefly.
• Use a lockable bag for sensitive papers and keep identifying information out of sight when working in public.
• Be careful when reading in public. On trains and in court waiting areas, others can easily see a page with a child's name or a medical diagnosis.
• Store securely at home. Papers should be kept somewhere that family members and visitors cannot access.
• Return or destroy promptly. When a case concludes, return papers to the solicitor or dispose of them securely by shredding or confidential waste, in line with your retention policy.

Handling digital papers

Electronic bundles reduce the risk of loss but create new ones.

• Encrypt every device that holds client material, including phones and tablets.
• Use multi-factor authentication on email and cloud storage.
• Download only what you need to a device and remove it when the case ends.
• Avoid public Wi-Fi for client work unless you use a secure connection.
• Check the recipient before you send any email, and be wary of autocomplete in the address bar. Misdirected emails are one of the most common causes of breaches reported to the ICO.
• Be cautious about using personal messaging apps to discuss cases.

What counts as a personal data breach

Under the UK GDPR a personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. It covers far more than hacking. Losing a bundle, sending an email to the wrong person, a stolen phone without encryption, or a family member reading papers left on the kitchen table can all qualify.

What to do if a breach happens

Speed matters. Work through these steps as soon as you discover a problem.

1. Contain it

Take immediate steps to limit the damage. Try to recover lost papers by contacting the train operator, the court or the venue. Ask the recipient of a misdirected email to delete it and confirm they have done so. Remotely wipe a lost device if you can, and change passwords on any compromised accounts.

2. Tell the right people internally

Inform your clerk and your chambers' data protection lead or head of chambers. They can help you manage the response and may have their own reporting obligations. If you were instructed by a solicitor, consider whether and how to tell them promptly, as the solicitor's firm may also be a controller.

3. Assess the risk

Think about what information was involved, how sensitive it is, how many people are affected, whether it was protected by encryption and the likely consequences for the individuals. A lost encrypted laptop with a strong password may present little risk. An unencrypted bundle of family court papers left on a train is very different.

4. Report to the ICO if required

If the breach is likely to result in a risk to people's rights and freedoms, you must report it to the Information Commissioner's Office without undue delay and, where feasible, within 72 hours of becoming aware of it. If you are not sure, it is often safer to report. You can provide further information later if you do not yet have all the facts. Keep a record of your reasoning if you decide not to report.

5. Tell the people affected where necessary

If the breach is likely to result in a high risk to individuals, you must also inform them without undue delay, explaining what happened, the likely consequences and what you are doing about it. Think carefully about how to do this in a way that is sensitive to their situation, and coordinate with the instructing solicitor where appropriate.

6. Notify your insurer

Contact the Bar Mutual Indemnity Fund promptly. Notification requirements in your policy may apply, and early notice protects your cover.

7. Consider your regulatory obligations

Think about whether the breach raises any reporting obligations to the Bar Standards Board under the Handbook. In many cases a properly handled data breach will not require a report, but serious incidents may. Seek advice from the Bar Council's ethics enquiry service if you are unsure.

8. Record and learn

Every breach, whether reported or not, should be recorded with the facts, effects and remedial action taken. Then look at what could be changed to prevent a repeat, whether that is encryption, carrying fewer papers or a new habit of double checking email recipients.

Prevention is mostly habit

Most breaches at the Bar are caused by ordinary human mistakes made under time pressure. Simple habits make a large difference: encrypt devices, check email addresses, carry less paper and never leave bags unattended. A short written procedure for responding to breaches, agreed with your chambers, means you will not be working it out from scratch on the worst day of the year.

At Clerk&Counsel we share only the information a panel barrister needs to consider an instruction, and we ask clients for documents through secure upload rather than email wherever possible.

This article is general information, not legal advice. Consult the ICO's guidance on personal data breaches and your chambers' data protection lead for advice on a specific incident.