Client onboarding is often treated as a standard administrative exercise. Client information forms are issued, identity documents are sought and recorded, and basic matter details are logged into the case management system. Straightforward, quickly mastered process – what could possibly go wrong?
Because this stage is routine, firms often opt for the most cost effective option and delegate it to junior staff or central administrative hubs. From a cost perspective, this makes operational sense. Yet these initial interactions represent a critical point for client confidentiality breaches. When firms fail to properly train, resource, and support the staff handling initial client information, they introduce regulatory exposure from the first point of contact.
The blind spot
Confidentiality obligations under the SRA Code of Conduct are present the moment a prospective client discloses information to a firm. It is worth remembering that this duty applies whether or not a formal retainer is ever signed.
In practice, administrative staff, such as legal assistants and receptionists are the first people to handle the sensitive client disclosures. It is routine for them to manage unredacted client identity documents, personal financial records, and sensitive background information. They are exposed to the raw elements of the client matter, the information that allows the more experienced staff to swoop in and progress instructions.
Despite handling the first influx of confidential information, administrative staff do not always receive the same structured confidentiality training as fee earners. The gap in training creates several operational risks:
- Who is the client? Accurately identifying who the client actually is – and who holds the authority to provide instructions – remains a fundamental compliance step that is frequently missed during early contact. Junior staff may inadvertently accept instructions or share details with family members without verifying proper authority.
- Where is the information? Junior staff may accept sensitive personal information through non-secure channels or save files in temporary local folders before onboarding is complete.
- Don’t share it there? Without a clear understanding of the boundaries that exist, junior staff may post detailed background information in open internal chat channels or emails to fee earners before a matter is formally opened or conflict-checked.
- Is there a conflict? Junior staff may not recognise subtle conflict risks that exist. This can lead to confidential details being added on firm-wide systems before a conflict check has cleared, creating systemic conflict and confidentiality issues.
- Can you say that? It is not uncommon for prospective clients to involve third parties in early communications. Staff without adequate training may share matter status updates or sensitive details with these third parties without establishing explicit authority to do so
Mirror
The risk of a confidentiality breach rarely stems from deliberate neglect. It is usually the result of how firms allocate their training budgets and operational resources.
Assumptions are often made by firm leadership that risk management rests squarely with fee earners, viewing onboarding as operational overhead rather than a core risk control. This is particularly noticeable when practices scale or handle high transaction volumes. Onboarding teams are expected to process files quickly so a matter can progress – often without investment in their regulatory training or appropriate supervision.
When an administrative support function struggles to keep pace with work volume because it has not been scaled appropriately, staff naturally prioritise speed over procedural steps. In that environment, standard data protection and confidentiality protections are easily and often missed.
Signal
Responding to this positively does not require a firm to completely restructure its existing processes. However, it is critical to recognise onboarding for what it truly is, not merely an initial stage client onboarding but a fundamental risk management tool and regulatory safeguard.
Training for junior staff and administrative teams must extend past the process. Staff need practical investment in their knowledge and understanding on how confidentiality applies at the initial onboarding of a client, how breaches occur, how to spot potential conflicts early and importantly the implications and impacts of getting it wrong.
Manoeuvre
Clear rules for receiving and storing prospective client information are essential. Confidential information often starts flowing before a file is formally opened and conflict checks are complete. Consider clear retention and purging policies for client enquiries that do not proceed, which should prevent unnecessary conflict risks further down the line.
People should not be expected to operate in isolation. Staff should always have access to a senior colleague such as the COLP or other experienced senior member of staff whenever an unusual request or potential conflict arises during onboarding. A culture of openness in seeking guidance is essential to its success.
Looking in the rear-view mirror
It is good practice to regularly review a sample of rejected or incomplete onboarding files alongside opened matters. In addition to learning why new enquiries did not progress, there is much to gain from checking how client information was handled, where it was stored, and who had access to it prior to formal engagement.
Investing in the training and support of front-line staff helps to ensure that a firm’s confidentiality processes are effective from the first point of contact with a prospective client. This investment gives the firm confidence that new client relationships begin safely and that sensitive information is handled with care, respect and importantly regulatory compliance.
JBL Compliance can help firms review their current onboarding arrangements, assess staff training needs, and identify practical gaps in data handling procedures. Please contact us if you would like to discuss how this applies to your firm.
