Data minimisation
Use synthetic, redacted or minimum-necessary information for discovery and testing where practical. Do not submit privileged, sensitive or client-identifying matter information through a general enquiry form.
This page describes principles for agreeing controls; it does not claim certification or guarantee a particular security posture. Confirm the actual implementation and contractual commitments before publication.
This page describes principles for agreeing controls; it does not claim certification or guarantee a particular security posture. Confirm the actual implementation and contractual commitments before publication.
Draft review date: October 2026. Confirm the effective date and responsible entity before publication.
Access and permissions
Access should be limited to authorised people and systems based on role and need. Credentials should not be sent through general enquiry forms or embedded in shared documents.
Approved channels
Before transferring client or matter information, agree the approved transfer channel, permitted data categories, access duration, retention and deletion process.
AI and third-party tools
Do not enter confidential or privileged information into AI systems or third-party services unless authorised, assessed and covered by the engagement terms and applicable policies.
Incident handling
The engagement should identify incident reporting contacts, escalation steps and responsibilities. Any notification timelines must be specified in the applicable agreement and comply with law.
Continuity and deletion
The controls applicable to a project depend on the systems used, the data involved, client requirements and the signed agreement. Do not assume a certification or control that has not been independently verified.
Use synthetic, redacted or minimum-necessary information for discovery and testing where practical. Do not submit privileged, sensitive or client-identifying matter information through a general enquiry form.
Define authorised users, least-privilege permissions, multi-factor authentication where available, approval steps, joiner/mover/leaver processes and access revocation.
Assess approved tools, data use terms, retention, training settings, subprocessors, transfer locations and human review before entering client information into AI or third-party systems.
Agree a point of contact, escalation route, evidence preservation steps, notification responsibilities and decision authority in the project or service agreement.
Set retention periods and deletion responsibilities before work begins. Backups, legal holds and vendor retention limits may affect the timing of deletion.
Document system owners, dependencies, backups where in scope, recovery responsibilities, administrator access and the steps required to transition or end services.