Information Barriers: Confidential Matter Controls

Decide Whether a Barrier is Legally Available

Identify the client relationships, confidential information and applicable conduct rules before designing the barrier. The rule examples below use Queensland’s Australian Solicitors Conduct Rules. Other jurisdictions require their own adopted rules and relevant court authorities.

Under Queensland’s rules on relations with clients, the starting points differ.

Record the legal basis for acting and any required consent before the new team receives information. A client’s willingness to proceed does not establish that the practice can discharge its duties.

The Law Council’s conduct rules commentary stresses effectiveness in the particular circumstances. A court can restrain representation even where the practice considers its arrangement adequate. Family law can involve stricter considerations.

Keep the underlying client confidentiality assessment separate from the operating instructions. Broader competing-duty decisions belong in the legal ethics assessment. The barrier record must identify the permitted recipients without circulating the protected information to everyone making administrative arrangements.

Map People, Information and Access Paths

Map actual access to the confidential information, including access outside the matter folder. A document restriction leaves a gap if the same information appears in an unrestricted email or meeting summary.

List the screened people who hold the protected information and the permitted team working on the new matter. Include supervisors, assistants and shared administrative staff. Identify externally instructed specialists and anyone who can provide remote technical support.

For each person or role, record the information they may receive and the route by which they can receive it. Review matter-system permissions, shared folders, email groups, meeting invitations and physical files. Check search results, preview panes, shared calendars and automated notifications where they expose matter content.

Treat analysis as confidential wherever it reveals the protected material. A categorised transaction spreadsheet can disclose the same payment as a statement PDF. A findings paragraph can expose a client’s position even when it omits the original document.

A law firm merger or incoming practitioner requires this mapping before files or people move into shared arrangements. A new matter number alone does not change what a practitioner already knows.

Put the Barrier Into Operation

Put the authorised arrangement in place before the new team starts work. The Queensland Law Society’s information-barrier guidance calls for established protocols, responsible oversight and secured information, supported by undertakings and staff education.

1. Appoint an experienced solicitor to oversee the barrier. Identify who approves access changes and who receives a suspected-breach report.
2. Apply the restrictions to paper records and electronic copies. Remove inherited permissions that contradict the approved access list.
3. Give each affected person written instructions for their role. Obtain the required undertakings and record acknowledgements before access begins.
4. Separate supervision and communications. Provide an authorised substitute when the usual supervisor is unavailable, so urgency does not draw a screened person into the matter.
5. Explain the rules to shared staff and providers. Limit their tasks and access to the approved role, with a clear route for declining an inappropriate request.
6. Test the arrangement and resolve failed controls before relying on it. Keep unresolved exceptions visible to the responsible solicitor.

Consider a fictional estate dispute. Team A holds a former client’s bank records. Team B proposes to act in a new dispute, subject to a documented legal assessment permitting the arrangement.

The source PDFs stay within Team A’s restricted records. Its categorised transaction workbook and cited findings remain under the same separation. The authorised Team A reviewer can follow a finding back to its statement page. Team B receives none of those materials through a shared review folder.

A shared assistant receives instructions to refer requests for those records to the responsible solicitor. If Team B asks Team A for an informal explanation, Team A stops the discussion and reports the approach. The solicitor resolves any requested exception before information crosses the separation, including whether further consent or a reassessment is necessary.

Test and Document Effective Separation

Test the ways information can cross the barrier, using fictional records before exposing real confidential material. The following is an illustrative test plan, not a report of tests on an actual matter or provider.

Fictional Access Test

Retain the access review, responsible person and instruction record beside the test results. Record which access paths were tested and which exceptions remain unresolved. A signed policy establishes what staff were told. Observed results show whether the controls operate as intended.

A successful test covers those tested paths and permissions. Continue supervision and repeat affected checks when roles or systems change.

Respond to a Breach or Changed Team

Contain suspected leakage promptly and reassess whether the practice can continue acting. Staff movement, new facts about a client relationship or changed provider access can require reassessment before any actual disclosure occurs.

Stop the affected information transfer and refer the issue to the responsible solicitor. Preserve the relevant access logs and communications under appropriate restrictions. Establish what information passed, who received it and whether anyone used it in the new matter.

Apply the governing duties to the established facts. The response can require further instructions, legal advice or a decision to cease acting. Later restrictions cannot be assumed to repair a past disclosure or restore a retainer that is no longer permissible.

Before work resumes, document the decision about continuing to act and resolve the affected access arrangements. The team needs an authorised operating arrangement it can follow, supported by evidence of how it works.