Choosing a client document portal for a law firm: what to check before you sign up

Family law files hold some of the most sensitive information a firm will ever see: bank statements, tax returns, payslips, super statements and, often, details of family violence. Most of it still arrives as email attachments.

This guide covers why that's a risk, which duties apply to Australian firms, and what to look for when comparing client document portals. It's general information, not legal or compliance advice for your firm.

Why email is the weak point

Email was never designed for confidential document exchange. Three problems come up again and again:

• Wrong recipient. In the Office of the Australian Information Commissioner's July to December 2024 report, personal information emailed to the wrong recipient was the largest single cause of human-error breaches: 71 of 170 notifications, or 42%. Autocomplete makes this easy to do and impossible to undo.
• Compromised mailboxes. In the same period, phishing that compromised credentials accounted for about a third of breaches caused by cyber incidents. Once someone is inside a mailbox, every attachment in it is exposed, often going back years.
• No record. An email thread doesn't tell you which documents are still outstanding, which version is current, or whether the other side ever opened what you sent.

The legal, accounting and management services sector made 81 notifications under the Notifiable Data Breaches scheme in calendar 2025, out of 1,205 in total, the highest yearly figure since the scheme began.

The duties that apply

Confidentiality

Rule 9 of the Australian Solicitors' Conduct Rules (as adopted in your state or territory) says a solicitor must not disclose information that is confidential to a client, subject to limited exceptions. The rule doesn't mention technology, but a system that makes misdirected disclosure easy works against it.

The Privacy Act

Many small businesses with annual turnover of $3 million or less are exempt from the Privacy Act 1988, but not all. A firm is covered regardless of turnover if, among other things, it is related to a larger covered business, has opted in, or is a reporting entity under the anti-money laundering laws (for those activities). With AUSTRAC's reforms extending to lawyers who provide certain services from 1 July 2026, check where your firm now stands.

For firms that are covered:

• APP 11 requires reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access or disclosure. Since the December 2024 amendments, those steps expressly include technical and organisational measures.
• APP 8 governs disclosing personal information overseas. The OAIC's guidance explains that giving data to an overseas cloud provider only for storage, where the firm keeps effective control, may be a use rather than a disclosure, but APP 11 still applies either way. Where your provider stores data, and on what contract terms, is a real question.
• The Notifiable Data Breaches scheme requires an assessment of a suspected breach within 30 days, and notice to the OAIC and affected individuals if serious harm is likely.

Even firms outside the Act have their conduct rules, their insurer's expectations and their clients' trust to protect.

A checklist for comparing portals

Where is the data stored?

Ask where the application runs and where documents are stored, not just where the company is based. Ask for it in writing.

How do people sign in?

The Australian Cyber Security Centre lists multi-factor authentication among its Essential Eight strategies. Staff accounts should require it. Check how lost phones are handled: an authenticator reset should need identity checks, and the person should be told it happened.

Who can see what?

Firm staff, clients and the other side's lawyers need very different access. Ask whether separation is enforced by the database on every request or only by what the screens show. Clients should see only their own items, and the other side only what you choose to disclose to them.

What do the emails say?

Notification emails are themselves a leak if they name documents or amounts. Good portals send "something needs your attention" and keep details behind sign-in.

Is there an audit trail?

You should be able to see who uploaded, reviewed, disclosed, downloaded or withdrew each document, and when. For disclosure, a register showing when the other side first downloaded each file answers most later disputes.

How are documents shared?

Documents should be served through short-lived links to signed-in people with permission, not permanent public links that work for anyone who has them.

Retention and export

Ask how long closed matters are kept, whether deletion is automatic, and whether you can export a whole matter at any time. You shouldn't lose access to your own files when you change systems.

Does it fit the work?

A general file-sharing tool solves the security problem but not the workflow one. For disclosure, look for item-by-item requests with periods, statuses, reminders, review with reasons, and an index and bundle built from what's accepted. See why disclosure stalls.

How Matter Folio handles these

Matter Folio runs in Sydney, with the database and every document stored there. Staff sign in with an authenticator app, separation between firms, clients and the other side is enforced by the database, emails never name documents or amounts, and every action is recorded in the matter's activity. Read the details on our security page, or see how the client document portal works.