One client. Many matters. Many systems. One firm's responsibility.
Follow one client's matter through conflict checks, engagement and KYC, instructions arriving on WhatsApp, evidence and due diligence, the document system, drafting and AI, external counsel and experts, court and regulatory filing, billing, closure and long-term archives - and count every place it ends up, and where you lose control of it.
- 1
Enquiry, conflict check & the first conversation
+5 places · 5 so farSomeone calls, messages or walks in with a problem. Before any engagement exists they describe the facts, name the other side, and often send the first document - so the firm holds a stranger's dispute and a counterparty's name before it has decided to act.
Moving hereClient identity & contact (new at this stage)Matter details (new at this stage)Instructions & communications (new at this stage)Allegations & personal circumstances (new at this stage)Other people's records (new at this stage)Filings & orders (new at this stage)DPDPAYou are collecting personal data - about the enquirer and about people they name - from the first conversation. Say what you collect and why, and decide how long a rejected enquiry is kept.
- 2
Engagement, KYC & matter opening control breaks
+5 places · 10 so farThe engagement letter is signed, identity documents are collected, and a matter is opened in the firm's systems. One client record and one matter number now exist, and every system downstream copies from them.
Where control breaks: Full ID documents collected because that is what is always done
Moving hereKYC & identity proofs (new at this stage)Property & corporate documents (new at this stage)Employment & HR records (new at this stage)Time, billing & expenses (new at this stage)Staff access & credentials (new at this stage)Client identity & contact+3 moreDPDPACollect only the identity documents the engagement actually needs, and use the engagement letter to explain how data will be used, shared, stored and kept.
- 3
Instructions, documents & client uploads control breaks
+5 places · 15 so farThe client sends everything they have - contracts, bank statements, chat screenshots, photographs, medical papers - by email, WhatsApp, a shared link and a bundle of hard copies, usually all four for the same matter.
Where control breaks: The whole case arrives on a personal phone
Moving hereFinancial & banking records (new at this stage)Medical & health records (new at this stage)Evidence files & media (new at this stage)Client identity & contactKYC & identity proofsInstructions & communications+5 moreDPDPAEvery intake channel is a place a later access or deletion request has to reach. One controlled channel is worth more than any policy about the others.
- 4
Evidence, witnesses & third-party records
+4 places · 19 so farMaterial is gathered about people who never engaged the firm - the opposing party, witnesses, family members, employees. Call recordings, device extractions, screenshots of someone else's messages, medical and financial records obtained for the dispute.
Moving hereInstructions & communicationsFinancial & banking recordsAllegations & personal circumstancesEvidence files & mediaOther people's recordsDPDPAMost of this data belongs to people you have no relationship with and cannot notify. Hold only what the matter needs, and keep it separately from routine files.
- 5
The matter file, DMS & working copies control breaks
+3 places · 22 so farEverything is consolidated into the matter file - and simultaneously duplicated onto associate laptops, a personal drive, a print-out and the physical file room. The document system is where the firm believes the matter lives.
Where control breaks: Everyone in the firm can open every matter
Moving hereAdvice, drafts & strategy· inferred (new at this stage)Client identity & contactMatter detailsFinancial & banking recordsEvidence files & mediaOther people's records+1 moreDPDPAAccess should follow the matter team, not the firm. If everyone can open every matter, a family or criminal file is open to everyone too.
- 6
Research, analysis & AI-assisted drafting control breaks
+5 places · 27 so farFacts become legal analysis: a chronology, an issue list, a settlement position, a view on the other side's witnesses. Research platforms and AI tools are used to summarise and draft, and matter facts are pasted into them.
Where control breaks: Matter facts pasted into a public AI tool
Moving hereAssessments & predictions· inferred (new at this stage)Matter detailsInstructions & communicationsAllegations & personal circumstancesEvidence files & mediaOther people's records+3 moreDPDPAThe analysis is new personal data you created about identifiable people. An AI tool you never contracted with is a disclosure, not a feature.
- 7
Drafting, review & client approval
+2 places · 29 so farPleadings, agreements, affidavits and schedules are drafted, redlined, printed, emailed for approval and revised - so the same personal data exists in a dozen near-identical versions across a dozen places.
Moving hereClient identity & contactInstructions & communicationsFinancial & banking recordsProperty & corporate documentsEmployment & HR recordsMedical & health records+6 moreDPDPAVersion sprawl is a privacy problem, not only a housekeeping one: it decides how many copies a later request has to find and correct.
- 8
External counsel, experts, translators & agents control breaks
+2 places · 31 so farThe file leaves the firm. Senior counsel, experts and valuers, translators, notaries, filing agents, clerks and e-discovery vendors each receive a copy - very often the whole file when a subset would do.
Where control breaks: The whole file goes out when part of it would do
Moving hereKYC & identity proofsMatter detailsInstructions & communicationsFinancial & banking recordsProperty & corporate documentsEmployment & HR records+6 moreDPDPAShare the minimum the recipient's task needs, record who received what and why, and agree what happens to their copy when the work ends.
- 9
Court, tribunal & regulatory filing control breaks
+5 places · 36 so farThe submission is made - to a court or tribunal e-filing portal, a registry counter, the MCA or a sector regulator. Personal data crosses out of the firm's private file into a system with its own publication and retention rules.
Where control breaks: What you file becomes public, exactly as the client sent it
Moving hereClient identity & contactKYC & identity proofsMatter detailsFinancial & banking recordsProperty & corporate documentsMedical & health records+5 moreDPDPAOnce filed, control ends. Apply minimisation and redaction BEFORE submission, because there is no meaningful way to withdraw it afterwards.
- 10
Hearings, orders, settlement & enforcement
+3 places · 39 so farHearing notes, video-hearing recordings, transcripts, orders and settlement terms accumulate - on the record, in the matter file, on a junior's laptop and in the client's WhatsApp thread.
Moving hereClient identity & contactMatter detailsInstructions & communicationsFinancial & banking recordsMedical & health recordsAllegations & personal circumstances+5 moreDPDPAOrders and settlement terms carry the matter's most sensitive facts. Send them to the verified client contact, not to a group.
- 11
Time recording, billing & expenses control breaks
+4 places · 43 so farTime entries describe the work in the matter's own words, expenses carry receipts and third-party details, and the invoice travels to the client's accounts team and into the firm's finance systems.
Where control breaks: The invoice tells the story of the matter
Moving hereClient identity & contactMatter detailsFinancial & banking recordsMedical & health recordsAllegations & personal circumstancesOther people's records+3 moreDPDPAA narrative written for a partner is read by finance staff and the client's accounts payable. Keep matter facts out of the line item.
- 12
Matter closure, legal hold & return of documents
+3 places · 46 so farThe matter is marked closed. Originals may be returned, a hold may be recorded, access should be revoked - and in practice the file simply stops being opened while remaining exactly where it was.
Moving hereClient identity & contactKYC & identity proofsMatter detailsInstructions & communicationsProperty & corporate documentsEvidence files & media+3 moreDPDPAClosure is a decision point, not an event. Separate what genuinely must be kept from what has merely never been deleted, and write down which is which.
- 13
Archives, backups & the record room control breaks
+2 places · 48 so farThe file settles into long-term storage - the archive, nightly backups, an offsite records vault, the physical record room, and whatever is still sitting on the laptop of an associate who left two years ago.
Where control breaks: Closed matters are kept forever, by default
Moving hereClient identity & contactKYC & identity proofsMatter detailsFinancial & banking recordsProperty & corporate documentsAllegations & personal circumstances+4 moreDPDPARetention needs a defined period and an owner. "In case of appeal" is a reason to keep a file for a stated time, not a reason to keep everything forever.
Top risk hotspots - where control usually breaks
The 8 places client data most often slips out of your control. Each links to the matching check in the readiness assessment.
- Hotspot 1 Critical risk
Annexures go up with the submission in the form they arrived - full bank statements, a medical report, a salary slip, a chat export naming children and family members - because the question asked was 'what proves the point', not 'what has to be on the record'.
Why this matters
Filing is the one place in this map where control ends permanently. A document on a public record is indexed, copied and quoted, and no engagement letter, deletion request or change of lawyer reverses it.
Fix: Make redaction a step in the filing checklist, not a judgement call: decide what the forum actually requires, mask the rest, and keep the full version in the matter file.
Check this in the assessment - Hotspot 2 Critical risk
Clients send statements, medical papers, photographs and screenshots of the other side's messages straight into a WhatsApp thread, where they auto-download to a personal handset and back up to a personal cloud account.
Why this matters
This is usually the richest single collection of high-impact data in the matter, and it sits where the firm cannot search it, protect it or delete it - including material about people who never engaged the firm at all.
Fix: Give clients one controlled intake route - a portal or an official channel - and stop accepting matter documents on personal chat, including from long-standing clients.
Check this in the assessment - Hotspot 3 Critical risk
Access is granted by joining the firm rather than by joining the matter, so a matrimonial file, a criminal brief and a harassment investigation are all readable by anyone with a login - including this term's interns.
Why this matters
The most sensitive matters a firm handles are precisely the ones where an unnecessary reader causes real harm, and open access means the firm cannot say who has read what.
Fix: Move to matter-based access with a restricted setting for high-impact matters, and review who can open what when people join, move team or leave.
Check this in the assessment - Hotspot 4 Critical risk
Counsel, experts, translators, notaries and filing agents each receive the same assembled pack because it is the one that already exists - and nobody records who got which version or what happens to it afterwards.
Why this matters
Each recipient becomes a separate, permanent copy of the matter outside the firm, with their own staff and storage, and no agreed end point. A later request cannot reach any of them.
Fix: Build the pack for the recipient rather than reusing one, keep a note of who received what and why, and set a return-or-destroy expectation in the instruction letter.
Check this in the assessment - Hotspot 5 Critical risk
A junior pastes a statement, a notice or a set of facts into a general-purpose chatbot to summarise or draft - names, dates, allegations and figures included - because it is quicker and nobody said not to.
Why this matters
That is a disclosure to an outside service the firm never contracted with, and the prompt history persists somewhere the firm has no access to and cannot delete.
Fix: Provide an approved tool with written terms, say plainly that client facts must not go into consumer AI services, and make sure every intern hears it in week one.
Check this in the assessment - Hotspot 6 Critical risk
A matter is marked closed and nothing else happens. The file, its evidence, its identity documents and its backups stay complete and restorable, because 'we might need it if there's an appeal' has no end date attached.
Why this matters
A litigation file genuinely does have grounds to be kept for a period - but a period is not forever, and a firm that keeps everything cannot tell the difference between what it must retain and what it has simply never deleted.
Fix: Set a retention period per matter type with a named owner, record the reason whenever something is kept longer, and make deletion a scheduled step rather than an intention.
Check this in the assessment - Hotspot 7 Critical risk
PAN, Aadhaar and passport scans are taken at matter opening whether or not the engagement needs them, dropped into a folder alongside the client's papers, and kept long after the matter ends.
Why this matters
Identity documents are the most reusable thing a firm holds and the most damaging to lose, and most of the copies exist because of habit rather than a requirement anybody can point to.
Fix: Write down which documents each type of engagement actually requires, keep the verification result rather than every full scan, and restrict the folder to the people who need it.
Check this in the assessment - Hotspot 8 High risk
Time entries are written in the matter's own language - the allegation, the medical report, the family member - and the invoice travels to the firm's accounts team and the client's accounts payable.
Why this matters
People with no reason to know the facts of a matter read them routinely, and an invoice is one of the most widely circulated documents a firm produces.
Fix: Write narratives at the level of the task rather than the facts, and keep matter detail in the matter file where the access rules apply.
Check this in the assessment
What happens when someone asks
The map above shows where client data ends up. This is what that means the day someone asks you to find it, fix it or remove it - including the places a request realistically cannot reach.
Who asks: A client moving to another firm, usually mid-matter and usually in a hurry
Where you have to look
- Physical file room & case bundlesYour firm
- Document management systemYour firm
- KYC & ID document folderYour firm
- Client portalYour firm
- Firm emailYour firm
- Return-of-documents recordYour firm
Where this usually cannot reach
- E-filing & regulator submission portalCourts, tribunals & regulators
- Public record & registerOn the public record
- External & senior counselOthers who receive it
- Departed staff's copiesOthers who receive it
What has to happen
- Confirm who is asking and that they are authorised to receive the file for this matter.
- Identify what is the client's own property - the originals they gave you - and hand those back.
- Produce the matter documents the client is entitled to a copy of, in a usable form rather than as a box.
- Record what was returned and what the firm retained, and why, in the return record.
- Tell the client plainly which material stays with the firm and which is already outside it.
- Close portal access and stop new material being added to the matter.
The part that usually fails: The originals go back and every scan, working copy, email attachment and printout stays. Most firms cannot say how many copies that is, so the honest answer to "do you still have my documents" is usually yes.
Check whether you could answer this todayWhen it has already gone wrong
An operational response reference for the incidents this sector actually has - what to do in the first hour, what to put right afterwards, and the control that stops a repeat. Whether an incident needs to be reported is a decision to take with your own advisers.
How you find out: The other side points it out, or the client sees the filed set and calls
Systems involved
- E-filing & regulator submission portalCourts, tribunals & regulators
- Document management systemYour firm
- Public record & registerOn the public record
- Registry & filing counterCourts, tribunals & regulators
First - stop it spreading
- Establish exactly what was filed, in which version, and whether it is already publicly visible.
- Stop the same set being served or filed again anywhere else in the matter.
- Check whether the forum offers a corrected, sealed or restricted filing route, and use it immediately if it does.
- Preserve the original submission and the acknowledgement rather than overwriting them.
Then - correct it and record it
- File the properly minimised version through the route the forum provides.
- Correct the firm's own copies and the brief pack so it cannot be re-served.
- Tell the client what has been done and, plainly, what cannot be undone.
- Record the incident, what was exposed and to whom, on the matter file.
The control that prevents a repeat: Make redaction an explicit step on the filing checklist, so the question "what does the forum actually require" is answered separately from "what did the client send us".
How to read this journey
Pick your model
Switch between Litigation & dispute resolution, Corporate, transactional & advisory and Full-service multi-office firm to see the journey each kind of practice actually runs. This is not a filter over one journey - a litigation practice gathers evidence about the other side and files it into a public record and has no data room; a corporate practice takes in a target company's employee files in bulk and files with the MCA and never drafts an affidavit; a full-service firm runs both and adds a precedent bank that reuses matter content across offices. The stage count and the place-counter recalculate for the model you choose.
When it leaves you
A violet left edge and a tag mark everything outside your firm - counsel and their clerks, experts, translators and notaries, filing agents, e-discovery and data-room providers, the transcription service, the courts and regulators you file with, the other side and their lawyers, and anything that lands on a public record. Once data is there your control is indirect at best: it runs through your instructions and your contract, not your document system. Risk is shown separately, as an amber or red fill - so an outside system can be low risk, and a junior's own laptop can be one of the worst things on the page.
Where control breaks
Red flags mark the hotspots - the eight places law firms most often lose control of client and matter data, from an annexure that becomes public exactly as the client sent it, to a whole case arriving on a personal phone, to closed matters that are simply never deleted. Tap any system to see what it holds and how to fix it.
Now check whether your controls hold up
The map shows where client and matter data travels in a typical law firm. The 3-minute readiness scan checks whether your firm has the controls that matter at each hotspot - and the Discovery tool builds your own data inventory.
Educational reference model - not legal advice, and not a scan of your actual systems.