On this page
Executive summary
Advocates hold some of the most sensitive information anyone shares: criminal allegations, family disputes, commercial secrets, medical records. The duty to keep it confidential is old and well understood. What is new is the number of places a document can end up once it is pasted into a tool.
General-purpose chatbots are useful and many have business tiers with stronger data commitments. The point is not that any particular vendor is unsafe — it is that a chamber should know, for every tool it uses, where client data is stored, who can access it, whether it is used for training, and how it can be deleted. Consumer accounts used by individual juniors on personal devices rarely meet that bar.
This guide sets out the professional and legal framework at a general level, the questions to ask any AI tool, and how a dedicated workspace such as Legal Staff approaches the problem.
A confidentiality checklist for using AI in a chamber
Write down which tools are allowed
List the AI tools the chamber may use and for what. Without a policy, every junior chooses their own, on their own accounts.
Classify what can be uploaded where
Public material (bare Acts, reported judgments) can go almost anywhere. Client documents, statements and strategy notes should only go into tools the chamber has approved for client data.
Check each tool's data terms
Read the current terms and settings: where data is stored, whether inputs are used to train models, how long they are retained, who at the vendor can access them, and how to delete them. Terms differ between consumer and business plans and change over time.
Prefer firm accounts to personal ones
Firm-managed accounts let you control access, remove departing staff and apply the right settings. Personal accounts leave client data with individuals.
Keep documents with the case
Upload documents to the case's own workspace rather than pasting them into separate chats. Then access is governed by the case, not by whoever ran the query.
Limit access by role
Juniors and clerks should see the matters they work on. Client portal sharing should be deliberate and per document.
Review and offboard
When someone leaves the chamber, remove their access the same day. Review who has access to sensitive matters periodically.
The framework in brief
| Source | What it requires (in general terms) | What it means for AI use |
|---|---|---|
| Bar Council of India Rules (standards of professional conduct) | An advocate must not breach the client's confidence or disclose communications made in the course of engagement | Do not put client confidences where you cannot control who sees them |
| Section 132 BSA (formerly s.126 Evidence Act) | Professional communications between advocate and client are protected from disclosure, subject to stated exceptions | Protect the communications themselves, including drafts and notes stored in tools |
| Digital Personal Data Protection Act, 2023 | Personal data must be processed for lawful purposes with reasonable security safeguards; obligations are phased in by the DPDP Rules | Know where client personal data goes, who processes it and how it is secured |
| Client engagement terms | Whatever you agreed with the client about handling their documents | Some clients, especially corporates, restrict use of third-party AI tools — check before uploading |
| Court and protective orders | Sealed covers, in-camera proceedings, identity protection in certain cases | Such material should not go into any external tool without clear permission |
The DPDP Act at a general level
The Digital Personal Data Protection Act, 2023 regulates the processing of digital personal data. In broad terms, a person or firm that decides why and how personal data is processed is a 'data fiduciary' and must, among other things, process it for lawful purposes, take reasonable security safeguards to prevent breaches and handle breaches as the law requires. The Rules framed under the Act phase in obligations over time.
A chamber handling client files is likely to be processing personal data — of clients, opposite parties and witnesses. How each obligation applies to legal practice, and the current commencement status of each part of the Act and Rules, should be checked in the text itself; this article does not attempt to state it definitively. The practical point is simpler: you should be able to say where your clients' personal data is and who can see it.
How Legal Staff approaches confidentiality
Legal Staff is built as a workspace for one firm's matters. Each firm's data is isolated at the database level using row-level security, documents are kept in private storage, and sign-in is through Google accounts. Access within the firm is by role, and client portal sharing is opt-in per matter.
The AI Case Brain answers only from the documents of the case you are working in, with citations to them. Client documents are not used to train public models. As with any vendor, read the current terms and security documentation and decide what your chamber's policy allows.
- Firm-level data isolation (row-level security).
- Private document storage per case.
- Role-based access for juniors, clerks and partners.
- AI answers grounded in the case's own documents.
When a general chatbot is fine
Plenty of AI use involves no client data at all: explaining a procedural concept to a junior, improving the language of a standard clause, structuring a research note on a public judgment. For these, a well-configured general tool on a firm account may be perfectly appropriate. The discipline is in not letting convenience carry client documents along with it.
Common pitfalls
If the chamber has not decided which tools are allowed for client data, the decision is made by whoever is in a hurry.
Client documents in a junior's personal account stay there after the junior leaves.
Vendors update data and training terms. Review the settings of approved tools periodically.
Even in approved tools, share only what the task needs. Names and identifying details are often unnecessary for drafting help.
Banning AI outright tends to push use underground. A clear policy with an approved tool is safer than a ban that people work around.
Frequently asked questions
Is it a breach of confidentiality to use ChatGPT or similar tools?
It depends on what you upload, the account and settings you use, and what your client has agreed. Using a general tool for public material is very different from pasting a client's statement into a personal account. Check the tool's current terms and your professional obligations.
Does the DPDP Act apply to advocates?
Chambers that process clients' and others' digital personal data are likely to be within its scope as data fiduciaries, subject to any exemptions. Check the Act and the DPDP Rules for how and when specific obligations apply.
Does Legal Staff use my documents to train AI models?
No. Client documents are not used to train public models. Each firm's data is isolated and documents are kept in private storage. Read the current terms for details.
What should a chamber's AI policy include?
Which tools are approved, what data may go into each, firm versus personal accounts, who has access to what, how outputs are reviewed by an advocate, and what happens when someone leaves.
General information for advocates, not legal advice. Statutes, rules and court practice directions change; check the bare Act, the latest amendments and your court's rules before relying on any date or section.