Is Offshore Legal Support Confidential? What Firms Should Know
It's usually the first question that comes up, even before cost or capacity: if a firm sends case files to a team overseas, is that information actually protected the way it needs to be?
The short answer is yes, offshore legal support can be handled confidentially, and the American Bar Association has said outsourcing is not inherently unethical when the lawyer takes the right steps. The longer answer is that confidentiality isn't automatic. It depends on how the arrangement is structured, and firms that skip that step are the ones who end up with real exposure.
The ABA has already addressed whether this is allowed
In ABA Formal Opinion 08-451 (Aug. 5, 2008), the ABA looked at outsourcing legal and nonlegal support work, including work sent overseas. It concluded there is nothing unethical about it as long as the lawyer provides competent representation, protects client confidentiality and remains responsible for the work. State bar authorities, including the North Carolina State Bar, discuss and quote this opinion directly. Any lawyer or ethics counsel can verify it by name and date through Westlaw, Lexis, or a direct search.
So the question was never really "is this allowed." It's "what has to be in place for it to be allowed," and that's where the real substance is.
Confidentiality is a duty on the attorney, not just the vendor
Under ABA Model Rule 1.6, attorneys have an ethical duty to make reasonable efforts to prevent unauthorized disclosure of client information. That duty doesn't stop at the firm's own walls. Under Model Rule 5.3, it extends to the nonlawyers the firm brings in to help, offshore or not. In practice, the duty to protect client information stays with the attorney and does not pass to the support provider. The attorney is expected to confirm the provider has real protections in place, not assume it does. Some states describe a lawyer's responsibility for outsourced work differently, so firms should check the rules in their own jurisdiction.
ABA Formal Opinion 95-398 (Oct. 27, 1995) points the same way. It advised that a lawyer might be well advised to get a written statement of confidentiality assurance from an outside service provider. That opinion covered outside providers in general, but the reasoning applies to anyone who handles client files. The lawyer has to make reasonable efforts to confirm the provider will not make unauthorized disclosures.
What "reasonable efforts" actually looks like in practice
The rules don't require perfection, but they do require care that matches the sensitivity of the information. In practice, firms should expect, and providers should be able to show, four things:
a written confidentiality agreement that covers the support team specifically
defined access controls so only the people working a file can see it
secure systems for handling and sending documents
and a clear process for what happens if something goes wrong
That last point matters because ABA Formal Opinion 95-398 notes that a significant breach may require the lawyer to tell the affected clients. A provider that can't speak clearly to these points isn't necessarily acting in bad faith, but it does mean the firm hasn't yet done the diligence the rules expect of it.
Client disclosure is often expected, not optional
Several state bar authorities have concluded that the use of outsourced support should be disclosed to the client, ordinarily with the client's informed consent. Illinois says so in ISBA Opinion 19-04 (Oct. 2019). Disclosure and informed consent will ordinarily be required there, and always required when a lawyer hands off complete or substantial responsibility for a matter to an unaffiliated lawyer.
North Carolina is stricter when the work goes abroad. Its 2007 Formal Ethics Opinion 12 (April 25, 2008) requires the lawyer to disclose outsourcing to foreign assistants and get the client's written informed consent. Its 2011 Formal Ethics Opinion 14 requires client consent, confirmed in writing, before a lawyer sends transcription and typing work to a company in another country.
Requirements vary by state, but the pattern is consistent. Firms that are open with clients about how a case is being supported tend to be on much safer ground than firms that treat it as something not worth mentioning.
What happens when confidentiality isn't structured properly
The firm carries ethical exposure it may not realize it has, since the duty under Model Rule 1.6 doesn't shift to the vendor
Clients who later learn their file was handled offshore without disclosure may reasonably feel misled, even if nothing was actually mishandled
Without written agreements and access controls, a breach becomes far harder to trace, contain, or explain if a client or bar authority asks what happened
The firm's own credibility with clients and referral partners takes the hit, not the support provider's
What confidentiality looks like when it's done right
Firms that get this right treat confidentiality as infrastructure, not an assumption. That means a written agreement with the support provider, defined access limited to the people actually working a file, secure handling of documents from request through delivery, and clear communication with the client about how their matter is being supported. Done this way, offshore legal support doesn't have to be a confidentiality risk. It's a structured extension of the same duty the firm already carries for every other part of the case.
Ardent is a legal process outsourcing (LPO) provider in the Philippines that focuses only on legal support for law firms and legal professionals. Ardent Paralegal and Business Solutions has supported U.S. personal injury law firms with dedicated legal support teams since 2015. If you've had a difficult experience with outsourcing before, we're happy to walk through what we do differently. No pressure, just a conversation.
Frequently Asked Questions
Is it ethical for a U.S. law firm to use offshore legal support?
Generally, yes. The ABA addressed this in Formal Opinion 08-451 and concluded outsourcing is permissible when the lawyer provides competent representation, protects client confidentiality and remains responsible for the work. State rules differ, so a firm should check its own jurisdiction.
Who is responsible for confidentiality when using offshore legal support, the firm or the provider?
The attorney keeps the duty to protect client information under Model Rules 1.6 and 5.3, no matter who does the underlying work. That's why confirming a provider's confidentiality practices is part of the attorney's own duty and not something to assume. Some states describe the lawyer's responsibility for outsourced work differently, so it's worth checking local rules.
Do firms need to tell clients if their case is supported by an offshore team?
Often, yes. Several state bar authorities say disclosure and informed consent are ordinarily expected, especially when a provider takes on substantial responsibility for the matter. North Carolina requires written consent for outsourcing to foreign assistants. Requirements vary by state.
What should a firm look for to confirm a provider protects confidentiality properly?
A written confidentiality agreement specific to the engagement, defined access controls that limit who can view a file, secure systems for handling documents, and a clear process for responding if something goes wrong.
Does using offshore legal support waive attorney client privilege?
Not automatically. Privilege problems generally come from missing confidentiality safeguards, not from where the work is physically done. Written agreements, access controls and supervision help protect it. A firm with a specific concern should talk to its ethics counsel.
How does Ardent handle confidentiality for the law firms it supports?
Ardent's teams work under written confidentiality agreements and defined access controls, in line with the safeguards described in the ABA opinions. The firm stays in control of its files and its cases.
Comments