POPIA and a law practice's client files
What the LSSA's POPIA guidelines ask of an attorney's client files, from lawful grounds to retention, and where Achekam helps a practice.
By Achekam · · 5 min read · For Legal businesses in South Africa
Few businesses hold as much personal detail as a small law practice. One divorce file can contain identity numbers, salary slips, bank statements, the children's school reports and a psychologist's assessment. A personal injury file holds hospital records. A conveyancing file holds both parties' bank details and marital status.
All of it falls under the Protection of Personal Information Act 4 of 2013 (POPIA). The Law Society of South Africa (LSSA) published guidelines for attorneys in 2021 that read the Act against a practice's daily work. This article follows those guidelines through the life of one client file, from intake to the day it is destroyed, and then sets out what Achekam can carry and what stays with the practice.
Eight conditions, read against one matter
The LSSA's guidelines state that section 4 of POPIA sets eight conditions for lawful processing: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation.
A list like that is easier to grasp against a real file. Take a residential transfer:
- Accountability: a named person in the practice answers for how the seller's and buyer's details are handled.
- Processing limitation and purpose specification: the practice collects what it needs to register the transfer, for that purpose.
- Further processing limitation: the buyer's e-mail address is not quietly added to a newsletter list later.
- Information quality: a changed postal address or bank account is updated on the file.
- Openness: both clients know what the practice holds and why.
- Security safeguards: the file is protected against loss and prying eyes.
- Data subject participation: a client who asks what the practice holds about them gets a proper answer.
Pick the lawful ground before you rely on consent
According to the LSSA, personal information may be processed only when one of these applies: the data subject (or a competent person, for a child) consents; the processing is necessary for a contract with the data subject; it complies with a legal obligation; it protects the data subject's legitimate interest; or it is necessary for the legitimate interests of the responsible party or a third party.
Consent is one ground among five, and often not the best one. Most of what a client hands over is processed because the mandate, a contract, requires it. Details about the opposing party, witnesses or a deceased estate's heirs usually rest on another ground. A practice that asks everyone for consent invites trouble when somebody withdraws it halfway through a matter. Record at file opening which ground covers each kind of person the file will mention.
What clients must be told at intake
The guidelines say that when attorneys collect personal information, they must take reasonably practicable steps to make the person aware of:
- the information being collected;
- its source, where it does not come from the person;
- the responsible party's name and address;
- the purpose of collecting it;
- whether supplying it is voluntary or mandatory; and
- any intended transfer to a third party.
The engagement letter or a one-page privacy notice handed over at the first consultation is the natural home for this. Name the third parties a matter commonly involves: counsel, correspondent attorneys, the deeds office, the sheriff, experts. Clients seldom object when told up front; they object when they find out by accident.
Retention: why is this file still here?
The LSSA's guidelines state that attorneys must not keep personal information longer than necessary for its purpose, unless the law requires it, it is needed for lawful purposes, a contract provides for it or the data subject consented. Once the practice is no longer authorised to keep it, the information must be destroyed, deleted or de-identified.
That does not mean shredding a file when the final account is paid. Trust records and some matter records must be kept for periods that other laws and the profession's rules set, and a closed file may be needed to answer a claim. The test the guidelines set is whether the practice can say why it still holds each file. A written retention schedule, applied to closed matters at least once a year, gives the answer.
Safeguards and a registered Information Officer
On security, the LSSA writes that attorneys must take appropriate, reasonable technical and organisational measures to prevent loss of, damage to or unauthorised destruction of personal information, and unlawful access to or processing of it. The organisational half matters as much as the technical half: who may open which files, how papers leave the office, what happens to a departing associate's access.
Someone has to own all of this. South Africa's Information Regulator states that, under section 55 of the Act, an Information Officer may take up their duties only after the responsible party has registered them with the Regulator, and that private and public bodies must register their Information Officers on its Information Officer Portal. In a sole practice that is usually the principal.
The LSSA lists what non-compliance can bring: financial and reputational risk, adverse publicity, fines issued by the Information Regulator and civil action by the person whose information was mishandled.
Where Achekam fits, and where it stops
Achekam does not run a practice's POPIA programme, and it does not decide what may be kept. It gives the practice a controlled place for client documents:
- One store for the file. Document Centre is folder-based: upload single files or whole folders, then preview, download, rename, move, tag, archive and search. Uploading a new version keeps the earlier ones.
- Expiring links instead of attachments. A document goes out as a personal e-mailed link with an expiry, an optional one-time code, and a choice to allow or block downloading. If it went to the wrong address, revoke the share.
- Screening at the door. Every stored file gets a SHA-256 fingerprint, executable files are refused by default, and every upload passes a malware check. That check uses ClamAV only where the server is configured for it; otherwise a built-in heuristic check runs.
- Stronger sign-in. Each user can turn on two-factor sign-in with an authenticator app, the practice can require it for everyone in its workspace, and staff can sign in with Google or Microsoft Entra ID once single sign-on is set up.
On retention, archiving a closed matter's folder and tagging it with the year it closed lets the annual review find it. Deleting or de-identifying it when the schedule says so is still a decision a person in the practice makes and carries out.
If the danger you worry about most is a fraudster changing bank details on an invoice, see stopping payment fraud through changed bank details. For setting up the folders themselves, read organising matter files and versions in one store.
Start with the guidelines themselves
The LSSA's Guidelines for Attorneys on the Protection of Personal Information Act explain each condition in the profession's own terms. Read them alongside your file-opening form, register your Information Officer if you have not, and write the retention schedule before the next matter closes.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
