Client data can be safe with virtual paralegals when the firm controls the access, and the duty stays with the lawyer. First settle whether the client must be told and must consent. Then ask to see seven controls: your own systems, scoped sign-in, no local copies, a signed agreement, a conflicts answer, same-day shutoff and an incident plan.
A law firm rarely hesitates over the work itself. The worry is access: who can open the file, from which device, and what happens to the copy afterward?
Only controls the firm can inspect will answer those questions. This is the checklist I would hand an attorney before any file moves to virtual paralegals.
Sources: ABA, 2023 Cybersecurity TechReport, a free summary of the ABA’s 2023 survey. Verizon, 2026 DBIR.
What does a careful firm ask for before it shares a file?
It asks four access questions: which systems the paralegal signs in to, whether files can be saved locally, who signs the confidentiality agreement and when, and how fast access can be switched off. The composite below shows them in use.
This is a composite drawn from several firms, details changed, not one client. A managing partner at a four-lawyer family and estate firm worried about one shared inbox holding names, medical notes and bank statements. On the first call he asked the four questions, and the provider shared a screen listing the accounts the paralegal would get.
Whose duty is client data when virtual paralegals work remotely?
The lawyer’s. The ABA Model Guidelines for the Utilization of Paralegal Services (2021 revision) make the lawyer responsible for the professional actions of a paralegal working at the lawyer’s direction, and Guideline 6 asks for reasonable measures to preserve client confidences. Model Rule 5.3 covers supervision of nonlawyer assistants.
Model Rule 1.6(c) asks for reasonable efforts to prevent inadvertent or unauthorized disclosure of, or unauthorized access to, client information.
ABA Formal Opinion 498 (2021) applies those rules to virtual practice. It says the duty to supervise reaches nonlawyers inside and outside the firm. It lists paralegals among outside support staff and says the lawyer must ensure that these individuals comply with the lawyer’s obligation of confidentiality.
Before any client information moves, decide whether the client must be told and must consent. ABA Formal Opinion 08-451 (2008) says that where the relationship is attenuated, as in a typical outsourcing relationship, no information protected by Rule 1.6 may be revealed without the client’s informed consent. Close supervision by your lawyers changes the analysis, and your state’s rules control.
The same opinion adds that a lawyer outsourcing support work should consider reference checks and a background investigation of the provider and any intermediary. For whether outsourcing is allowed at all, see this post on legally outsourcing paralegal work internationally.
Also ask where the work will be performed, and whether local law changes who could compel access to the file. Opinion 498 quotes Rule 5.3 comment [3], which points to the legal and ethical environments where services are performed.
If your firm holds health records as a HIPAA business associate, 45 CFR 164.502(e) lets it share them with a subcontractor only on satisfactory assurances in a written agreement. Ask your privacy counsel if an agreement applies.
What should virtual paralegals show you before the first file is shared?
Seven controls, seen on a screen or on paper: the firm’s own systems, scoped access and MFA, no local files, a signed NDA, a conflicts answer, same-day shutoff and a written incident process.
| Control | Require | Red flag | Basis |
|---|---|---|---|
| Own systems | Sign-in to systems the firm owns | Files by email or on unseen drives | Good practice; see Op. 498, p. 7 |
| Scoped access and MFA | Personal login for the role, MFA on | Shared login or admin rights | Good practice; Op. 477R (2017), p. 7 names MFA as a tool |
| No local files | Written rule against downloads to personal machines | Downloads allowed anywhere | Stricter than Op. 498 |
| Signed NDA | Signed before the first login | Access first, paperwork later | Strongly advisable: Op. 08-451, p. 5 |
| Conflicts | A clear answer on current and past work for adverse parties on related matters; if any, a screen or a different paralegal | No answer | Should verify: Op. 08-451, p. 5; Rule 1.10 cmt. [4] |
| Same-day shutoff | Logins removed the day work ends, file returned | Accounts left open | Good practice |
| Incident process | Written plan: who calls whom, how clients are told | “We have never had an incident” | Plan urged; material-breach notice required: Op. 483 (2018), pp. 6, 10 |
- Scoped access. A login limited to what the role needs.
- Multi-factor authentication (MFA). A second proof of identity at sign-in.
- Local copy. A client file saved outside the firm’s systems.
- Bring-your-own-device policy. Written rules for a worker’s own device.
The same seven apply to a paralegal assistant agency, a freelance marketplace and virtual legal assistants who touch client files.
On AI, the safer house rule is no client files in public AI tools.
Does the paralegal’s device change the risk?
It can, mostly through where copies of the file end up. Files saved locally are harder for the firm to see, restrict or recall once the engagement ends.
- 1StorageFirm controls
- 2BackupsVendor contract
- 3Other usersFirm controls
- 4File returnFirm controls
In the ABA’s 2023 survey, 29 percent of responding lawyers reported a security incident, lost devices included.
What does Simpalm Staffing publish, and what should you still ask?
Simpalm Staffing’s security FAQ lists four safeguards: an NDA signed before day one, a background check, access limited to the role with permissions your own team sets, and an optional Virtual Desktop that keeps work in a locked-down remote environment.
Simpalm Staffing places vetted virtual paralegals with U.S. businesses, and they work inside tools firms already run, such as Clio, MyCase, Filevine and Smokeball.
Ask any provider whether it holds a SOC 2 report or ISO 27001 certification. Simpalm Staffing’s FAQ lists the four safeguards above and no certification.
The public pages do not answer everything, so ask any provider, this one included, for written answers. Is multi-factor sign-in enforced? What does the Virtual Desktop block? Who signs the NDA? What does the background check cover? Who removes access at the end? Is there a written incident process? How are conflicts screened? Where is the work performed?
What should a firm do before the first file moves?
Settle client consent first, then send the questions above in writing, record what you were shown and what you were only told, and set a date to repeat the check. The lawyer who signs the engagement owns the result.
For short engagements, such as tax-season overflow for law firms, ask the same questions on day one, before deadline pressure starts.
The partner in the composite signed once he had seen the access list himself. The work had never been the problem. The login was.
Frequently asked questions
Can virtual paralegals work from a personal laptop?
ABA Formal Opinion 498 does not ban personal devices, but a bring-your-own-device policy must keep security tight, allow remote wipe, keep family members out and keep files retrievable.
Does a signed NDA make client data safe?
No. ABA Formal Opinion 08-451 calls written confidentiality agreements strongly advisable, but an agreement is one control among seven. Pair it with scoped access and a same-day shutoff.
Does the ABA require multi-factor authentication?
No. ABA Formal Opinions 477R and 498 name multi-factor authentication as an available tool but do not call it mandatory. CISA advises small businesses to require it.
Do we need the client’s consent before a virtual paralegal sees their file?
It depends on whether your lawyers closely supervise the paralegal and on your state’s rules. ABA Formal Opinion 08-451 treats a typical outsourcing relationship as attenuated and requires the client’s informed consent before Rule 1.6 information is revealed.
Can a paralegal use public AI tools with client files?
Not by default. If the tool is self-learning, ABA Formal Opinion 512 (2024) requires the client’s informed consent before client information goes in, and boilerplate in an engagement letter is not enough.
This article is general information for law firms, not legal advice. ABA opinions and guidelines are advisory and your state’s rules control. Sources: American Bar Association, Opinions 498, 477R, 483, 08-451 and 512; Rules 1.6, 1.10 comment and 5.3; Model Guidelines. Information last verified November 2, 2026.
Want to see the controls before the first file moves?
Read what Simpalm Staffing publishes in its security FAQ, then tell us which systems your firm runs. Anything the FAQ does not cover, ask for in writing. See the staffing process first if you want the steps.
Book a Free ConsultationReady to Build Your Remote Dream Team?
Simpalm Staffing matches US companies with top LATAM professionals.
Book a Free Discovery Call →