Key takeaways
- The SRA Code of Conduct requires solicitors to keep the affairs of current and former clients confidential, and solicitors remain accountable for work carried out through people they supervise.
- When a translation provider processes personal data for a law firm, UK GDPR Article 28 requires a written contract with specific terms, including confidentiality commitments.
- Sending personal data to a translator outside the UK can be a "restricted transfer" that needs adequacy regulations, appropriate safeguards or an exception.
- ISO/IEC 27001 certification shows that a provider runs an information security management system; Cyber Essentials covers five basic technical controls.
This article is for solicitors, compliance officers, in-house legal teams and procurement staff who send confidential documents for translation. It sets out the legal and regulatory duties that apply, how to turn them into contract terms, and what evidence to ask a translation provider for.
Confidentiality is one of the main reasons legal translation differs from general translation. For the wider topic, see our guide to legal translation; for security in translation outside the legal sector, see data security when outsourcing translation.
What confidentiality duties apply when a law firm uses a translator?
A law firm that uses a translator remains bound by its own confidentiality duty to the client. Paragraph 6.3 of the SRA Code of Conduct for Solicitors states:
"You keep the affairs of current and former clients confidential unless disclosure is required or permitted by law or the client consents."
Paragraph 3.5 of the same Code adds that where you supervise or manage others providing legal services, "you remain accountable for the work carried out through them". In practice, the firm must choose providers whose confidentiality controls match its own, and record why it trusted them.
Legal professional privilege is a separate concern. Sharing privileged material with a translator under strict confidence for the purpose of the case is a normal part of litigation, but careless handling, such as uploading documents to a public tool, creates avoidable arguments about confidentiality.
What does UK GDPR require when translators handle personal data?
Most legal documents contain personal data, so a translation provider acting on a law firm's instructions is usually a processor (an organisation that processes personal data on behalf of a controller). Article 28(1) of UK GDPR says the controller "shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures".
Article 28(3) requires a written contract that, among other things, makes sure "persons authorised to process the personal data have committed themselves to confidentiality". Article 28(2) also stops a processor from engaging another processor, such as a freelance linguist, without the controller's prior specific or general written authorisation.
If a data breach happens
Under Article 33, a processor must notify the controller "without undue delay" after becoming aware of a personal data breach. The controller must then notify the regulator, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to individuals. Your contract should set a shorter internal deadline for the provider so you can meet the 72-hour window.
Can confidential documents be translated by linguists outside the UK?
Yes, but sending personal data to a linguist abroad may be an international transfer with its own rules. The ICO's guide to international transfers calls a transfer to a separate organisation outside the UK a "restricted transfer" and states:
"Every restricted transfer must be covered by one of the following transfer mechanisms: UK adequacy regulations; appropriate safeguards; or an exception."
Translation often needs native speakers living in the country of the language. Ask the provider where its linguists are based, how files reach them, and which transfer mechanism it relies on, such as the International Data Transfer Agreement (IDTA) or the UK Addendum.
What do ISO 27001 and Cyber Essentials prove about a translation provider?
ISO 27001 and Cyber Essentials prove different things, and neither replaces a contract. ISO describes ISO/IEC 27001 as "the world's best-known standard for information security management systems (ISMS)", and says conformity means an organisation "has put in place a system to manage risks related to the security of data owned or handled by the company".
Cyber Essentials, run by the National Cyber Security Centre, is narrower. The NCSC calls it "the minimum standard of cyber security recommended by the Government for organisations of all sizes", built around five technical controls. Certification starts at £320 plus VAT, and Cyber Essentials Plus adds independent technical testing.
| Safeguard | What it covers | What it does not cover |
|---|---|---|
| ISO/IEC 27001 | A managed, audited system for information security risk across the organisation | The quality of translations; specific contract terms |
| Cyber Essentials | Five baseline technical controls against common internet attacks | Policies, people and supplier management in depth |
| UK GDPR Article 28 contract | Legal obligations on processing personal data | Technical security in practice |
| NDA with each linguist | Individual confidentiality commitments | System security and data transfers |
What should a legal translation NDA and contract include?
A legal translation NDA and processing contract should cover who may see documents, how they are stored and deleted, and what happens if something goes wrong. Use this checklist when reviewing a provider's terms.
- Confidentiality obligations that bind the agency and every individual linguist, reviewer and project manager.
- Article 28 processor terms, including instructions, sub-processor approval and assistance with data subject rights.
- Where files are stored and processed, and the transfer mechanism for any linguist outside the UK.
- Secure file transfer instead of email attachments for sensitive material.
- A ban on uploading client content to public machine translation or AI tools.
- Retention and deletion periods, including for translation memories built from your documents.
- Breach notification to you within a fixed number of hours.
- Your right to audit or to receive evidence of certifications.
Common confidentiality mistakes in legal translation
Most confidentiality failures in legal translation are ordinary process errors. These are the ones to watch for.
- Pasting extracts into free online translators. Judicial guidance on AI warns that information put into a public AI chatbot "should be seen as being published to all the world"; see our article on machine translation for legal documents.
- Sending unredacted bundles when extracts would do. Translate only what the case needs.
- Forgetting metadata. Tracked changes, comments and file properties can reveal privileged advice.
- No record of who worked on the file. In disclosure-heavy cases, such as those in our litigation and disclosure translation article, keep a log of every linguist with access.
- Treating a certificate as the whole answer. Ask how the controls apply to your project specifically.
How TranslationWorks can help with confidential legal translation
TranslationWorks is a UK-based translation agency that translates confidential legal documents through native-speaking professional linguists in more than 150 languages, and it is ISO 27001 registered for information security, ISO 9001 registered for quality management and Cyber Essentials certified. TranslationWorks is registered to ISO 17100, the international standard for translation services. Our legal translation service covers contracts, dispute documents and regulatory material. If your panel terms include specific security, NDA or data protection requirements, include them when you request a free quote, and we will confirm how we can meet them. You can also email [email protected] with security questions before you send any documents.
