Remote and paperless legal work

by Hamza Suleman

Paperless does not mean recordless. The firm needs an authoritative record, controlled access, recovery and deletion rules. Use it when lawyers work away from the office or use several devices, or when paper is removed or records move to digital storage.

Boundary: this is not a security assessment. Obtain qualified advice for sensitive or high-impact systems.

Operational guidance, not legal advice. No confidential information is needed. Original PDF editions (both v1, 18 Aug 2026, now combined into this single maintained page): Remote Legal Work Checklist and Paperless Law Firm Checklist.

1. Frame the decision

Paperless does not mean recordless. The firm needs an authoritative record, controlled access, recovery and deletion rules.

Specific focus - pick the line that matches your situation:

• Remote work: confirm how client information is accessed, discussed, stored and recovered.
• Paperless: prove retrieval, retention and restore before disposing of old records.

Questions to answer:

• Which devices reach client data?
• Where is the authoritative record?
• Which controls belong to the firm?
• Can records be restored?

Avoid:

• personal accounts
• assuming cloud defaults are secure
• calling sync a backup

2. Control sheet

Treat a blank evidence field as a reason to pause, not a reason to guess. Record sources and owners before changing the workflow.

Fail closed: if an input, owner or approval is missing, record the gap and keep the affected step outside the proposed change.

3. Working record

Complete this page with counts, dates and named sources. Do not include client names, matter names, contract text or privileged material.

Evidence quality check:

• The source is named and dated.
• An estimate is labelled as an estimate.
• The owner can reproduce the measure.
• The same method can be used after a change.

4. Decision record

Select the outcome that the evidence supports. A stop or no-change decision is valid.

• Stop: a required source, owner or approval is missing.
• Fix: repair the underlying route before adding technology or cost.
• Test: run one bounded change with a baseline and review date.
• Proceed: adopt only the option supported by the recorded evidence.

Related pages: the fix-buy-pilot decision guide (/resources/fix-buy-pilot-leave-it-alone-guide/) and the guides hub (/law-firm-guides/). Questions: hello@margolegal.com.

Primary sources

• NCSC - Small organisations guide to cyber security: https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security
• NCSC - Choosing a cloud provider: https://www.ncsc.gov.uk/collection/cloud/choosing-a-cloud-provider
• NCSC - Cloud security shared responsibility model: https://www.ncsc.gov.uk/collection/cloud/understanding-cloud-services/cloud-security-shared-responsibility-model
• Information Commission (formerly ICO) - Information security checklist: https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-self-assessment-medium-businesses/information-security-checklist/
• SRA - Code of Conduct for Firms (confidentiality of client information, para 6.3): https://www.sra.org.uk/solicitors/standards-regulations/code-conduct-firms/

Source status: links checked 15 September 2026 (all five verified live 200). Confirm the current version and obtain appropriate professional advice before relying on regulated, contractual, privacy, security, insurance, financial or wellbeing conclusions.

MARGO LEGAL LTD, company number 17322603. Registered in England and Wales. Registered office: 66 Paul Street, London, England, EC2A 4NA. Originally published as two PDF guides (v1, 18 August 2026); consolidated and converted to HTML 15 September 2026.