Guides

Outsourcing legal support: what a COLP should check before instructing a provider

17 August 2026 · 7 minute read

General orientation for firms considering outsourced legal support, not legal advice. Rules change and every firm's position differs, so check the current text of anything referred to here and take your own advice before relying on it. Northbound Legal Ltd is not a law firm and is not authorised or regulated by the Solicitors Regulation Authority.

Most firms that look at outsourcing stall in the same place. Not on price, and not on quality, but on a compliance question nobody wants to answer casually: if someone outside the firm touches the file, what changes about our regulatory position? The short answer is nothing, and that is exactly the point. Nothing changes, which means the firm carries the same accountability it always did, and the arrangement has to be built so that it can.

Below is what a compliance officer for legal practice sensibly establishes before instructing an outsourced legal support provider. It is written from the provider's side of the table, which means we have an interest in you concluding this can be done properly. Read it accordingly, and check the current rules yourself.

1. Separate outsourcing support work from referring a matter

These are different things and the distinction does real work. Outsourcing legal support means a third party carries out defined tasks, using its own people, on a file that remains yours: the client relationship, the retainer, the advice and the sign-off all stay with the firm. Referring a matter means sending the client elsewhere, so another firm takes on the retainer and its own client care duties.

The SRA has been explicit that a firm cannot outsource an entire matter to another firm while keeping the client retainer and presenting the work as its own, because that is misleading. If a whole matter is going somewhere else, it is a referral and should be handled as one. A support arrangement is only a support arrangement if the firm is still doing the legal work and directing the file.

The practical test is uncomfortable but useful: if the outsourced provider disappeared tomorrow, would your client still have a lawyer who knows their matter? If the honest answer is no, the arrangement is not what you have called it.

2. Establish who supervises, by name

Supervision is where outsourcing arrangements are won or lost. A firm should be able to say which individual reviews outsourced work before it reaches the client or the court, what they are checking, and what happens when it is not good enough. "The provider has a QA process" is not an answer to that question, because the provider's QA process is not the firm's supervision.

Two layers work better than one. A competent provider will review its own output before delivery, which catches the mechanical errors. That does not replace review by the firm; it makes the firm's review faster, because the supervisor is checking judgement rather than formatting. Be wary of any arrangement that treats provider-side review as a substitute for yours, and be equally wary of one that gives you nothing to review.

3. Decide what your clients need to be told

Confidentiality is owed to the client, and a firm cannot casually widen the circle of people who see a client's papers. Where a firm outsources to another firm, the SRA's position is that client consent is needed, because without it the disclosure breaches confidentiality.

For third-party support providers the analysis firms usually run is different in form but not in seriousness: the firm remains responsible for the confidentiality of everything it discloses, so it needs a lawful basis and an honest account of who will see what. In practice most firms handle this through their engagement terms and privacy notice, which is a drafting exercise worth doing before the first file moves rather than after. Some clients, particularly institutional ones, will have their own outsourcing restrictions in their panel terms. Those bite regardless of what your retainer says.

Whatever route your firm takes, take it deliberately. The failure mode is not a firm that decided wrongly; it is a firm that never decided.

4. Ask where the data goes, and get it in writing

If the provider's people are outside the UK, personal data in the file is likely to be making a restricted transfer, and that needs its own mechanism and its own assessment. This is involved enough that it has its own guide. For a first conversation, three questions get you most of the way: where are the people, what contractual mechanism covers the transfer, and can the work be done inside our systems so that no transfer happens at all?

That last option is worth more than it usually gets credit for. Where a provider works under scoped access inside the firm's own case management system, matter data never leaves the firm's control, and a great deal of the transfer analysis falls away.

5. Check qualifications honestly, and expect honesty back

People delivering outsourced legal support may be paralegals, or lawyers qualified somewhere other than England and Wales. Neither is a problem in itself. What matters is that the firm knows which, that the work is matched to it, and that nobody is described in a way that implies a qualification they do not hold.

A provider that blurs this in its marketing will blur it elsewhere. If a website says "lawyers" without saying where they are admitted, ask. The answer should be immediate and specific.

6. Plan for the arrangement ending

Before it starts, know how it stops: notice period, what happens to work in progress, how data is returned or deleted, and whether you are exposed if the provider fails. A month of notice and a clear deletion obligation is a very different risk profile from a twelve-month minimum term.

Continuity during the arrangement matters too. If the work depends on one individual, ask who covers their absence and whether that person is trained on your precedents. An outsourcing arrangement that collapses when someone takes leave has not removed a resourcing problem, it has moved it somewhere you can see it less clearly.

The short version

• The firm keeps the retainer, the advice, the client and the accountability.
• A named person at the firm supervises and signs off. That is not delegable.
• Confidentiality and client communication are decided deliberately, in advance.
• Data transfers have a mechanism and an assessment, or do not happen at all.
• Qualifications are stated precisely, by both sides.
• Exit, deletion and absence cover are agreed before the first file moves.

None of this is exotic. It is the same diligence a firm applies to any supplier that touches client confidential information, applied a little more carefully because the subject matter is legal work.

Sources

• SRA Code of Conduct for Firms
• SRA guidance on outsourcing and common queries
• The Law Society on outsourcing