An estate agent requests the buyer’s source-of-funds documents through a shared portal. A mortgage broker asks for the Report on Title. A member of staff uploads a document without realising that everyone invited to the transaction workspace can see it.
The portal may be secure. The disclosure may still be inappropriate.
Conveyancing firms need to establish who can access the information, why they need it and what permits the firm to share it. Technical permission to upload a document is different from professional authority to disclose its contents.
Lexsure’s October 2026 CQS policy notification addresses controlled information sharing through conveyancing portals. It provides a useful prompt to review the decisions staff make before documents leave the firm’s own systems.
A secure connection does not decide who should see the file
A portal can provide useful access controls, document histories and communication records. Those features need to be understood and configured for the transaction.
Before using a shared workspace, establish who can view, download, forward or add documents. Check whether permissions operate at transaction, folder or individual-document level, and who can invite additional users.
A folder labelled “buyer documents” does not necessarily mean that only the buyer and their conveyancer can access it. Staff should verify the actual permissions rather than rely on the label or their experience of another platform.
Our wider guide to reviewing the CQS Information Management and Security Policy considers how the firm’s written procedures should reflect the systems and safeguards it actually uses.
Ask four questions before sharing
A practical disclosure decision starts with four questions:
- Who is requesting the information? Verify the recipient and their role in the transaction.
- What do they need? Identify the particular information required and the purpose of the request.
- What permits disclosure? Establish the relevant client authority or other legal basis for sharing confidential information.
- How will access be controlled? Check the destination, recipients, permissions and record of disclosure.
An invitation from a familiar participant should not bypass these questions. A genuine request can still seek more information than is necessary or appropriate.
Explain client authority precisely
The SRA’s guidance on confidentiality of client information explains the duty to keep current and former clients’ affairs confidential, subject to the applicable exceptions.
Where the firm relies on client consent, explain what will be shared, with whom and for what purpose. Record the authority and its limits. A general request to “keep the agent updated” should not automatically be treated as permission to disclose financial evidence or legal advice.
Authority from one client may also be insufficient where the material contains another person’s confidential information.
Professional confidentiality, legal professional privilege and data protection require separate consideration. Client consent to a particular disclosure does not remove the need to assess the other applicable requirements.
Share what is needed for the purpose
The ICO’s guidance on data minimisation explains that personal information should be appropriate to the purpose and limited to what is necessary.
That principle matters when someone requests a whole document to answer a narrower question.
For example, consider whether an authorised factual update would answer the request without disclosing a bank statement containing unrelated payments, account details and information about third parties.
Do not assume that removing an account number makes the remaining document suitable for disclosure. Review the complete contents, including attachments, comments, tracked changes and information embedded elsewhere in the file.
Take particular care with financial evidence and legal advice
Requests involving identity documents, bank statements, source-of-funds evidence, internal AML assessments or legal advice should be referred through the firm’s agreed procedure.
Different documents raise different issues. Some contain third-party personal information. Some reveal confidential advice. Others may engage legal professional privilege or statutory restrictions on disclosure.
An estate agent’s or broker’s separate compliance responsibilities do not automatically entitle them to the conveyancer’s AML file. Equally, there may be circumstances in which a defined disclosure is appropriate. Assess the actual request and applicable obligations.
Where privilege or restrictions on AML-related disclosure may be involved, obtain appropriate advice before uploading. A general portal-sharing authority should not be used to resolve those questions.
An illustrative request: “Upload the bank statements to keep things moving”
A buyer’s conveyancer receives a portal request from the estate agent for the bank statements already supplied to the firm. The stated purpose is to complete the agent’s checks and avoid delaying the sale.
The first step is to clarify the request. What information is needed? Who will access it? Does the client understand the proposed disclosure? Would the client supplying information directly, or another properly authorised response, meet the purpose?
The firm should assess confidentiality, data protection and any other restrictions before deciding. Commercial urgency does not establish permission.
The record should show the request, assessment, authority where required, information disclosed and recipients. If the request is declined or narrowed, explain the reason appropriately and identify the next step.
Uploading and downloading are different from reviewing
Information management also concerns what happens when documents arrive.
A portal notification may show that a report has been uploaded. It does not establish that the responsible conveyancer has reviewed the report, identified its implications or acted on an outstanding issue.
Allocate responsibility for:
- Monitoring notifications and covering absences.
- Saving the relevant documents and correspondence to the matter record.
- Reviewing the contents and identifying required action.
- Recording deadlines, qualifications and unresolved questions.
- Escalating urgent or unclear material.
The October notification suggests a document-saving timetable for firms to consider and adapt. Any adopted timetable must accommodate urgency and expiring links; it should not be described as a universal statutory deadline.
Similarly, an uploaded message or changed transaction status should not be assumed to authorise exchange or completion. Our article on why a lender portal acknowledgement is not approval considers the related distinction between receipt and a substantive decision.
Keep the client-facing terms consistent with the procedure
The engagement documents should accurately explain how the firm uses portals and shares information. Staff procedures should support that explanation.
Our October terms and conditions update includes suggested wording on portal confidentiality and client authority.
When reviewing the wording, check whether it matches the particular platform, actual recipients and alternatives available to clients who cannot use the portal.
A broad clause should not become a substitute for explaining a proposed disclosure that falls outside the arrangements the client reasonably understood.
Plan for access changes and the end of the transaction
The firm should know how access is amended when staff leave, participants change or the transaction ends.
Check who can remove users and revoke links. Understand what information remains available to other participants and what the firm can retrieve after its subscription or transaction access ends.
Preserve the documents, communications, authority records and relevant audit information needed for the matter file. A portal should not become the only location of important evidence if access can disappear before the firm’s retention obligations end.
If information has been shared with the wrong recipient, activate the firm’s incident procedure promptly. Assess containment, preservation of evidence and any applicable notification duties with the responsible compliance personnel.
Turn the October amendment into a working procedure
Firms reviewing their documentation can consider Lexsure’s CQS CPMS Information Management and Security Policy template as a framework to adapt to their systems and responsibilities.
For portal sharing, the procedure should identify approved platforms, access controls, disclosure decisions, escalation arrangements and the records staff must retain.
Test it with a realistic request. Can the team explain who decides whether financial evidence may be shared, how authority is recorded and what happens if the usual supervisor is unavailable?
Lexsure’s POLICYmonitor CQS Policy Update Service provides monthly suggested policy paragraphs for CQS-accredited firms in England and Wales to review and adapt. The useful outcome is an approved procedure that staff understand and apply.
Does your policy explain who may share what?
Keep your CQS procedures under active review. POLICYmonitor’s monthly notifications provide suggested paragraphs to help your firm assess changes to information sharing, lender reporting and other conveyancing controls.
Explore the CQS Policy Update Service →
For CQS-accredited firms in England and Wales. Review, adapt and implement wording relevant to your practice.
This article concerns conveyancing practice in England and Wales and develops an issue addressed in Lexsure’s October 2026 policy notification. Disclosure decisions depend on the information, recipients, client authority and applicable legal and professional obligations.