The practice note makes it clear that outsourcing business processes does not exclude solicitors from satisfying Outcome 4.1 of the Solicitors' Regulatory Authority's (SRA) Code of Conduct 2011, which requires them to keep the affairs of clients confidential unless disclosure is required or permitted by law or the client consents. The key word here is 'affairs', as this implies that the firm needs to keep confidential not only the client's data, but also which service providers the firm has retained to undertake work on the client's behalf.

The first step in keeping the affairs and data of a client confidential is to ensure that any service providers undertaking outsourced activities sign comprehensive confidentiality agreements. For example, a service provider might agree not to disclose the law firm's name, or the client's name, in its press releases and other marketing material. It is important that law firms also satisfy themselves that the service provider generally operates in a way which ensures that the firm can comply with the SRA guidelines on confidentiality and disclosure.

Outsourcing offers many benefits for law firms seeking greater efficiency, but it should still not be undertaken lightly. If things go wrong, whatever the part played by the service provider, ultimate responsibility rests with the law firm that outsourced the work. For example, the European Court of Justice recently held that if a UK law firm outsources to a US service provider, and transfers data, the EU-US safe harbor principles cannot necessarily be relied on (Maximillian Schrems v Data Protection Commissioner C-362/14; see News brief 'Safe harbor in a storm: ECJ rules on data transfers to the US', this issue). This may be the reason why some law firms have been slow to adopt the full range of outsourced services available. But is avoiding outsourcing, and missing out on the opportunity to increase efficiency and improve productivity, really good for the future of a law firm and its clients?

The risks associated with outsourcing can be mitigated by choosing the right service providers. The selection process is important, but as there is potential for this to be a long and involved process, some law firms or individuals within those firms might be tempted to cut corners and increase the risk. The practice note does not suggest the basis on which firms should select their service providers. However, law firms should be aware that their selection criteria may come under scrutiny and that a defined policy will help to lessen any criticism of the choices made.

A good place to start when selecting an outsourcing or co-sourcing partner is to look for one that meets ISO 27001:2013, the internationally recognised standard for information security management. This certification requires a service provider to set security objectives, monitor its performance against them and address any risks discovered, while taking every opportunity to improve standards. This proactive approach encourages service providers to identify problems and develop solutions relevant to their own activities and the needs of their clients, rather than pursuing a set of rigid security standards. The practice note suggests that law firms might consider auditing and checking the service provider's confidentiality and security processes for themselves, however, this is largely unnecessary for those with ISO 27001:2013 certification.

The location of service providers is also important when law firms are making their selection. For example, using service providers based entirely in the UK will make it easier for law firms to satisfy the need for the SRA to be able to enter the premises of service providers when required. This is not always practical if the service provider is on the other side of the world.

The practice note suggests that law firms should tell their clients when aspects of their business processes are being outsourced, to allow the client to decide if this introduces any potential risks. Choosing service providers that are committed to confidentiality will make it easier for a law firm to demonstrate that it understands its responsibilities. In addition, a law firm will have nothing to fear when revealing the identity of the service provider, as it can be confident that the client's own checks will reveal nothing of concern.

One of the more popular outsourcing activities for law firms is transcription of dictation, copy typing and secretarial services. There are a limited number of service providers offering these processes, which raises the question of conflicts of interest for law firms, particularly if work is undertaken by a small team in one location. There is a greater risk of conflicts of interest when using local suppliers and so firms should consider service providers with a workforce spread across the UK, rather than a single location.

The practice note also encourages law firms to consider whether they are outsourcing work that could be done just as efficiently in-house and whether it is being done to a standard similar to what would be achieved if it were undertaken by the law firm. Outsourcing partners are more likely to match or exceed the quality of work performed in-house if law firms work with service providers that employ people with experience of delivering the same or similar services. If they have experience of working in the same sectors, quality is less of a concern, whether this involves legal secretaries, IT teams or costing services.

The need to comply with the SRA Code of Conduct 2011 has led many law firms to consider co-sourcing rather than outsourcing arrangements with service providers (see box 'Co-sourcing'). Co-sourcing allows remote access to the firm's system, so that data never leaves the firm and remains under its control. This modern and increasingly popular approach to secretarial support guarantees the quality of office-based legal secretaries, but without the risks of outsourcing or the costs of hiring additional staff.

Outsourcing is here to stay. It allows law firms to deliver a better, more efficient service to their clients, while keeping costs under control and increasing productivity. However, there are obvious pitfalls and law firms must undertake the necessary due diligence when selecting outsourcing partners. There is no room for complacency. Firms must review constantly the service that they receive, maintain regular contact with service providers to make sure that they understand their responsibilities and work hard to ensure quality and confidentiality.

Maxine Park is a solicitor and the co-founder of DictateNow.