Using Notion with client data: a confidentiality checklist

1. Decide what belongs in Notion

A database of matters, dates and next steps is not the same as a store of privileged documents. Decide, in writing, which categories of information go in Notion and which stay in your document management system or secure file store.

• Safe-ish to start with: matter names or reference numbers, dates, statuses, internal to-dos.
• Think twice: client identity where it is itself sensitive, medical or financial details, privileged advice.
• Consider a reference system: store a matter number in Notion and the document in your secure system.

2. Set permissions deliberately

Notion lets you set access at the workspace, teamspace and page level, with levels such as full access, can edit, can comment and can view. Start with the least access that lets each person do their job, and widen it only when needed.

• Keep sensitive matters on pages shared only with the people on that matter.
• Review who has access to each top-level page. Permissions on a parent page flow down to its children unless you change them.
• Check what your plan allows. Several admin controls depend on plan type.

3. Keep public links off

Notion can publish a page to the web. For a practice workspace this should be off. Where your plan allows it, workspace settings let owners restrict public sharing, guest invitations and content export. Check the settings and confirm they match your policy.

4. Treat guests and clients carefully

• Invite a guest only to the single page they need, never to the whole workspace.
• Remove guests when the matter closes.
• If clients see anything, build a separate client-facing page rather than exposing your internal database.

5. Secure the accounts

• Turn on two-step verification where available, and require it if your plan lets you.
• Use a password manager and unique passwords.
• Use single sign-on if your plan offers it and your firm already runs it.
• Review connected apps and integrations, and remove any you do not use.

6. Decide your position on AI features

If you or your team use Notion AI or any other assistant on matter content, decide first what the tool does with the data, whether your engagement terms and client consent allow it, and what your regulator says. See the guide on Notion AI for lawyers for ground rules and prompts.

7. Plan retention and offboarding

• Decide how long matter information stays in Notion after closure, and what happens to it.
• Keep an export or backup routine that matches your record-keeping duties.
• Remove access promptly when someone leaves or changes role.

8. Check the rules that apply to you

Professional conduct rules on confidentiality, supervision of third-party services and client consent differ by jurisdiction. Data protection law may add its own requirements. Read Notion's security and privacy documentation, and speak to your regulator's guidance or your firm's risk team before storing client information.

• Notion help: Sharing and permissions