Notice: this article is for general information and is not legal advice. Each law firm must assess its own case with its data protection officer and check the rules that apply at any given time.
Professional secrecy (secreto profesional, a Spanish lawyer's duty of confidentiality) makes no allowances for convenience. Article 542.3 of the LOPJ (Ley Orgánica del Poder Judicial, the Spanish Judiciary Act) and the Estatuto General de la Abogacía (the general statute of the Spanish legal profession) require lawyers to keep confidential everything they learn through their professional work. And when that information passes through someone else's tool, you need to know exactly where it goes.
The two layers that people tend to mix up
When assessing a tool, two different obligations get mixed up. It is worth separating them, because they are not met in the same way:
- Professional secrecy is a matter of professional ethics and covers the client's information, whether or not it is personal data. A corporate matter with no data about any individual is covered too.
- The GDPR is a regulation and covers personal data. Here the law firm is the controller and the provider, if it processes data on the firm's behalf, is a processor.
A tool can comply scrupulously with the GDPR and still make you uneasy from the point of view of professional secrecy, for example if the provider can read the content. It is worth looking at the two layers separately.
The five questions to ask
1. Where is the data processed?
This is the first question and the one that simplifies everything else the most. If the processing happens on the computer itself, that information is not disclosed to anyone: there is no processor to contract with and no transfer to analyse for that stage. If it travels to a server, the next four questions come into play.
That is why the split matters so much. «Everything is processed in the cloud» is not the same as «this part stays on your computer and only this other part leaves».
2. Is there a data processing agreement?
If the provider processes personal data on behalf of the law firm, Article 28 of the GDPR requires a processing agreement that sets out the subject matter, duration, purpose, security measures and the rules on sub-processors. It is not optional paperwork: without it, the processing is not properly covered. Before you sign up, ask for the document and check it.
3. Does the information leave the European Union?
International transfers have their own rules in Chapter V of the GDPR, and their legal basis has changed several times in the last decade. A provider that processes everything within the EU saves you that analysis and the uncertainty of future revisions. Watch out for vague answers: «we comply with the GDPR» does not mean «your data does not leave the EU».
4. Is your data used for training?
This is the question most often forgotten and the one that hurts most when the answer comes too late. Many general-purpose AI services reserve the right, by default, to use what you enter to improve their models. For a law firm that is simply unacceptable, and you have to check it in the specific terms of the plan you sign up for, not in the press release.
5. How long is it kept?
This is different from the previous point. A provider may not train on your data and still keep it for a while for operational or abuse-prevention reasons. What you need to know is the specific period and whether there is a zero-retention option for professional plans. Be wary of anyone who promises instant deletion without explaining under what contractual terms it happens.
A principle that saves arguments: data that does not leave your computer does not need protecting in transit, contracting for or auditing. Reducing what is sent is more effective than armour-plating what is sent.
The specific case of dictation
Voice dictation is a good example of why the split matters. When you dictate about a matter, the recording contains literally what you would tell a colleague: names, figures, strategy. It is some of the most sensitive material a law firm handles.
Most dictation apps send that audio to a server to transcribe it. It works well, but it means the recording of your voice talking about a client leaves your computer. If the server is also outside the EU, Chapter V comes into play as well.
The alternative is for the transcription to happen on the computer itself. Then the audio is not disclosed to anyone, and the whole first layer of the problem disappears.
How ablalo splits it. Your voice is transcribed on your own computer: the audio is not uploaded to any server. If you use Assistant mode (the one that rewrites, adjusts the tone or translates), only the text travels, and it goes to a European AI. Without that mode, nothing leaves. Your data is not used for training. The plans for law firms also include zero retention and a data processing agreement. The full details are in the privacy policy (in Spanish).
A checklist for assessing any tool
It works just as well for dictation, a document management system or a writing assistant:
- Which part is processed locally and which part is sent?
- Where, physically, are the servers that receive what is sent?
- Will they give me the signed Article 28 processing agreement?
- Is my data used to train models? Where does it say so in writing?
- How long is it kept, and can I sign up for zero retention?
- Are there sub-processors? Who are they and where are they?
- Can I delete my information and check that it has been deleted?
If a provider does not answer these seven clearly, you already have your answer. As an example of what a large vendor publishes, we go over what Microsoft says about the documents you give it in Copilot in Word.
In short
AI is not at odds with professional secrecy: what is at odds with it is using AI without knowing where the information goes. The difference between a tool you can justify to a client and one you cannot rarely lies in the quality of the result: it lies in the split between what stays on your computer and what leaves it, and in whether the provider puts it in writing.
Sources: BOE, Organic Law 6/1985 on the Judiciary, Article 542 (in Spanish) and General Statute of the Spanish Legal Profession, Articles 21 and 22 (Royal Decree 135/2021, in Spanish); Regulation (EU) 2016/679, the General Data Protection Regulation (Article 28 and Chapter V, in Spanish). Checked on 12 October 2026.
Frequently asked questions
Can a lawyer use AI tools without breaching professional secrecy?
Using AI does not in itself breach professional secrecy, but it does require you to control where the client's information goes. What matters is where the data is processed, whether the provider acts as a processor under an Article 28 GDPR agreement, whether there are transfers outside the EU and whether the data is used to train models.
What is a data processor in an AI tool?
It is the provider that processes personal data on behalf of the law firm, which remains the controller. Article 28 of the GDPR requires a processing agreement setting out the purpose, the duration, the security measures and the rules on sub-processors. Without that signed agreement, the processing is not properly covered.
What is the advantage of transcribing locally?
If the audio is transcribed on the computer itself, that recording is not disclosed to any third party, so for that stage there is no processor or international transfer to analyse. It is the simplest way to reduce the risk surface, because data that does not leave does not need protecting in transit.