Attorneys handle some of the most sensitive documents in professional life: client communications protected by privilege, discovery materials under protective order, settlement agreements, medical records in personal injury cases. The tools used to process these documents deserve the same scrutiny as the locks on the filing cabinet.
The privilege question
Attorney-client privilege protects communications made in confidence for the purpose of legal advice. When a lawyer uploads a privileged document to a third-party PDF tool, that document passes through infrastructure controlled by an entity outside the attorney-client relationship. While this likely doesn't waive privilege on its own, it introduces a variable that didn't need to exist.
Courts have generally held that inadvertent disclosure to a third party doesn't automatically waive privilege — but the analysis is fact-specific and jurisdiction-dependent. The simplest way to avoid the question entirely is to not send the document to a third party in the first place.
Protective orders and confidentiality agreements
Discovery materials often come with protective orders that restrict how documents can be stored, accessed, and processed. Uploading a protected document to an online PDF tool may technically violate the terms of a protective order, depending on its language. "Shall not be disclosed to any third party" is common protective order language — and a cloud PDF service's server infrastructure is, definitionally, a third party.
Opposing counsel probably won't audit your PDF tool choices. But if a breach occurs and your document handling comes under scrutiny, "I uploaded it to a consumer web tool" is not the answer anyone wants to give in a deposition.
Regulatory obligations
Lawyers handling health information (HIPAA), financial records (GLBA), or the personal data of EU residents (GDPR) face specific data handling requirements. These regulations typically require knowing where data is processed, by whom, and under what security controls. Consumer PDF tools rarely provide this level of transparency — and their terms of service are designed for general consumers, not regulated professionals.
What to evaluate in a PDF tool
When choosing PDF tools for legal work, the key questions aren't about features — they're about data flow. Does the tool upload files to a server? If so, where are those servers located? What's the retention period? Is there a BAA available for HIPAA-covered work? Can you verify the deletion claim?
A browser-based tool that processes files locally eliminates most of these questions. If the file never leaves your device, there's no third-party server, no cross-border transfer, no retention period to verify, and no BAA needed. The compliance analysis is simpler because there's less to analyze.
Practical steps
For firms evaluating their PDF tooling, the practical checklist is short. First, identify which tools in your current workflow upload files to external servers — check the Network tab in your browser's developer tools. Second, assess whether any of those uploads involve privileged, protected, or regulated documents. Third, for those document types, consider tools that process locally. The merge, split, compress, and redact operations that make up 90% of daily PDF work can all be done without an upload.