Password-protected PDFs in firm workflows

Password protection on PDFs is everywhere in matter work: clients send protected contracts, opponents deliver encrypted exhibits, internal drafts are locked. For filing or shared editing the team must decide whether and when to unlock - and how the unprotected version is handled afterwards.

Protection is not a licence for casual handling

A password protects the file, not automatically the whole processing chain. Unlocking and then dropping the clear copy into chat, email or shared folders effectively removes the protection. At the same time, many court portals and beA paths reject password-protected uploads outright. The professional question is not “password good or bad”, but “for this purpose, what protection status does this version need?”.

When unlocking is justified

Unlocking is typically required before portal upload, before OCR, before merging and before internal quality review that needs text search. What is not required - and often undesirable - is keeping an unprotected copy indefinitely beside confidential matter material without an access model. A clean rule: keep the unlocked working copy only for as long as the processing step lasts; then delete it or re-protect if the original should remain protected.

Record who knew the password and how it was received. Especially with client passwords arriving through a separate channel (phone, SMS), that note prevents later confusion.

Risks teams underestimate

Some tools remove only the open password but leave permission restrictions (print, copy) partially intact - or the reverse. Others rewrite the PDF structure and drop signatures. Before filing, check: does the file open without a dialogue? Are page count and visible content unchanged? Was a draft unlocked by mistake instead of the approved version?

Handover, cover and retention of unlocked copies

Password cases become critical when the fee-earner is away. Do not leave the password in clear text beside the file on the matter; record the channel and the storage location of the access note under firm rules - separate from the PDF itself. Cover solicitors must know whom they may call without the password landing in a widely readable chat.

Define a retention period for unlocked working copies: delete after filing or after the OCR step finishes, unless a separate archive duty applies. Synced folders and personal downloads are common leftovers; a short close-out checklist after the matter step catches them.

When clients dictate passwords orally, confirm receipt in an internal note without repeating the password. That keeps an audit trail that access existed without multiplying the secret. Discipline here is less elegance than repeatable care under everyday pressure.

LexLogik can support PDF workflows when files must be processed. Password sharing and retention remain organisational duties of the firm - tooling does not replace access rules.

Password paths and cover

Passwords for matter PDFs do not travel in the same email as the file, nor in a partner’s private chat. Office management keeps a protected pointer; cover staff get access only for named matters and only for a limited time.

Password protection without a handoff rule blocks cover staff and deadlines. Separating file and secret, and naming where the pointer lives, keeps protection and workability together.