Why public chatbots are a confidentiality hazard
When you enter text into a public, consumer AI tool, you often lose visibility and control over what happens to it. Depending on the service and its settings, that data may be retained, processed on external servers, or used to improve the model. For an advocate, that is a serious problem: the facts of a matter, the identity of parties, privileged strategy, and personal data of clients are exactly the kind of information that must not leak.
The judiciary has flagged this directly. The Kerala High Court's 2025 AI policy specifically cautioned against feeding case data into public cloud-based AI tools, naming the likes of ChatGPT. The concern that drove that warning applies with equal force to advocates handling sensitive client information.
Where the DPDP Act fits in
India's Digital Personal Data Protection framework raises the stakes further. Advocates routinely handle personal data — names, identifiers, financial and sometimes sensitive details of clients and third parties. Processing that data carelessly, including by feeding it into tools without appropriate safeguards, sits uncomfortably with the obligations the data protection regime imposes on those who handle personal information.
The practical upshot is simple: you cannot treat client personal data casually just because a convenient AI tool is a browser tab away. Where and how that data is processed matters, both ethically and legally.
The good news: you can have the benefits safely
None of this means avoiding AI. It means being deliberate about which AI and how. The advocates who handle this well capture every productivity gain without the exposure.
1. Prefer tools with proper data protection. A purpose-built legal platform can offer contractual and technical protections — controlled data handling, no use of your inputs to train public models, and appropriate security — that a free consumer chatbot does not. The question to ask any tool is: what happens to what I put in? If you cannot get a clear answer, do not put client data in.
2. Minimise and anonymise where possible. For general research questions, you often do not need to include identifying client details at all. Ask the legal question in the abstract. Reserve tools that process actual client material for platforms you trust with that material.
3. Keep sensitive documents in secure environments. Scanned briefs, evidence, and privileged drafts should be processed in tools designed for confidential legal work — not uploaded to a public service to save a few minutes.
4. Understand the tool's data posture before you rely on it. Retention, location of processing, training use, and security should be known quantities. Competence now includes knowing how your tools treat data.
Privacy and accuracy: the same discipline
It is worth noticing that the habits protecting client data are the same habits protecting against hallucination: choose purpose-built, trustworthy tools rather than convenient public ones, understand how they work, and keep control in your hands. An advocate who uses a grounded legal platform with proper data protections solves the citation-accuracy problem and the confidentiality problem at once. The shortcut of pasting everything into a public chatbot is precisely what creates both risks.
The takeaway
Client confidentiality is one of the deepest obligations in legal practice, and the AI era tests it in a new way. The convenience of a public chatbot is real — and so is the danger of handing it your clients' most sensitive information. As India's data protection framework matures, careless handling of client data through the wrong tools is a risk no advocate should take.
The solution is not to retreat from AI but to use it deliberately: choose tools built for confidential legal work, minimise what you expose, and keep control of your clients' data. Platforms built for Indian advocates — like LawWorld — are designed to deliver AI's speed and research power while keeping client information protected and citations grounded in real law. That is how you serve clients faster and keep faith with them.
This article is for general information and does not constitute legal advice. Advocates should assess their obligations under the applicable data protection law and Bar Council rules.
