Automatic time capture and client confidentiality: where does your data go?

Automatic time capture can process client names, document text, browser addresses and descriptions of legal work. That does not make it incompatible with client confidentiality, but “GDPR compliant” or “encrypted” is not a sufficient answer.

The real test is concrete: what is captured, what remains on the lawyer's device, what leaves it, which organisations receive it and when it is deleted.

What automatic time capture can see

Confidentiality is one of the statutory core values of the Dutch legal profession. The Dutch Bar records it as a core value under Article 10a of the Advocatenwet, with the duty of secrecy anchored in Article 11a.

Automatic capture needs more scrutiny than a stopwatch. It observes activity to determine what the lawyer worked on. Depending on the product and its configuration, that could include screen content, application activity, keyboard input, clipboard content or background-window information.

The distinction is not simply local versus cloud. A product may store activity locally but still send selected text to an external AI model. The firm needs the complete route, not one reassuring sentence about storage.

Raw activity, model input and time entries are separate

The first is raw capture: the detailed record observed while the lawyer works. The second is model input: the subset sent to an AI system to identify a task, matter or narrative. The third is the resulting time entry that moves into the firm's practice-management or billing system.

Each layer can have a different storage location, retention period and authorised audience. “Zero retention” at a model provider does not mean no processing took place. Encryption protects data in storage or transit, but does not determine whether the recipient was entitled to receive it.

What should remain on the lawyer's device

For a confidentiality-focused design, raw activity should be processed before it is shared with an external service. The information sent onwards should be limited to what is required to identify the work, connect it to a matter and prepare a usable entry.

Sixminute processes captured activity on the device first. It organises and reformats that material before anything is prepared for model processing. This separates the detailed working record from the narrower input required to produce a time entry.

That boundary does not mean nothing can leave the device. Model processing and delivery of approved entries are separate data movements, each requiring its own safeguards.

When information needs to leave the device

When external model processing is used, prepared activity material is transmitted through a secure routing layer. Sixminute does not retain the content in that routing layer. The model account, retention terms and restrictions on training must be agreed for the firm's deployment.

Firms with different confidentiality requirements can use a firm-controlled or on-premise processing arrangement instead. The exact architecture should be documented during implementation rather than assumed from a general product label.

After review, the resulting matter, duration and narrative are released into the firm's practice-management system through the connector built for that environment. “On-device processing” therefore does not mean that no information ever leaves the device. It means that captured activity is prepared locally before any external inference or downstream release occurs.

Dutch law firms remain responsible for the data

The GDPR's data-minimisation principle requires personal data to be adequate, relevant and limited to what is necessary. Article 28 requires sufficient guarantees from processors and a binding processing agreement. Article 32 requires security appropriate to the risk, while Chapter V governs transfers outside the European Economic Area.

The Dutch Bar's recommendations for AI tell lawyers to map processing countries, subprocessors and security; share only necessary information; check contracts; and conduct a Data Protection Impact Assessment when processing personal data with AI.

Automatic capture may also involve employee privacy. If a system is intended or suitable for observing attendance, behaviour or performance, Article 27 of the Works Councils Act can give the works council a right of consent. The Dutch Data Protection Authority says organisations should conduct a DPIA before large-scale or systematic monitoring of employee activity. A private draft visible only to the timekeeper reduces internal exposure, but it does not remove the need to define permitted use.

Ask every vendor for the complete data flow

Before approving automatic capture, require a written data-flow description covering collected fields, recipients, processing locations, retention, deletion, model training, subprocessors, access roles and incident response. The processing agreement and technical documentation should support it.

The safest architecture depends on the firm's work. A hosted route may be acceptable when only minimised data leaves the device under adequate contractual and technical controls. A firm handling matters with stricter client restrictions may require firm-controlled or on-premise processing.

The decision is therefore not whether automatic capture “reads the screen”. It is whether the firm can account for each piece of confidential information from capture to deletion, while keeping the lawyer in control of what becomes a billable entry.