Why you should stop collecting documents by email.

Most firms still collect documents by email. It's free, every client has it, and nobody needs showing how to attach a file. But financial documents by email are a poor fit: bank statements, payslips, tax letters and IDs end up copied into inboxes nobody controls, and nothing tells you what's still missing.

This guide sets out why we think you should stop collecting documents by email, using the UK regulator's own guidance, and what to use instead. It's an opinion, so we've kept to what the sources say.

The case for collecting documents by email

Email deserves a fair hearing first.

• It costs nothing extra. You already pay for it.
• Clients know it. There's nothing to learn and no link to lose.
• It's quick for one file. If a client sends one document, once, a reply with an attachment is hard to beat.

The problems start when email becomes the system: ten documents per client, forty clients, the same job every year.

Attachments live forever, on both sides

An emailed bank statement doesn't arrive in one place. It sits in your client's sent folder, in the inbox of whoever received it, in any shared mailbox it was copied to, and often in someone's downloads folder too.

Nothing deletes those copies when the work is done. Your client's sent folder isn't yours to clear, and few firms go back through old inboxes to delete attachments.

That clashes with how data protection law treats personal data. The ICO's guidance on storage limitation says you must not keep personal data for longer than you need it, and should erase it when it's no longer needed (checked on 21 October 2026).

The ICO's list of common mistakes includes keeping things "just in case".

A retention policy is easy to write and hard to apply to an inbox. Files in a mailbox are mixed in with everything else, under subject lines like "Re: re: docs".

One wrong address is a data breach

The ICO's guide to personal data breaches lists "sending personal data to an incorrect recipient" as an example of a breach. Its page of common data protection mistakes puts sending an email to the wrong person first, among mistakes organisations tell it about daily (both checked on 21 October 2026).

It's an easy mistake. Two clients share a first name, the address field fills itself in, and a client's payslips go to someone else.

The ICO also says human error is the leading cause of reported breaches. What follows is work:

• trying to recall the email, then asking the recipient to delete it
• assessing the risk to the person whose documents went astray
• recording the breach, whether or not it needs reporting
• reporting it to the ICO within 72 hours if it's likely to put the person at risk

Financial documents raise the stakes. The ICO's data security advice says financial information, or information that could be used for identity fraud, would probably be classed as sensitive.

Forwarding takes the file out of your hands

Once an attachment is sent, anyone who has it can pass it on. A client forwards the thread to a spouse or a bookkeeper. Someone on your team forwards it to a colleague, or to a personal address to work from home.

Each forward makes another copy in another mailbox, with its own retention and its own security. You can't see it happen, and you can't undo it.

Email doesn't know what's missing

This is the part that costs time every week. An inbox records what arrived, not what you asked for.

So someone keeps the real list elsewhere, usually a spreadsheet. Every reply means opening the attachments, checking them against the list and updating the sheet. When a client goes quiet, someone works out what's outstanding and writes the reminder by hand.

The wrong files make it worse. A blurry photo, last year's statement or page one of three each needs another email, and another wait. After three rounds, nobody is quite sure which version is the right one.

Size limits split documents up

Every email provider caps attachment size. Gmail's limit for personal accounts is 25 MB, and over it, Gmail removes the attachment and adds a Google Drive link instead (checked on 21 October 2026).

So a long scanned bank statement arrives in three emails, or as a link to a file in someone else's Drive with its own sharing settings. Some clients give up and post paper.

What to use instead

There are three common alternatives. Each is better than email for collecting documents, and each has trade-offs.

Client portals in practice management software

If you already use practice management software, it may include a client portal. Documents go straight onto the client's record, next to the rest of your work.

The trade-off is that clients often need an account and a password, and some never log in. These suites also cost more, because collection is one feature among many.

Shared folders and file requests

Dropbox, Google Drive and OneDrive can all receive files, and you may already pay for one. A file request means your client doesn't need an account.

A folder knows that a file arrived, not which document it is or what's still missing. You still chase by hand, and folder permissions need care. The ICO's breach reporting categories include misconfigured permissions on a folder.

Dedicated document collection tools

These are built for the job: a checklist per client, uploads against each item, and reminders that list what's missing. Some don't ask clients to make an account, so check before you choose.

The trade-off is another tool to pay for and learn. Look for clear retention controls, and check how the private links are protected.

No tool removes risk entirely. The ICO counts personal data shown to the wrong person in a client portal as its own type of incident, so ask any provider how it keeps each client's files separate.

If you keep using email for now

Not every firm can switch tomorrow. If email stays part of your process, these steps reduce the risk. The first three come from the ICO's guidance:

• Turn off address autofill for work email, so the wrong "Sam" isn't suggested.
• Add a send delay, so there's time to catch a mistake before the email leaves.
• Check twice, send once, the ICO's phrase, especially for anything with attachments.
• Delete attachments after filing. Save them where they belong, then clear them from the mailbox.
• Never send documents back by email. If a client needs a copy, use something with a link you can revoke.

How to do this in GarnerDocs

GarnerDocs is a dedicated collection tool. Your client still gets an email from you, with a private link instead of a list to reply to.

• No attachments to clear. Clients upload through their link, so files don't sit in either side's mailbox.
• A checklist, not a spreadsheet. Each document is an item on the request, and you see what's in and what's missing.
• Reminders that only list what's missing. They stop once a document arrives.
• Files deleted on schedule. Choose 30, 90, 180 or 365 days after a request is complete, with warnings before anything goes.
• A link you can reset. If a link is forwarded, generate a new one and the old one stops working. Add a 6-digit PIN for sensitive requests.
• Larger files. Each document can be up to 25 MB by default, and your client sees the limit before uploading.

See how client links are protected, or how GarnerDocs compares with email attachments.

Sources

• Personal data breaches: a guide, ICO. Checked on 21 October 2026.
• Common data protection mistakes (and how to fix them), ICO. Checked on 21 October 2026.
• Data security advice, ICO. Checked on 21 October 2026.
• Principle (e): Storage limitation, ICO. Checked on 21 October 2026.
• Data security incident trends: incident types, ICO. Checked on 21 October 2026.
• Send attachments with your Gmail message, Google. Checked on 21 October 2026.

Several of these ICO pages say they're under review after the Data (Use and Access) Act, so check the current versions.

This guide is general information, not legal advice. Check what applies to your firm and your clients.