Why clients shouldn't email sensitive documents.

Ask a client for their passport and a bank statement, and most will photograph both and hit reply. It's quick, and it's what they're usually asked to do. We think clients shouldn't email sensitive documents: passports, driving licences, bank statements, tax returns and anything else that could be used to pretend to be them.

This guide is for any business that collects ID and financial records from clients: law firms, lenders, advisors, HR teams and property managers. Why you should stop collecting documents by email covers the day-to-day costs of email, such as size limits and tracking what's missing. This one is about the documents themselves, and where they end up.

Why these documents are different

Most attachments do no harm if they go astray. An ID scan is different, because it's useful to anyone who wants to be your client for a day.

• Passports and driving licences carry a full name, date of birth, photo and document number.
• Bank statements show account numbers, balances and who your client pays.
• Tax returns add income, a home address and, in the US, a Social Security number.
• Payslips and benefit letters tie all of that to an employer or an agency.

The FTC's guide for business, Protecting Personal Information, names Social Security numbers and financial information as what thieves use most often for fraud and identity theft (checked on 21 October 2026). One emailed pack can hold all of it.

Inboxes keep everything, for years

An emailed passport doesn't arrive in one place. It sits in your client's sent folder, on their phone, in your inbox, in any shared mailbox it was copied to, and in the inbox of every colleague it was forwarded to.

Nobody goes back to clear those copies. Five years after the work closed, the scan is still there, one search away for anyone who gets into the account.

Deleting doesn't always delete, either. The ICO's right of access guidance points out that an email moved to "Deleted items" hasn't been deleted, because it's still easy to get to (checked on 21 October 2026).

Both regulators say the same thing about how long to keep this kind of data:

• The FTC says that if you have a business need for sensitive information, keep it only as long as necessary, and write a retention policy that says how to dispose of it.
• The ICO's data minimisation principle asks you to collect only what you need, review what you hold and delete what you don't need (checked on 21 October 2026).

An inbox makes that hard. Files aren't filed by client, nothing has a deletion date, and nobody owns the clean-up.

Email travels through personal accounts

On your client's side, the passport often goes nowhere near a work account. It's sent from a personal email on a shared family laptop. Or a son or daughter scans it and sends it for them, so now it sits in a relative's sent mail too.

The photo stays in the phone's camera roll, which often syncs to a cloud photo library. You can't ask for those copies to be deleted, because you don't know they exist.

On your side, a colleague forwards a thread to a personal address to finish it at home, or saves attachments to a home laptop.

The ICO's view is that staff shouldn't usually keep client information in private email accounts or on personal devices. You should have a policy that makes this clear, partly because of the security risk on devices you don't control. The FTC also says your policies should cover people who work from home.

A mailbox is a single point of failure

The ICO publishes personal data breach examples to show organisations how to judge risk (checked on 21 October 2026). One is about a law firm:

• An employee entered their login details on a fake site after a phishing email.
• A forwarding rule was set up that sent their emails to a third party.
• The third party emailed clients with "new" bank details, and two clients paid.
• The account also held scanned copies of client ID documents.

The firm reported the breach to the ICO and told its clients. It judged the risk of identity theft or fraud to be high because the ID scans were in that mailbox.

Every ID that arrived by email became part of that breach. If clients had uploaded them somewhere else, the attacker would have found emails, not passports.

The FTC is blunt about the channel itself: "Regular email is not a secure method for sending sensitive data." It tells businesses to warn staff against emailing Social Security numbers and account details, and to encrypt sensitive data sent over the internet.

What to offer clients instead

There are three common alternatives. Each keeps sensitive documents out of inboxes, and each has trade-offs.

Secure client portals

Practice, case and loan management software often includes a client portal. Documents land on the client's record, next to the rest of the work.

The trade-off is that clients usually need an account and a password. Some never log in and email the documents anyway. Check that your own team signs in with multi-factor authentication, which the FTC suggests.

Shared-folder file requests

Dropbox and OneDrive file requests let a client upload without an account. Files land in one folder you control, not in two inboxes.

A folder knows that a file arrived, not which document it is or what's still missing. Folder permissions need care, because one wrong sharing setting exposes everything in it. You also delete the files yourself. How shared folders compare goes through each tool.

Dedicated document collection tools

These are built for asking clients for documents: a checklist per client, an upload for each item and reminders for what's missing. Before you choose one, ask:

• Does your client need an account, or just a link?
• How is that link protected, and can you replace it if it's forwarded?
• How long are files kept, and are they deleted automatically?
• Who on your team can download them, and can you require two-factor sign-in?

No tool removes the risk. A good one moves sensitive documents out of inboxes into one place, with an owner and a deletion date.

Tell clients why, and what to do instead

Clients email IDs because that's how they were asked. A sentence in your request changes the habit:

Please upload your passport and bank statements through the link
below, rather than attaching them to an email. Email copies stay in
inboxes for years, on your side and ours. The link keeps them in one
place, and we delete them once we no longer need them.

Only promise deletion if you actually delete. Then back it up:

• If a document arrives by email anyway, save it where it belongs, delete the email from the inbox and from "Deleted items", and reply with the link for next time.
• Never send ID or statements back by email. If a client needs a copy, use something with a link you can revoke.
• Protect the mailboxes you still use. Turn on multi-factor sign-in and forbid forwarding work email to personal accounts.
• Ask only for what you need. If a photo page will do, don't ask for every page of a passport.

How to do this in GarnerDocs

GarnerDocs is a dedicated collection tool. Your client still gets an email from you, with a private link instead of a request to reply with attachments.

• A private link, no account. Each request has its own random link. Your client uploads from a phone or a computer, with no password to create.
• A PIN for sensitive requests. Add a 6-digit PIN that you give your client by phone or text. It's never in the email.
• A link you can replace. If a link is forwarded, generate a new one and the old one stops working straight away.
• Files in one private place. Files are kept in private storage, and your team signs in to download them. Owners can require two-factor authentication for everyone.
• Deleted on schedule. Choose 30, 90, 180 or 365 days after a request is complete, with warnings before anything is deleted.
• Collected, not verified. GarnerDocs collects ID documents. It doesn't verify them, so your own checks still apply.

How client links are protected

Sources

• Protecting Personal Information: A Guide for Business, FTC. Checked on 21 October 2026.
• Personal data breach examples, ICO. Checked on 21 October 2026.
• How do we find and retrieve the relevant information?, ICO. Checked on 21 October 2026.
• Principle (c): Data minimisation, ICO. Checked on 21 October 2026.

Some ICO pages say they're under review after the Data (Use and Access) Act, so check the current versions. For the wider case against email, including misdirected emails, see how GarnerDocs compares with email attachments.

This guide is general information, not legal advice. Check what applies to your business and your clients.