Confidentiality for Interim Lawyers and Staff

By Christian Steinmetz and Maren Siegels

Short answer: Companies protect confidential data when working with an interim lawyer or compliance professional through four building blocks: a contractual confidentiality undertaking that also runs directly to the host company, an access concept based on need-to-know, a briefing on day one and a documented return of data and devices at the end of the assignment. Data protection responsibility stays with the company: in Germany, agency workers count as the hirer's employees for data protection purposes (Section 26(8) no. 1 BDSG). In Switzerland, Art. 321a(4) of the Code of Obligations (OR) requires employees to keep confidential information secret, including after the employment ends, as far as legitimate interests require.

This guide is for general counsel, heads of compliance, information security and HR in Switzerland and Germany who bring in interim staff. It explains which confidentiality rules apply to an interim lawyer, how to set up contracts and access rights, and what to do when the assignment ends.

Confidentiality in four phases: who is responsible for what

Confidentiality on an interim assignment is a sequence of measures before, during and after the engagement.

Phase	Measure	Responsible
Before the assignment	Cover confidentiality in the staff leasing or freelance contract, obtain a personal confidentiality undertaking to the host company, check for conflicts of interest	Company (legal, procurement) together with the provider
Before the assignment	Define access roles, agree devices and work location, request accounts	Business unit with IT and information security
Day 1	Briefing on policies, classification, filing and how to report a data breach	Line contact in the company
During the assignment	Adjust permissions when tasks change, spot-check access	Business unit and IT
End of assignment	Disable accounts, collect devices and documents, obtain written confirmation of return and deletion	Business unit, IT, HR or procurement
After the assignment	Document continuing confidentiality, retain logs	Company; the professional remains bound

Under staff leasing, the company holds the right to give professional instructions and the professional is integrated into its organisation. Under freelancing, the professional works independently within the agreed mandate. Both models need the same building blocks, but different contracts.

Setting out confidentiality in contracts: employment contract, staff leasing agreement, NDA

Under staff leasing, the statutory duty of confidentiality is owed to the employer, which is the staffing provider. The host company therefore needs its own contractual basis. Three layers work together:

Employment contract between provider and professional: in Switzerland, the duty of confidentiality under Art. 321a(4) OR applies, including after the contract ends.
Staff leasing agreement between provider and host company: it must be in writing in Switzerland (Art. 22 AVG, Swiss Recruitment Act) and in text form in Germany (Section 12(1) AÜG, German Temporary Agency Work Act). It should state that the provider binds the professional to confidentiality towards the host company.
Personal non-disclosure agreement: the professional signs directly with the host company, so the company can enforce claims itself. Under freelancing, confidentiality is part of the mandate agreement; under Swiss law the agent is liable for faithful and diligent performance (Art. 398(2) OR).

What a confidentiality agreement should cover

Definition of confidential information, including personal data, matter data and client data
Use only for the assignment, no copies on private devices or accounts
No input into tools that have not been approved, including AI applications
Duty to return and delete, with written confirmation
Survival after the assignment and reference to statutory secrecy duties such as Swiss banking secrecy
Duty to disclose conflicts of interest and earlier work for opposing parties

In Germany the agreement serves a further purpose: information only qualifies as a trade secret if its holder has taken reasonable steps to keep it secret (Section 2 no. 1(b) GeschGehG, German Trade Secrets Act). Contracts and an access concept are evidence of those steps.

Professional secrecy and legal privilege in Germany and Switzerland

Interim lawyers in an in-house legal team do not act as attorneys. As a rule, they are bound by employment and contractual confidentiality, not by attorney professional secrecy. This affects how documents are protected in proceedings.

Germany

In criminal proceedings, in-house lawyers admitted as Syndikusrechtsanwalt (German in-house attorney) generally have no right to refuse testimony about what they learned in that capacity (Section 53(1) sentence 1 no. 3 StPO, subject to Section 53a StPO).
According to the Federal Court of Justice, a lawyer placed with a law firm through Arbeitnehmerüberlassung (German temporary agency work) cannot be admitted as an attorney or in-house attorney if they act externally (BGH, judgment of 20 March 2023, AnwZ (Brfg) 12/21). Because the provider is the employer and an in-house attorney may only act in the legal matters of their employer (Section 46(5) BRAO), in our assessment the same is to be expected in a corporate legal department; this has not been expressly decided.
A law firm using project lawyers must bind them to secrecy as contributing persons; failing to do so can be a criminal offence (Section 203(3), (4) StGB). For service providers, Section 43e BRAO requires a contract in text form with a confidentiality obligation.

Switzerland

Since 1 January 2025, a party in civil proceedings may refuse to produce documents of its in-house legal department if that department is headed by a person with a cantonal bar qualification (Art. 167a Swiss Civil Procedure Code). Third persons working in the legal department can rely on it under the same conditions. Whether an interim professional on a staff leasing assignment counts as such a third person has not been decided. The rule does not apply in criminal or administrative proceedings.
In-house lawyers employed by an employer that is not itself registered cannot be entered in the cantonal bar register (Art. 8(1)(d) BGFA, Swiss Lawyers Act). Whether they fall under criminal professional secrecy under Art. 321 Swiss Criminal Code is disputed; do not rely on it, but secure confidentiality by contract.

In practice, privileged work belongs under a qualified head of legal in Switzerland and is often coordinated with outside counsel in Germany.

Banking secrecy and outsourcing at financial institutions

Swiss banks also have to consider banking secrecy. Art. 47 of the Banking Act provides for imprisonment of up to three years or a fine for anyone who discloses a secret entrusted to them as a governing officer, employee, agent or liquidator of a bank. The offence also applies after the employment or mandate ends (Art. 47(4) Banking Act). The Act does not expressly say whether a leased professional is covered as an employee or agent of the bank; the bank should clarify this before the assignment. In practice, banks also bind interim staff by contract and point them to Art. 47.

A separate question is whether an assignment counts as outsourcing. Under FINMA Circular 2018/3, outsourcing exists where a service provider performs a significant function independently and on a permanent basis (margin no. 2). An integrated professional working under instruction on a staff leasing basis does not usually meet that test; a freelancer who takes over a function independently may. This is an assessment; according to FINMA's list of circulars, Circular 2018/3 remains in force, and the institution documents the classification case by case. Decisions to open or close client relationships stay with the bank in any case. Typical assignments in banking are described on the page AML, KYC and financial crime compliance.

Data protection: who is responsible

The controller under the GDPR and the Swiss Federal Act on Data Protection (FADP) remains the company on whose behalf the data is processed. The professional's role depends on the engagement model:

Staff leasing: the professional acts under the authority of the controller and may only process data on its instructions (Art. 29, Art. 32(4) GDPR). In Germany, they are an employee in relation to the hirer (Section 26(8) no. 1 BDSG). The provider itself does not process your company's data in this case; in our assessment, a data processing agreement with it is therefore usually not needed as long as it has no access to that data.
Freelancing: where the professional works in the company's systems and to its specifications, they are usually also a person acting under its authority. Where they process data in their own systems, this can amount to processing on behalf (Art. 28 GDPR; Art. 9 FADP). The distinction needs to be checked case by case.
Switzerland: processing may only be assigned to a processor if no statutory or contractual duty of confidentiality prohibits it (Art. 9(1)(b) FADP). Controller and processor must ensure data security appropriate to the risk (Art. 8 FADP).

Interim professionals need to know the internal reporting route for data breaches. Under the GDPR, a breach must be reported to the supervisory authority within 72 hours; under the revised FADP, the controller reports to the Federal Data Protection and Information Commissioner (FDPIC) as soon as possible where a high risk is likely (Art. 33 GDPR; Art. 24 FADP). Where GDPR and the revised FADP differ in practice is covered in the guide GDPR vs. Swiss FADP.

Access concept: need-to-know, logging, devices

An access concept limits the interim professional's rights to what the task requires and makes access traceable. It should cover:

Roles, not individual rights: one role per task, such as "procurement contract review" or "KYC review segment X", expiring on the last day of the assignment.
Need-to-know: no full access to shared drives or matter repositories; sensitive files such as investigations, HR cases or M&A projects only after approval.
Devices: company laptop or secured remote access, no local storage, USB ports blocked and printing only where needed.
Logging: log access to sensitive personal data and review it by sampling. In Germany, the works council may have a co-determination right over technical monitoring tools (Section 87(1) no. 6 BetrVG).
Remote work: set explicit rules on work location, screen privacy and calls; no documents sent to private accounts.

Example: a Swiss private bank brings in an interim compliance professional for periodic KYC reviews. The professional gets read access to the files of one client segment and write access only in the review tool. Escalations go to internal compliance, and the bank decides on client relationships. Other assignment types are described on the page interim compliance. The steps for the first weeks are summarised in the guide onboarding interim staff.

End of the assignment: remove access, return documents

On the last day all access is disabled and all documents are returned; confidentiality continues. In Switzerland, each party must hand over to the other everything it received during the employment (Art. 339a OR). Under staff leasing that relationship exists with the provider, so the return to the host company should be written into the NDA and the staff leasing agreement.

Disable accounts, VPN, tokens and group memberships on the last day, not after the final invoice.
Hand over open files and document the handover.
Collect devices, badges and paper documents.
Obtain written confirmation that local copies and private notes have been deleted.
Record the continuing confidentiality duty and a contact for later questions.

Limits and risks

Alpinum Solutions provides legal and compliance professionals through staff leasing and freelancing. Alpinum is not a law firm; responsibility for data protection, information security and secrecy stays with the company.
An NDA does not replace an access concept. Most incidents stem from overly broad permissions, not from missing signatures.
Statutory protections such as the right to refuse production under Art. 167a Civil Procedure Code require a specific set-up. Whether they apply in a given case should be checked with the legal department or outside counsel.

Frequently asked questions on confidentiality for interim lawyers

Do we need a separate confidentiality agreement?

Under staff leasing it is usually advisable. The statutory duty of confidentiality under Art. 321a(4) OR is owed to the employer, which is the staffing provider. A personal undertaking directly to the host company gives the company its own claims and can address banking secrecy, AI tools and the return of documents in concrete terms. Under freelancing, confidentiality belongs in the mandate agreement.

May an interim compliance officer see client data?

Yes, as far as the task requires and the access concept allows. The professional processes data on the company's instructions, and the company remains the controller. At Swiss banks, banking secrecy under Art. 47 Banking Act also applies, and the bank should clarify in advance how it binds the professional to it. Access to entire client books without a link to the task is not needed.

Are conversations with in-house lawyers privileged?

Only to a limited extent. In Switzerland, since 2025 a party may refuse to produce documents of its in-house legal department in civil proceedings if the department is headed by a qualified lawyer (Art. 167a Civil Procedure Code). In Germany, in-house attorneys generally have no right to refuse testimony in criminal proceedings (Section 53 StPO). For highly sensitive matters, companies therefore often involve outside counsel.

Who is liable if an interim professional discloses data?

Towards authorities and data subjects, the company remains responsible as controller. Internally, claims against the professional may arise from the employment, mandate or confidentiality agreement and, depending on the model, against the provider. The liability set out in the staff leasing or mandate agreement should be clear before the start.

Next step

Settle the contract, access roles and return process before you review profiles. The assignment can then start without delay.

Last updated: 30 October 2026.

Confidentiality and system access for interim legal and compliance staff