Document review for law firms: staffing, process and quality

Short answer: A law firm organises a large document review project around four roles: first-level reviewers code documents against a written review protocol, second-level reviewers resolve borderline and privilege questions, quality control (QC) checks samples, and a review lead from the firm directs the team and makes the calls. Before the start come the protocol, calibration on a shared sample and controlled access. In Germany, project lawyers placed through temporary agency work only work in the back office (Federal Court of Justice, judgment of 20 March 2023, AnwZ (Brfg) 12/21).

This guide is for partners, counsel and legal operations leads in law firms in Germany and Switzerland. It explains how to build a document review team at a law firm: triggers, roles, protocol, quality control, confidentiality and the limits set by professional rules.

Typical triggers: due diligence, investigations, mass claims, regulatory requests

Document review is worth running as a separate project once a document set is too large for the core matter team to review alongside the matter. Typical triggers:

• Due diligence: reviewing data room contracts for change of control, exclusivity, liability or termination rights.
• Internal investigations: reviewing emails and files after a whistleblower report or a suspicion.
• Mass claims: similar case files that need to be captured and assessed against consistent criteria.
• Regulatory and production requests: for example in competition or supervisory proceedings, or as eDiscovery in foreign proceedings.
• Contract remediation: amending large numbers of contracts to meet new regulatory requirements.

What all triggers have in common: the legal assessment stays with the firm. The review team delivers consistently coded documents, documented escalations and traceable QC results. How law firm, forensics and review team share the work in investigations is covered in the guide internal investigations; assignments in disputes are described on the page litigation, investigations and eDiscovery.

The team and the ratio of roles

A review team consists of first level, second level, QC and a lead; the ratio of roles depends on volume, complexity and error rate. The table shows tasks and qualifications.

How many reviewers does the project need?

Team size follows from document volume, throughput and deadline. The formula: documents ÷ (documents per hour × productive hours per day) = first-level person-days. Example with assumptions: 60,000 documents after culling, 50 documents per hour and 7 productive hours give around 171 person-days. With eight reviewers that is just over four weeks, plus time for QC and second level. Measure throughput yourself in the pilot; it varies widely with document type and language.

Review protocol, coding and calibration

The review protocol is the project's most important document: it defines what is reviewed, how it is coded and when to escalate. At a minimum it contains:

• review questions, date range and the permitted document set
• coding fields such as relevant, not relevant, hot, privileged, confidential, personal data, foreign language, technical issue
• definitions with examples for each category
• escalation triggers and who answers them within what time
• rules for families (emails with attachments), duplicates and drafts
• handling of personal data and sensitive data

Calibration before ramp-up

1. Lead and second level code a shared sample as the reference.
2. All first-level reviewers code the same sample.
3. Discrepancies are discussed and the protocol is sharpened.
4. Only then are batches assigned at full volume.
5. In the first days, QC re-checks a high share; later, a risk-based sample.

Metrics for steering

• throughput per reviewer per day, split by document type
• discrepancy rate between first level and QC
• open escalations and their age
• remaining volume and forecast to the deadline

Professional secrecy, data protection and access

The firm must bind everyone who works on the review to confidentiality. In Germany, a lawyer must bind employed and contributing persons to confidentiality in text form and inform them of the criminal consequences (Section 43a(2) BRAO). Failing to do so for contributing persons can be a criminal offence (Section 203(4) StGB). For external service providers such as review platforms, Section 43e BRAO requires a contract in text form with a confidentiality obligation. In Switzerland, criminal professional secrecy covers lawyers and their auxiliaries (Art. 321 Swiss Criminal Code).

A review almost always involves personal data of employees, customers or third parties. In Switzerland, processing must be proportionate and limited to its purpose (Art. 6 FADP); in the EU the GDPR applies. Transfers for foreign proceedings follow their own rules: from Switzerland, disclosure abroad is allowed if the Federal Council has found that the destination offers adequate protection or if appropriate safeguards are in place (Art. 16 FADP); by way of exception, also where it is necessary to establish, exercise or enforce legal claims before a court or another competent foreign authority (Art. 17(1)(c) FADP). Transfers from the EU are governed by the GDPR rules on third countries (Chapter V). Clarify this with data protection and the law firms involved before any export. From a Swiss perspective, since 15 September 2024 the United States counts as adequate only for companies certified under the Swiss-US Data Privacy Framework (Annex 1 of the Data Protection Ordinance).

• access only through the review platform, with no download or print rights for first level
• roles per batch, expiring at project end
• defined work location and devices, including for remote review
• close-out with disabled accounts and documented return

How to set up contracts and access for interim staff is covered in the guide confidentiality and access for interim staff.

Project lawyers at the firm: what the BGH ruling on temporary agency work means (Germany)

Project lawyers placed through Arbeitnehmerüberlassung (German temporary agency work) may work on a review at a German law firm but may not act externally as attorneys. In 2023 the Federal Court of Justice held that a lawyer placed by a non-lawyer staffing provider who is to act externally at the firm can be admitted neither as an attorney nor as an in-house attorney. Back-office work is unobjectionable under professional rules (margin no. 75).

For a review project, this means:

• leased project lawyers code, annotate and draft privilege logs and summaries
• letters to courts, authorities or opposing parties are signed by the firm's admitted lawyers
• the contract expressly designates the arrangement as temporary agency work and names the individuals before the assignment (Section 1(1) sentences 5–6 AÜG); equal pay applies in principle from day one (Section 8 AÜG)
• where there is a works council, it must be involved before the assignment (Section 14(3) AÜG)

Switzerland has no equivalent decision. The staffing provider needs a cantonal licence (Art. 12 AVG, Swiss Recruitment Act), and there is no statutory maximum assignment period. When freelance lawyers or fixed-term employment fit better is covered in the guide capacity crunch at your law firm.

Limits and risks

• Alpinum Solutions provides law firms with individual project lawyers and review teams through staff leasing and freelancing. Alpinum is not a law firm; direction, assessment and responsibility towards the client stay with the firm.
• A review without a protocol and calibration creates rework. Time spent on the pilot pays off.
• Throughput figures from other projects are only indicative. Plan with your own pilot data.
• Platform, hosting and data transfers are separate decisions for the firm or the client.

Frequently asked questions on document review at law firms

May leased project lawyers act externally at a German law firm?

No. Following the Federal Court of Justice judgment of 20 March 2023 (AnwZ (Brfg) 12/21), acting externally as an attorney is incompatible with placement through temporary agency work; the employer is the staffing provider, not the firm. In the back office, meaning review, research and drafting, the assignment is unobjectionable. Anyone who needs to act externally should be engaged as a freelance lawyer or employed directly by the firm.

How quickly can a review team be put together?

At Alpinum, selected profiles are usually available within 48 hours; the firm and Alpinum agree the start date together. The start usually depends on conflict checks, confidentiality undertakings, contracts and platform access. A ramp-up in waves works well: first project manager and QC, then a small pilot, then the full team.

Which languages are needed?

That depends on the document set. A language analysis on the platform before team planning shows the distribution. In Germany and Switzerland, German and English are standard; in Switzerland, French and Italian are often added. For rare languages, one second-level reviewer or targeted translation of relevant documents is often enough.

Can a review be done remotely?

Yes, if the platform allows it and access, devices and work location are regulated. Common safeguards are access without download, secured devices and clear rules for calls. For calibration and the first days, a joint session on site or by video helps the team share the same understanding of the protocol.

Next step

Tell us the data volume, languages, review depth, platform, timetable and subject-matter contacts. Confidential case data should only be shared through approved channels.

• Project lawyers for law firms
• Litigation, investigations and eDiscovery
• Internal investigations: choosing the right support
• Discuss your needs

Last updated: 30 October 2026.