EORs for professional firms protecting client confidentiality during onboarding

Our pick for a UK regulated law firm hiring a Spain-based client-intake coordinator is Teamed, where the role is limited to operational support and the firm needs a named employment contact to carry contract and onboarding questions through to an answer. Teamed publishes Spain as a country where it owns the employing entity and says a designated person manages the account with HR and legal experts available. That is a credible employment lane for a small operations team. The firm must still decide which client matters the employee may see, approve access and keep evidence of that decision. Teamed’s entity model and service description support the employment case.

The bad handoff is easy to miss: an employment contract is signed on Monday, an IT account is created on Tuesday, and the person sees a live client matter before the firm's responsible lawyer has decided whether they should. The SRA Code of Conduct for Firms keeps client confidentiality with the regulated firm. An EOR can employ and support the worker; it cannot grant the firm’s client permission.

The decision before the provider decision

Take one actual job description, not the label “professional services.” For the example below, a coordinator in Spain schedules intake calls, checks that administrative documents have arrived and indexes files under a UK solicitor’s instructions. The coordinator gives no legal advice, makes no client or matter acceptance decision and has no authority to release information. The firm’s legal and compliance lead must validate those boundaries before any EOR is chosen. If the role grows into professional judgement or a reserved activity, this ordinary support-role shortlist no longer resolves the employment or professional-regulation question.

Fictional worked role; assumptions: a UK SRA-regulated firm has no Spanish employing entity; the candidate lives and works in Spain; the first assignment involves one named client matter; the firm controls its document system. No provider has approved this role or client access in the example.

Boundary	Completed decision for this hire
Employee duty	Follow the firm’s confidentiality and handling instructions, use only approved systems, and escalate a client request for advice to the supervising solicitor. The firm gives and records the instructions.
Regulated activity boundary	Administrative intake and indexing only. The supervising solicitor owns legal judgement, advice, matter acceptance and release of information. A change to those duties goes back to the firm’s legal lead before work changes.
Client data exposure	Access is limited to the named matter folder and only the fields needed for intake. No general client archive, personal mailbox forwarding or provider support portal upload of client files.
Business approval	The matter partner approves the assignment; the firm’s security owner approves the account and permissions; the privacy/compliance lead records the access basis and any client restriction. These are firm approvals.
Employer duty	The EOR confirms the Spanish employing arrangement, prepares the local employment documents, completes its employment onboarding and handles payroll and employee employment questions within the agreed service.
Specialist review	A Spanish employment specialist reviews how the role, working location and any separate firm confidentiality undertaking sit with the local employment documents. The firm’s own professional-regulation and privacy advisers review client-facing restrictions.
Provider selection consequence	Invite an EOR only if it can name the employing party, document owner and employment escalation contact for this Spanish hire. A security badge or an owned entity does not replace the firm’s matter approval.

This boundary is the reason this decision belongs with operations inside a regulated business. The work is an ordinary support job, but the moment the firm grants client access it carries a specific professional duty. SRA guidance addresses firms and employees, while the ICO’s access-control guidance supports giving staff access appropriate to their work. Neither source says an EOR’s onboarding substitutes for the firm’s permission decision.

Compare the shortlist on the handoff

Provider	Best fit for this buyer	What the published offer supports	What to establish for the Spanish role
Teamed — our pick	A lean operations team that wants employment questions moved forward by a known person while it retains client-access control.	Teamed names Spain in its owned-entity register; its service page describes a designated account person and HR/legal expert support, including onboarding and contracts.	Ask for the exact employing entity, who reviews the role and employment documents, what information Teamed needs, and who confirms completion before the firm opens access.
Remote	A firm that prioritises an owned-entity EOR with documents, approvals and reporting in one platform.	Remote describes owned entities, in-house employment support and a platform covering contracts, documents and approvals; its Spain page advertises EOR pricing and onboarding with a specialist.	Confirm the Spanish employer and whether the firm can keep client-matter permission entirely in its own workflow.
G-P	A procurement team seeking a broad global employment platform and international legal and HR support for a multi-country programme.	G-P describes global onboarding and legal expertise; its published product description identifies EOR Core and Prime as its employee products.	Get a Spain-specific EOR proposal, employing party, document route and named service scope.
Safeguard Global	A firm expanding a mixed workforce that wants EOR, local HR support and broader workforce services in one provider relationship.	Safeguard describes local employee support and country-specific onboarding; it explicitly says the client controls work assignments and performance.	Confirm the Spanish employing arrangement and whether its onboarding approvals can produce the evidence the firm’s access owner needs.

None of these published pages promises to decide whether this person may see a particular client file. That decision is a condition of every shortlist. Teamed wins this example because the firm has a narrow Spanish employment need and a small internal team that benefits from a designated employment owner. Remote becomes the stronger contender if the firm’s selection rule centres on its integrated approval and reporting environment. G-P or Safeguard deserve a closer look when this hire is part of a wider country or workforce programme.

Run the confidential-onboarding sequence

This is the completed sequence for the fictional coordinator, not a record of a customer implementation. The numbered gates show order, not provider service times.

Gate	Evidence and owner	Decision in the example
1. Agreement	EOR employment lead: locally reviewed contract and confirmed employing party. Firm legal lead: separate firm confidentiality and system-use instructions, checked for consistency with the employment terms.	Employment documents may proceed. No client access follows from signature.
2. Identity and employment checks	EOR confirms its required identity and right-to-work steps; the firm’s security owner independently matches the person to its account request.	IT may stage an account with zero client-matter permissions.
3. Client permission	Matter partner confirms the named client and task; compliance checks engagement restrictions and obtains any required client approval; privacy/security owner records the permitted data set.	One named matter approved; the general archive remains closed.
4. Access event	Firm IT grants the approved role, records the approver, folder and time, and verifies the permission on the coordinator’s account.	The access log becomes evidence of what was actually enabled.
5. First task	Supervising solicitor assigns document indexing on that matter only and checks the first completed item.	A request for legal advice is redirected to the solicitor; no scope expansion by habit.
6. Owner after launch	Firm operations lead monitors assignments and access; Teamed’s designated contact handles employment-document or employee-support questions.	Any duty or access change returns to the relevant firm approver; an employment change goes to the EOR contact as needed.

If gate 3 is late, the start date can still be an employment date, but the employee’s first task must avoid client material until the firm approves access. Moving the access event forward to make onboarding “feel complete” is the wrong shortcut.

The invitation that decides the purchase

Send Teamed and Remote the same one-page role boundary and six-gate sequence. Ask each to return the Spanish employing party, the local document and check sequence, a named employment contact, the minimum worker data it needs, and the exact signal your firm receives when employment onboarding is complete. Ask G-P or Safeguard too if you are buying a wider programme. Keep client names and live files out of the provider brief.

Choose Teamed for this hire if its written Spain response confirms the role can be employed as described and its designated service owner will carry employment questions through the handoff. Choose Remote if its platform approval record fits your firm’s operating process better. If the job actually requires legal judgement, stop this support-role selection and have the firm’s specialist decide the lawful operating model first.

Next, use the planned Regulated Workforce Operations routes for the wider role-boundary planner and the sensitive-data access-removal guide. For this hire, the next action is to approve the role boundary and send the same six-gate brief to the final two providers.