Choosing a CRM for a law firm: confidentiality, conflicts and intake come before pipelines

Why a sales CRM is the wrong starting point

Generic CRMs are built around leads, opportunities and pipelines. They encourage broad visibility of customer information, automated follow-ups and marketing sequences. Some of that is useful for law firms, particularly for business development and events, but the core legal workflow is different.

A person contacting a law firm may disclose confidential and sensitive information before a lawyer has agreed to act. The firm may need to run conflict checks, decline the matter or limit who can see the enquiry. Relationships can also be complex: one client may be connected to many matters, companies, contacts and referrers. A sales pipeline does not capture these realities well.

Intake is where confidentiality starts

The first requirement is secure intake. Website forms, email, phone notes and messaging should enter a controlled system with only the information needed at that stage. Firms should be careful about asking prospects to describe detailed facts before conflict checks are complete.

Intake records should support triage: practice area, urgency, jurisdiction, opposing parties, deadlines and source. Access should be limited to people who need it, and sensitive enquiries should be protected from broad visibility inside the firm.

Minimal first information

Collect what is needed for triage and conflicts before detailed facts.

Restricted access

Limit visibility of sensitive enquiries and matters.

Deadline flags

Identify urgent matters with procedural or statutory deadlines.

Source tracking

Record referral and marketing sources without exposing confidential details.

Conflict checks and matter handover

Conflict checking is often handled in practice management or dedicated systems, but the CRM must connect to it. The names of prospective clients, related companies and opposing parties should flow into the conflict process without re-keying, and the result should control what happens next.

When a matter is accepted, the relevant intake information should move into practice management with the engagement details, while declined enquiries should be retained or deleted according to the firm’s policies. A CRM that keeps every declined enquiry indefinitely and visibly creates unnecessary risk.

Relationships across matters

Business development in law firms depends on relationships rather than transactions. Partners want to know which clients, in-house lawyers, referrers and intermediaries they know, who introduced whom, which events contacts attended and which practice areas the firm has already served for a client.

A good legal CRM connects contacts, organisations, matters, referrals and marketing activity while respecting confidentiality boundaries. Not every fee earner should see every matter, and marketing teams should not see privileged information simply because it helps segment campaigns.

Data location, security and professional rules

Law firms should understand where CRM data is hosted, who can access it, how it is encrypted, how backups work and what happens when the contract ends. Professional secrecy and data protection rules may affect cloud choices and supplier contracts, especially for firms handling sensitive matters or cross-border data.

Integration with email, calendars and AI tools also needs care. Automatic email capture can bring privileged communications into systems not designed for them, and AI features may process data outside the firm’s approved environment. These features should be assessed rather than switched on by default.

Buy, configure or build

Many firms use specialist legal CRMs or practice management systems with relationship features. Others configure general CRM platforms with strict permissions and integrations. Some build lightweight custom intake and relationship tools around existing practice management systems. The right answer depends on firm size, practice areas, existing systems and risk tolerance.

Whichever route is chosen, the evaluation should start with workflows: enquiry to conflict check, conflict check to engagement, engagement to matter, and relationships across matters. Pipelines and marketing automation can be added once the confidential core is right.

Where this sits in what we do

This article covers one decision inside a wider engagement. The solution page sets out how that engagement runs, what it includes and what it costs to find out.

• Custom Business Platform — A platform built around how your business actually runs — customer portal, internal tooling, database and the automation between them.
• When to build software instead of buying it
• The order of operations in a digital transformation
• Company details in business emails and on websites: what German and UK rules require
• Consent mode and marketing measurement in Europe: what you lose, what you keep and what to fix
• All insight articles