Legal

NOvA rules of conduct and file handling for lawyers

6 February 2026 · 8 min read · DeSnipperaar

The legal profession has an ethical regime of its own on top of the general GDPR and Wwft. The duty of confidentiality (Advocatenwet art. 11a), the Bar Regulation (Voda art. 16 on archive access protection) and the rules of conduct of the Netherlands Bar (NOvA) form a layered system in which file management is not an administrative activity but a core part of professional practice. This article covers how those rules play out for archiving and destruction of client files.

Audience: partners, managing partners, compliance officers and secretaries at law firms.

The foundation: confidentiality as the framework

Article 11a of the Advocatenwet imposes on the lawyer a duty of confidentiality for everything entrusted to them in the practice of the profession. That confidentiality continues after the end of the instruction and extends to everyone inside the firm (trainee lawyer, secretariat, IT manager). It has direct consequences for how files are kept and destroyed:

• External parties that could inspect the file must be contractually bound to the same confidentiality.
• Destruction must be carried out so that reconstruction of data is impossible.
• The lawyer bears personal responsibility, even when tasks are delegated.

Retention period: no hard law, but a rule

Unlike WGBO (20 years) or AWR (7 years), the Advocatenwet does not prescribe a specific period. NOvA rule of conduct 16 (old numbering, current with another reference) speaks of careful preservation of the file. In practice most firms apply:

• 5 years minimum: based on Wwft art. 33 for the client due diligence part. See also our article on Wwft 5 years.
• 7 years for financially relevant files: tax interest under AWR art. 52.
• 10 years for standard files: from the perspective of professional liability (civil limitation).
• 20 years for large liability-sensitive cases: longer civil limitation period for hidden defects or inheritance matters.
• Indefinite for certain niches: criminal cases, political asylum cases, hereditary recognition cases.

Firms set a period per case category in the office manual. Uniform "everything 10 years" is neither good professional practice nor GDPR-proof.

What is in the file?

A lawyer's file after end of case contains more than correspondence. For complete archiving and later destruction you must account for:

• Intake and engagement confirmation documents
• Correspondence by post, email, secured messaging
• Procedural documents (writs, conclusions, petitions)
• Court records and judgments
• Contracts in draft and in final form
• Financial settlements (timesheets, invoices, third-party funds statement)
• Wwft documents (identification, UBO)
• Digital files in DMS and email archive
• Audio and video recordings of meetings

Third-party funds account and administration

The third-party funds account falls under Voda with its own administrative duty. Documents relating to third-party funds are typically kept for 7 years, in line with the tax period. Destruction follows the same regime: paper documents via a P-5 shredder, digital documents via controlled purge or mobile destruction of backup tapes.

An unfortunate paper bin outside the office door with file parts in it is more serious in disciplinary terms than a GDPR breach. The rules of conduct are stricter than general law.

Destruction and DIN 66399 for lawyers

Because of confidentiality, most firms choose DIN 66399 P-5 for paper, somewhat above the GDPR minimum P-4. For digital media E-5 or higher. See our explanation of DIN 66399 P levels for the background.

Practice:

1. Check per file whether the period has passed.
2. Verification by a second partner or compliance officer.
3. Physical separation of files to be destroyed in a secured room.
4. Mobile destruction at the office. The file does not leave the premises intact.
5. Certificate noting DIN P-5, count, weight, date, witness.
6. Filing of the certificate in the office administration system for at least 5 years.

Processor agreement with the destruction party

For lawyers the processor agreement is crucial. Not because the GDPR requires it (although it does), but because you reinforce your duty of confidentiality through contractual binding. Minimum content:

• Reference to Advocatenwet art. 11a
• Duty of confidentiality for all staff involved
• Certificate of Good Conduct (VOG) for staff working on site
• Audit right for the lawyer
• Direct duty to report loss or irregularity
• Destruction method and DIN level
• Liability on breach

See our article on the processor agreement checklist for a complete 13-point list.

Digital files

Almost every firm works with a DMS (Dikke, Epona, Basenet, Clio, iManage). The retention period applies to the digital version as well. After the period:

• Deletion via DMS with audit trail
• Purge of backup copies on tape or in the cloud
• Deletion from the email archive
• Physical destruction of old HDDs and tapes (see HDD wipe vs destruction)

The biggest miss: someone removes a file from the DMS but not from the email archive. All your correspondence with clients sits in email. Without cleaning that up the file has not been destroyed.

End of practice and takeover

If the lawyer or firm stops, files must be transferred, archived or destroyed. Voda and NOvA provide the deken protocol for unforeseen circumstances. Many firms work with a deken-approved archive partner that takes over files. Destruction at the end of the retention period is then carried out by that party, with certificate.

Disciplinary risks

The Court of Discipline has repeatedly ruled on careless archive management. Three constants:

1. File parts on the street or in old paper leads to reprimand or suspension.
2. Missing protocol for retention and destruction is "deficient office organisation" (art. 10a Advocatenwet).
3. Outsourcing to an unbound party without a confidentiality contract breaches art. 11a.

The disciplinary judge looks not only at the incident, but at the system behind it. A solid destruction certificate is evidence of a careful system.

---

Get the firm's archive in order? Call us or request a quote via desnipperaar.nl. We have a standard processor agreement ready, written specifically for law firms, referring to art. 11a.