Every financial firm moves sensitive documents back and forth with clients - tax returns, statements, IDs, the occasional thing nobody should ever email. Most still email them anyway. A client portal is the usual answer, but the options range from free to absurd, and the right one for a three-partner practice is rarely the one being pitched. Here is how to think about it.
Emailing a client's tax return feels normal because everyone does it, which is precisely the problem. Email is sent in the clear more often than people assume, forwarded without thought, left sitting in inboxes for years, and addressed to the wrong person with one autocomplete slip. For a firm holding financial detail and identity documents, an attachment is a small breach waiting for a bad day. None of this is hypothetical - misaddressed email is one of the most common ways personal information leaks, and you are handling exactly the sort of information people care about losing.
A client portal is just a secure, logged space where you and the client exchange files instead of emailing them. The value is not glamour - it is that documents sit behind a login rather than in a dozen inboxes, that you can see what was shared and when, and that a client uploading their own records does so somewhere controlled. It also quietly raises how the firm looks: asking a client to log in to a portal signals that you take their information seriously, which is the same impression the rest of your online presence should be giving.
Here is the part most vendors will not lead with: you likely already have a portal and are not using it. The practice software most NZ firms already run - Xero, and the document and workflow tools that sit around it - includes secure client portals as a standard feature. Turning on what you already pay for is almost always the right first move. It keeps documents in the system where the work already happens, it is built for exactly this, and it costs nothing extra. Before you evaluate a single standalone product, find out what your existing stack already does.
If your practice software genuinely cannot do it, there are dedicated secure file-sharing tools that bolt on cleanly, and they are inexpensive. A fully custom portal built into your website is a different proposition - more expensive, more to maintain, and another thing handling client data that has to be secured and kept patched. For the overwhelming majority of small firms it is the wrong answer, sold to people who did not realise the cheaper one existed. Custom only earns its place when you have a genuinely unusual workflow, and even then, ask hard why the off-the-shelf options will not do.
It is worth being clear about one thing, because it trips firms up: your website is usually not the portal. The website's job is to be the front door - a clear, prominent 'Client Login' link that sends people to whichever secure system you have chosen. The portal itself lives in your practice software or the dedicated tool, behind its own authentication, maintained by people whose job is security. Trying to build the actual document exchange into a brochure website is how firms end up with a half-secured login bolted onto WordPress. Link to the portal; do not become one.
Whatever you choose, the Privacy Act 2020 is the backdrop, and it is not onerous so much as unavoidable. You are obliged to keep personal information secure and to be careful about where it is stored, including offshore - which is worth checking with any cloud tool, as the Privacy Act article sets out in more detail. The practical reading for a small firm is simple: prefer a reputable provider that is clear about where data lives, turn on the security features you are paying for, and make the secure path the easy path so clients actually take it. A portal nobody uses because email is simpler has solved nothing.
The goal is not the fanciest portal. It is a sensible, defensible way to move sensitive files that your clients will actually use and you can actually maintain. For most small NZ firms that already lives inside the software they own. Turn it on, point to it clearly, and stop emailing things that should never have been attachments.
