Friday, four in the afternoon. The firm’s front office receives an email from a “client” asking for an urgent change of the account for the return of a deposit, while the partner handling the matter is in court. At the same time, a trainee leaves a laptop with a full copy of the case files on a train. The scenario is hypothetical, but both events touch the same problem: a law firm processes information covered by professional secrecy as well as personal data, and their security depends on simple, repeatable habits and system settings.
This checklist organises those habits into areas that a managing partner or the person responsible for IT can go through point by point. Each section starts with a short explanation of why the area matters and ends with a checklist to tick off. Where an obligation comes from legislation, we give the legal basis and a link to the source text.
Why does a law firm need its own cybersecurity checklist?
A law firm has two independent sources of obligations. The first is professional secrecy: under Article 6 of the Polish Law on the Bar, an advocate is obliged to keep secret everything learned in connection with providing legal assistance, and this obligation cannot be limited in time. Article 3 of the Polish Act on Legal Advisers contains equivalent wording for legal advisers.
The second source is the GDPR. Article 32 requires the controller to implement appropriate technical and organisational measures and gives as examples, among others, the pseudonymisation and encryption of personal data, the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems, and the ability to restore the availability of data in a timely manner after an incident.
None of these provisions lists specific products. That is why a firm has to translate them itself into system settings, procedures and evidence that the safeguards work. The checklist below is such a translation — it starts with the measures that have the greatest impact on the risk of losing confidentiality.
It is also worth remembering that professional secrecy does not expire when a case is closed. Archives, old mailboxes and backups need the same protection as current files.
How to protect a law firm’s data with encryption?
Encryption protects data when other safeguards fail: when a laptop is stolen, a disk is replaced during servicing or a backup falls into the wrong hands. The GDPR explicitly lists the encryption of personal data among example measures for the security of processing, so its absence will be hard to justify after an incident.
In a law firm, encryption needs to be considered in four places: on endpoint devices, in email, in the document management system (DMS) and in backups. The last point is easy to overlook, because the backup “sits in a cupboard” or with a cloud provider.
- Full-disk encryption on all laptops and desktops, with recovery keys stored centrally.
- Encryption of removable media or a ban on using them to carry case files.
- Encrypted connections to mail servers and an agreed way of sending confidential documents to clients (e.g. encrypted attachments with the password sent through another channel).
- Encryption of data in the DMS and in file repositories, also at the cloud provider.
- Encryption of backups and control over who has access to the keys.
An overview of methods and tools is available in our article on data encryption in business.
How to control access to case files and the firm’s systems?
Getting to a law firm’s data does not require a sophisticated attack — a compromised password is enough. Multi-factor authentication (MFA) means that a password alone is not enough to log in to email or the document system. The second pillar is the principle of least privilege: an employee sees the files of the matters they work on, not the firm’s entire database.
Administrator accounts and access for external IT companies need separate attention. They give full control over systems, so they should be logged, time-limited and reviewed. PAM-class systems make it possible to grant such access only for the duration of a task.
- MFA for email, the DMS, accounting systems and remote access (VPN, remote desktop).
- Access to files granted per matter or team, not by default to the entire repository.
- Separate administrative accounts and PAM for administrators and IT providers.
- Review of permissions in an agreed cycle and after every change in the matter team.
- Leaver procedure: account lock, return of devices and handover of the mailbox on the same day.
How to monitor systems and detect data leaks?
Preventive safeguards will not stop every incident, so a law firm needs a way to notice quickly that something has gone wrong. DLP (data loss prevention) solutions detect and block documents being sent outside the organisation, for example mass forwarding of case files to a private mailbox.
The second layer is collecting and analysing logs: sign-ins, permission changes, unusual downloads from the DMS. A small firm rarely has a team that reviews this data continuously, which is why it often relies on monitoring provided by an external SOC.
- DLP for email and the cloud with rules for documents marked as confidential.
- Central log collection from email, the DMS, the domain controller and the firewall.
- Alerts for unusual events: sign-in from a new country, mass file downloads, mail forwarding rules.
- A designated person or service (SOC) that responds to alerts also outside working hours.
How to prepare backups and recovery after an incident?
Among security measures, the GDPR lists the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident. For a law firm, this means that procedural deadlines cannot depend on whether a server can be decrypted after a ransomware attack.
A backup is only valuable if it survives an attack and data can be restored from it. That is why at least one copy should be separated from the firm’s network, and restoration should be tested regularly on real data.
- Backups of email, the DMS and network drives performed automatically.
- At least one copy separated from the production network or immutable.
- A test restore of selected files and of a whole system, with the result recorded.
- A written order for restoring systems and a list of people who decide on it.
The design and maintenance of such a solution is covered by our backup and disaster recovery service.
How to protect a law firm’s email and payments against BEC?
Business email compromise (BEC) attacks consist of impersonating a client, a counterparty or a partner of the firm and persuading an employee to make a transfer or change an account number. In a law firm, the risk concerns in particular settlements with clients and correspondence in transactional matters where payment details appear.
An effective defence combines technology and procedure. The technology is email domain authentication (SPF, DKIM, DMARC) and tagging of external messages. The procedure is the rule that every change of an account number is confirmed by phone at a number known in advance, not one given in the email.
- SPF, DKIM and DMARC records for the firm’s domain, with a DMARC policy that is enforced, not just monitoring.
- Tagging of messages from outside the organisation and warnings about domains similar to the firm’s domain.
- Verification of every change of payment details through a channel other than email.
- A four-eyes rule for transfers from deposit accounts and refunds of advance payments.
We describe the attack mechanics and defence strategy in more detail in our article on business email compromise.
Which GDPR and professional secrecy obligations are worth ticking off?
A law firm is the controller of the personal data of clients, employees and third parties appearing in matters. The GDPR requires the controller to use only processors providing sufficient guarantees to implement appropriate technical and organisational measures. This applies to IT providers, cloud providers, practice management systems and accounting offices.
Article 32 of the GDPR also requires a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures. A checklist without verification is therefore only a declaration — you need evidence that the safeguards have been checked.
- Data processing agreements with every provider that has access to the firm’s data.
- Assessment of cloud and software providers in terms of where data is processed and how it is protected.
- Documented tests of the effectiveness of safeguards (reviews, penetration tests, restore tests).
- A register of personal data breaches, kept also for events not notified to the supervisory authority.
- Rules for working with AI tools that take professional secrecy into account — we discuss them in our article on AI, GDPR and ethics in law firms.
What should a law firm do after detecting an incident?
An incident response (IR) plan should be created before the incident. In a crisis, nobody has time to establish who decides on disconnecting a system, who talks to clients and who assesses the notification obligations.
The latter come directly from the GDPR. Under Article 33, the controller notifies the personal data breach to the supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. In Poland, the supervisory authority within the meaning of the GDPR is the President of the Personal Data Protection Office, as provided by Article 34 of the Polish Personal Data Protection Act. If the breach is likely to result in a high risk, Article 34 of the GDPR also requires the data subjects to be informed.
The controller documents any personal data breaches, comprising the facts, the effects and the remedial action taken. This documentation also helps with clients, who will ask what happened to their information.
- A written IR plan with roles, contacts and escalation criteria.
- A template for assessing a personal data breach and notifying the supervisory authority.
- An agreed contact with an incident response team and with the insurer, if the firm has a cyber policy.
- An exercise of the plan on a scenario, e.g. a takeover of a partner’s mailbox.
How to train a law firm’s team in cybersecurity?
People are the first line of defence against phishing and BEC, but also a source of mistakes. Training works when it concerns real situations from the firm’s work: fake correspondence from a court, a request to change an account, an attachment “from a client”.
Training alone does not show whether the team will recognise an attack. That is what controlled phishing simulations are for: they show who clicked, who reported the message and where the procedure failed.
- Induction training for every new person, including trainees and front-office staff.
- Periodic reminders based on examples from current phishing campaigns.
- Phishing simulations with a review of the results.
- A simple way to report suspicious messages, without fear of consequences for a click.
How to check whether the checklist works in practice?
A ticked list is not proof of security. The proof is the result of verification: a configuration checked by someone outside the IT team, a test confirming that backups can be restored, and a penetration test that checked whether the safeguards can be bypassed.
The table below helps set the order of actions. The first column shows the area, the second the minimum step worth starting with, and the third the evidence that can be shown to a client or an auditor.
| Area | First step | Evidence for a client or auditor | Basis |
|---|---|---|---|
| Access | MFA for email and the DMS | Report on account configuration and exceptions | GDPR Article 32 — confidentiality of systems |
| Encryption | Full-disk encryption on laptops | Report from the device management system | GDPR Article 32 — encryption of data |
| Backups | A copy separated from the network | Restore test record | GDPR Article 32 — restoring availability |
| Email and payments | Verification of account changes | Written procedure and verification log | Protection of client funds |
| Providers | Data processing agreements | List of providers with agreements | GDPR Article 28 |
| Incidents | IR plan and breach register | Result of a plan exercise | GDPR Articles 33 and 34 |
| Verification | Audit and penetration test | Report with recommendations and a remediation plan | GDPR Article 32 — regular testing |
nFlo performs security audits and penetration testing, which provide such evidence and show which points of the list need improvement first.
Key takeaways
- Professional secrecy covers everything an advocate or legal adviser learned in connection with legal assistance and does not expire over time — it also applies to archives and backups.
- The GDPR names encryption, resilience of systems, data restoration and regular testing of safeguards as example security measures.
- MFA and full-disk encryption are the first steps with the greatest impact on risk.
- A change of account number always requires confirmation through a channel other than email.
- The incident response plan must cover notifying the supervisory authority of a breach within the deadline set in Article 33 of the GDPR.
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
