PATTERNPROOF
← Back to blog

Law Firm Data Security: A Practical Guide for 2026

Hand-drawn security and legal record symbols

Law firm data security is the set of safeguards that keeps client information from being disclosed, accessed or lost without authorization. For a US lawyer it is also an ethical duty, not just an IT concern. The practical core is short: know where client data lives, lock down who can reach it, encrypt it, back it up, vet every vendor that touches it, and write a breach plan before you need one.

This guide covers each step in order, with guidance from state bars and the American Bar Association. It also covers a question most firm guides skip: how to handle sensitive evidence that clients, advocates and paralegals bring to you in the first place.

Pattern-proof
Keep Sensitive Evidence Organized
PatternProof links photos, messages, voice notes, and written entries into a timeline, with sharing controlled by you.
Visit PatternProof

TL;DR

  • Confidentiality is a duty under the ABA Model Rules, which require reasonable efforts to prevent unauthorized access to client information. “Reasonable” means documented, repeatable controls.
  • Start with an inventory of client data, then add unique accounts, multi-factor authentication, encryption at rest and in transit, and tested backups.
  • Vendors are part of your attack surface. Vet them before onboarding and review them on a schedule.
  • Write an incident response plan with named responders. After a breach, you may owe affected clients notice.
  • Sensitive evidence (photos, messages, voice notes) needs its own controlled workflow, with sharing limited to what the client approves.

Table of Contents

Why data security is an ethics issue for law firms

Lawyers routinely hold information that people would never give an employer or a bank. The Oklahoma Bar Association notes that lawyers often hold medical information and Social Security numbers, which is why confidentiality is described there as a fundamental legal duty.

The ABA Model Rules state the duty in Rule 1.6©: a lawyer must make reasonable efforts to prevent inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client. The rule does not list technical controls. It asks for reasonableness, and that is judged against the sensitivity of the data and the cost and difficulty of better safeguards.

Two practical consequences follow:

  1. Security is a supervision issue. The Washington State Bar Association’s cybersecurity guide says firms must protect confidential information, maintain technological competence, and supervise staff, and must know which devices access or store client data.
  2. A breach is an ethics event as well as a business event. The State Bar of California treats unauthorized access as something that can compromise confidential client information and trigger remedial duties.

Rules differ by state

Requirements vary by jurisdiction. According to the Oklahoma guide, they can depend on how much personal data a firm holds, where its clients live, and even firm revenue. Many states base their conduct rules on the ABA Model Rules, but the details are local. California’s Formal Opinion 2020-203, for example, interprets California Rules of Professional Conduct 1.1, 1.4, 1.6, 5.1, 5.2 and 5.3, along with sections 6068(e) and 6068(m) of the Business and Professions Code and Civil Code section 1798.82. Check your own state bar’s opinions and any breach-notification statute that applies to your clients.

Start with an inventory of what you hold

You cannot protect what you have not listed. The ABA’s GPSolo magazine suggests identifying client records and case files, correspondence, pleadings and contracts, email and communication tools, research-database credentials, billing and financial systems, cloud storage and collaboration accounts, and proprietary legal tools.

A workable inventory is a simple table with these columns:

Asset Where it lives Who can access it Sensitivity Owner
Case files Document management or cloud storage Matter team High Responsible attorney
Client email Email platform Attorneys, staff High Managing partner
Billing data Accounting system Finance, partners Medium Office manager
Evidence from clients (photos, messages, audio) Varies, often scattered Often unclear Very high Responsible attorney

The last row is where many firms are weakest. Evidence arrives by text, personal email, USB drive and shared links. If it is not on the inventory, it is probably not under any control.

Also list devices. The Washington guide stresses knowing which devices touch client data, and that includes personal phones used to photograph documents or take client calls.

Control who can get in

Accounts and authentication

Every person gets a unique account. Shared logins make it impossible to know who opened a file. The Oklahoma guidance recommends unique accounts and multi-factor authentication, and the State Bar of Michigan checklist goes further, recommending strong passwords or passphrases, a password manager, and multifactor authentication, especially for administrator accounts and remote access.

The Michigan checklist adds several configuration habits worth copying:

  • Automatic logoff after inactivity.
  • Device locking or wiping after repeated failed logons.
  • Controlled administrator privileges, so few people can change settings or add users.
  • Current security software and regular vulnerability assessment, with fixes made promptly.
  • Network segmentation, so a compromised laptop cannot reach everything.

Least privilege in practice

Give each person access to the matters they work on and nothing else. When a paralegal rotates off a case or a contract attorney’s engagement ends, remove access the same day. The Florida Bar’s Recommendation 25-1 lists inadequate access-control review among the vulnerabilities firms should assess. A quarterly review of who can see what takes an hour and catches most drift.

Staff habits

Technology fails when people work around it. The ABA’s Law Technology Today article on a defense-in-depth approach lists ten practices, including a written security policy, continuous staff training, strong passwords, encryption, secure communications, access control, regular reviews, vendor vetting, incident planning and stronger mobile security. Training is the one most firms skip. Short, frequent sessions on phishing and on what not to send over text beat one annual video.

Encrypt, store and back up

Encryption turns a lost laptop or an intercepted file into noise. The Oklahoma guidance says to encrypt data at rest and in transit, and the Florida Bar’s Recommendation 25-1 likewise identifies unencrypted data as a vulnerability to assess and recommends encryption at rest and in transit.

In practice:

  • At rest: turn on full-disk encryption on every laptop and phone, and use storage that encrypts files on the server.
  • In transit: use encrypted email, secure file-transfer protocols or a VPN as appropriate, and avoid public Wi-Fi and other unsecured channels.
  • Sharing: prefer a secure portal with expiring access over an email attachment. Attachments live forever in inboxes you do not control.

Backups that survive ransomware

The Oklahoma guidance recommends regular backups, at least one frequently backed-up copy kept offline, tested restores, and secure deletion of records and backups once the applicable retention period ends. The Michigan checklist is more specific: back up important files at least daily, configure backups so malware cannot immediately compromise them, and test them.

A backup you have never restored is a hope, not a control. Put a restore test on the calendar twice a year and record the result.

Vet every vendor

Cloud storage, email, e-discovery, billing and practice-management tools all hold client data on your behalf. The Oklahoma guidance advises vetting vendors and reviewing them periodically, and the Florida recommendation names third-party security as a vulnerability to assess.

Before signing, ask:

  1. Is data encrypted at rest and in transit?
  2. Who at the vendor can see our data, and how is that access logged?
  3. Can we export everything if we leave?
  4. How and when will you tell us about a breach?
  5. Where is the data stored, and how is it deleted at the end of the contract?

Put the answers in a file. If a regulator or insurer asks what you did to be reasonable, a dated vendor review is concrete proof.

Plan for the breach before it happens

The 2017 ABA article on cyber incident response recommends an incident response plan with named responders and backups, defined roles and overall responsibility, 24-hour contact methods, and documentation of every response step. The response itself runs through identifying and assessing the incident, containing the threat, preventing exfiltration, eradicating malware, restoring network integrity, preserving forensic evidence, and addressing reporting obligations.

On the ethics side, California Formal Opinion 2020-203 says lawyers must take reasonable steps to secure electronic systems and, after a breach, conduct a reasonable inquiry into its extent and consequences. They must notify clients whose interests have a reasonable possibility of being negatively affected. Other states have their own statutes and opinions, so a firm with clients in several states should have counsel map the notification rules in advance.

A one-page plan covers the essentials:

  • Who leads, who is the backup, and how to reach them at 2 a.m.
  • Who calls your cyber insurer, outside counsel and forensic firm.
  • How to isolate affected systems without destroying evidence.
  • A template for client notices, reviewed by counsel.
  • A log, started in the first hour, of every action and time.

Run a tabletop exercise once a year. Ten people in a room with a fictional ransomware note will find gaps no policy review will.

The overlooked piece: sensitive evidence intake

Most security guides stop at the firm’s perimeter. But family-law and domestic violence matters begin with raw material: screenshots, photos of injuries or property, voicemails, journal entries. Clients often hold this on a phone they share with, or that is monitored by, the other party. Once it reaches you, it lands in email threads, shared drives and paper folders.

Three problems recur:

  • Scattered evidence. Items arrive from many channels, and nobody can say which version is the original.
  • Over-sharing. A forwarded folder can expose far more than the matter needs.
  • Rebuilt timelines. Staff retype a chronology from memory and screenshots, which costs hours and loses the link back to the source.

A sound intake workflow does the opposite. It keeps each item tied to its original source, records whether a date is exact or approximate, restricts access by default, and lets the person who owns the information decide what is shared and with whom. Fix the intake and you shrink the number of places client data can leak.

Perspective: privacy by design, not as an add-on

We built PatternProof around one belief: sensitive records should stay private until the person who owns them chooses to share them. Security that depends on everyone remembering to be careful will fail on a bad day. Security built into how information is stored and shared holds up better.

Perspective: privacy by design, not as an add-on

In practice that means a few design choices. Photos, messages, voice notes and written entries sit in one source-linked timeline, so every entry traces to the original. The timeline separates exact dates from approximate ones, because honest uncertainty is more credible than a guessed precision. Storage is encrypted, and sharing is controlled by the user, not by default. Professionals receive material through a review export instead of an open folder.

We also draw a clear line: PatternProof does not make legal determinations. It supports professional review and does not replace the judgment of an attorney. For law firms, the value is less rebuilding of timelines by hand and a cleaner, more traceable record at intake. For clients and advocates, it is a way to keep records private while still being ready when a lawyer asks for them.

— Grace

How PatternProof fits a firm’s security stack

PatternProof is not a replacement for your firewall, your endpoint protection or your breach plan. It addresses one specific gap: collecting and organizing client evidence in a controlled, source-linked way.

For firms, access is by subscription after verification. The Solo Attorney plan is $297 per month and the Firm plan is $897 per month, both listed on the pricing page. The attorney page explains the family-law intake workflow, and the evidence integrity page describes how items stay traceable to their originals. Individuals can use personal accounts at no cost during our founding test cohort, and verified domestic violence organizations can partner with us through the advocate referral page.

Pattern-proof

If you want to see how a controlled evidence timeline would work in your practice, start with the Professional Access page.

Advice for clients and advocates keeping private records

If you are an individual or an advocate preparing records for a lawyer, the same principles apply at a smaller scale:

  1. Check device safety first. If someone else may have access to your phone, email or cloud accounts, assess that risk before storing anything new. Our app safety checklist walks through the questions, and our safety page explains how we approach it.
  2. Keep originals. Do not edit, crop or retype what you collect. Record the date and how you obtained each item.
  3. Mark dates honestly. If you know the day, record it. If you only know the month, say so.
  4. Share narrowly. Give your attorney what the matter needs, not an entire phone’s contents.
  5. Use encrypted storage. Prefer tools that encrypt your records and let you control access over unprotected notes apps or shared folders.

If you are in immediate danger, contact local emergency services or the National Domestic Violence Hotline before doing anything else with your records.

A 30-day starting plan

You do not need a security team to improve this month.

Week Action
1 Build the data inventory and device list. Turn on multi-factor authentication for email, document storage and admin accounts.
2 Enable disk encryption on every laptop and phone. Review who has access to each matter and remove stale accounts.
3 Set up daily backups with one offline copy, and run a restore test. Send vendors the five questions above.
4 Write the one-page incident plan, name responders and hold a short training session. Review how client evidence reaches you.

Revisit the list every quarter and after any staffing change, new vendor or new office.

FAQ

What is the biggest data security risk for a small law firm?

Usually it is a compromised account, most often through phishing, combined with weak authentication. Multi-factor authentication on email, document storage and administrator accounts, plus staff training, reduces that risk substantially, as the state bar checklists recommend.

Do lawyers have to encrypt client data?

The ABA Model Rules require reasonable efforts rather than naming specific tools. State bar guidance, including from Oklahoma and Florida, recommends encryption at rest and in transit. Check your own state bar’s opinions, because requirements vary by jurisdiction.

Must a law firm tell clients about a data breach?

Often yes. California’s Formal Opinion 2020-203 says lawyers must notify clients whose interests have a reasonable possibility of being negatively affected after a reasonable inquiry. Other states and statutes differ, so involve ethics or breach counsel quickly.

How often should a firm back up client records?

The Michigan checklist recommends backing up important files at least daily, with backups configured so malware cannot immediately compromise them. Keep at least one copy offline and test restores regularly.

How should clients share sensitive evidence with their lawyer?

Use a controlled channel that encrypts the material and lets the client decide what is shared, rather than forwarding screenshots by text or email. Send only what the matter needs, and keep the original files unaltered.

Sources

Written with BabyLoveGrowth’s tools