Law firms manage highly sensitive client data and are bound by professional confidentiality – a successful attack is not just an IT problem but a liability case. The good news: the most effective protections are not big projects. These are the five things I implement first with law firm clients. After that, I outline the IT duties that German professional rules and the GDPR place on a law firm.
1. Enable two-factor authentication everywhere
Stolen passwords are the most common entry point for attackers. With a second factor – an app confirmation or a hardware key – a stolen password becomes largely worthless. Prioritize email accounts, Microsoft 365, your practice management software and the VPN. It takes a few hours; the security gain is enormous.
Want to tackle this in your company?
Send me a short message or give me a call. I'll get back to you within 24 hours on weekdays.
2. Apply updates consistently and promptly
Most successful attacks exploit vulnerabilities for which patches have long existed. Windows, legal software, browsers, routers and NAS systems need a fixed update routine – ideally automated and monitored so no device slips through.
3. Back up following the 3-2-1 rule
Modern ransomware deliberately encrypts reachable backups too. So: three copies of your data, on two different media, one of them off-site and disconnected from the network. Equally important: test your restores regularly. A backup that has never been tested is just a hope.
4. Train your team against phishing
The best technology won't help if a convincing 'client email' triggers a click. Short, regular trainings with real examples reduce click rates drastically. What matters is a culture where suspicious messages are reported immediately and without blame.
5. Review encryption and access rights
Notebooks and smartphones should be fully encrypted (BitLocker ships with Windows Pro), and client communication by email should at least use transport encryption. Internally, apply the need-to-know principle: not everyone in the firm needs access to every file. Clean permissions limit the damage if an account does get compromised.
Which IT duties apply to a law firm in Germany?
The five measures above are good practice. For law firms, some of them are simply mandatory, because professional rules, criminal law and data protection law all place concrete requirements on IT. The overview below looks at the key provisions from an IT perspective; it does not replace a legal assessment of your specific case.
- Confidentiality (Section 43a(2) BRAO, Section 203 StGB): The duty of confidentiality covers everything you learn while practising law, which includes every file on the server and every email in the mailbox. You must bind your staff to confidentiality in text form and inform them of the criminal consequences of a breach. Disclosing a client secret without authorisation is a criminal offence under Section 203 of the German Criminal Code.
- External IT providers (Section 43e BRAO, Section 203(3) and (4) StGB): Since a 2017 reform, Section 43e of the Federal Lawyers' Act sets out when you may give service providers such as IT support, remote maintenance or a cloud provider access to client secrets: only as far as their service requires it. You must choose the provider carefully, and the contract has to be in text form. It must bind the provider to confidentiality with a notice of the criminal consequences, limit access to what is necessary and state whether they may bring in other people such as subcontractors. If the service is provided abroad, secrecy protection there must be comparable to German standards. If this commitment is missing and someone involved later discloses a secret, Section 203(4) StGB can make you criminally liable as well.
- Security of processing (Art. 32 GDPR): The GDPR requires technical and organisational measures that are appropriate to the risk and take the state of the art into account. It explicitly mentions encryption, the ability to restore data quickly after an incident and a process for regularly testing how effective the measures are. If an IT provider can access personal data during maintenance or remote support, German data protection authorities treat this as processing on your behalf, which also requires a data processing agreement under Art. 28 GDPR.
- beA (Section 31a(6) BRAO, Section 130d ZPO): Since 2018, you have had to keep the technical equipment for your special electronic lawyer's mailbox (beA) ready and take note of documents served through it. Since 2022, lawyers have generally had to file written submissions with the courts electronically, under Section 130d of the Code of Civil Procedure for civil cases and under similar rules in other types of proceedings. If the technology fails temporarily, filing by conventional means is still allowed, but you have to substantiate the outage. A card reader that stops working on the day a deadline expires is therefore more than an IT problem.
What this means for day-to-day IT in a law firm
These duties translate into a few fixed routines. The five measures above already cover much of it; the rest is organisation and documentation, which is part of any ongoing security support anyway.
- Have a confidentiality agreement under Section 43e BRAO and a data processing agreement in place with every IT provider that touches your systems. That includes remote maintenance, cloud storage and support for your practice management software.
- Bind all staff to confidentiality in text form, including trainees and temporary help, and keep the declarations on file.
- For cloud services, check where the data is processed and which subcontractors are involved.
- Test the beA on every workstation where deadlines are handled: card or software certificate, card reader, an up-to-date beA Client Security, and permissions for staff and substitutes. And decide who checks the inbox every day.
- Document your technical measures and review them regularly, for example once a year; Art. 32 GDPR explicitly names such a process. The free IT security check with ten questions gives you a first overview.
In most firms these five measures can be implemented within days and cover the most common attack paths. If you want to know where your firm stands, I offer a compact assessment and prioritize measures by risk and effort.