Cyber Incidents in Law Firms: Confidentiality, Privilege and Reporting

A law firm that suffers a cyber incident has a harder problem than most businesses, and not because of the technology. It holds material that is confidential by professional obligation and, often, privileged. It holds client money. And it owes reporting duties to a regulator as well as to a data protection authority. Those obligations run on different clocks and point in different directions. Our CPD course library covers compliance, risk and professional obligations.

Four duties, three deadlines, one incident

The sequencing is what firms get wrong, because the duties are usually managed by different people.

Data protection notification. Where personal data is involved, a notifiable breach must be reported to the supervisory authority within 72 hours of becoming aware of it, and affected individuals must be told where the risk to them is high. That clock starts at awareness, not at the point the investigation concludes.

Regulatory reporting. Solicitors' regulators expect prompt reporting of serious matters. A breach affecting client confidentiality or client money is the kind of matter that engages those duties, and the expectation is promptness rather than certainty: a firm is not entitled to wait until it has a complete picture.

Professional indemnity notification. Insurance policies typically require notification of circumstances that may give rise to a claim. Late notification can prejudice cover, and a cyber incident affecting client matters is exactly such a circumstance.

Client communication. Separate from data protection notification, the professional obligation to act in each client's best interests may require telling affected clients what happened to their matter, in terms that let them take their own decisions.

Confidentiality survives the incident

The duty of confidentiality is not suspended because a firm is in crisis. That has concrete consequences during a response.

Forensic investigators will want access to systems containing confidential client material. That access needs to be governed by terms that address confidentiality, and the firm should consider what the investigators genuinely need rather than granting blanket access. Where material is privileged, the position requires particular care, and it is worth taking advice on the engagement terms before the investigator starts rather than afterwards.

Internal communications about the incident are themselves discoverable in some circumstances. Firms that handle this well set up a defined incident channel with a clear understanding of what is being recorded and why, rather than conducting the response across ad hoc email threads.

Privilege is the issue nobody plans for

If an attacker exfiltrates privileged material, the firm faces questions that have no clean answer: what was taken, whose privilege it was, whether affected clients must be told, and what to do if the material is published.

Privilege belongs to the client, not the firm, which means decisions about it are not the firm's to make unilaterally. That is a strong argument for notifying affected clients earlier than the minimum, because they may need to take protective steps in live litigation or transactions that only they can assess.

It is also an argument for knowing, in advance, which matters are most sensitive and where that material sits. A firm that cannot answer "what was in the affected system" cannot answer any of the questions that follow.

Client money changes the risk profile

Firms holding client money carry an exposure most businesses do not. The dominant loss event is not encryption but payment diversion: a compromised mailbox used to alter bank details on a completion or settlement.

The control that defeats it is procedural rather than technical — independent verification of any change to payment details, through a channel not supplied in the instruction itself. We cover that in client account fraud and payment diversion risk, and the same discipline applies to the AML controls discussed in AML training requirements for solicitors.

What to have decided before anything happens

An incident is a poor time to make first decisions. Five should already be made.

Who declares an incident, and who has authority to disconnect systems. Which external advisers are engaged, on what terms, and whether those terms address confidentiality and privilege. How the 72-hour assessment will be conducted and by whom, given it begins at awareness. What the firm will tell clients, in what order, and who signs that off. And how the firm will operate without its systems — because a litigation deadline does not move because a case management system is down.

That last point is the one most continuity plans skip. Court deadlines, limitation periods and completion dates are not negotiable, and a firm needs to know how it would meet them manually.

Where practice management standards help

Firms accredited under a practice management standard already hold much of the required apparatus: risk registers, supervision frameworks, documented procedures and file review processes. Mapping incident response onto that existing structure is faster than building something parallel, and it makes the evidence recognisable to a regulator. Our guide to Lexcel accreditation sets out the framework.

Frequently asked questions

Does the 72-hour clock start when the breach happened?

No. It runs from when the firm becomes aware of the breach. Awareness does not require a complete understanding of scope, which is why initial notification can be made and supplemented later.

Must every incident be reported to the regulator?

Not every incident, but the threshold is lower than firms assume, and it concerns seriousness rather than certainty. Where client confidentiality or client money is affected, the safer assumption is that reporting duties are engaged, and the decision not to report should itself be reasoned and recorded.

Can a firm pay a ransom to prevent publication of client material?

That raises legal and sanctions questions before it raises a commercial one, and it should be treated as a matter for specialist legal and sanctions advice rather than as a business decision about cost.

Who should lead the response?

Someone with authority to make decisions across IT, compliance, insurance and client relationships, nominated in advance. In smaller firms that is usually a partner rather than an IT provider, because most of the decisions are professional rather than technical.