Law Firm Identity and Data Security Guide: Client Confidentiality and Access Control

Law firms hold some of the most valuable confidential information in any economy, deal and litigation files, criminal case material and large client money balances, yet most firms still give every fee earner broad access to the whole document store and move money on the strength of an email. The UK National Cyber Security Centre (NCSC) names phishing, business email compromise, ransomware, supply chain weaknesses and insiders as the main threats to the legal sector, and the Solicitors Regulation Authority (SRA) found that most incidents in the firms it reviewed came from individual errors rather than hacking. This guide covers the identity and data controls that protect client confidentiality: matter-based access and ethical walls, the document management system, email and payment fraud on conveyancing and transactions, privileged and third-party access, and the regulatory duties in England and Wales and the United States. It is written for IT, security, risk and compliance leads at firms of every size. It is not legal advice.

Key takeaways

• Confidentiality is a regulatory duty, not only good practice. SRA Code of Conduct for Firms paragraph 6.3 requires firms to keep the affairs of current and former clients confidential, and ABA Model Rule 1.6(c) requires US lawyers to make reasonable efforts to prevent unauthorised access to client information.
• Access should follow the matter, not the office. Default-open document stores mean any compromised account exposes every client; matter-centric permissions and ethical walls limit the blast radius.
• Payment redirection is the most direct loss. In the SRA's thematic review, more than £4m of client money was stolen in 23 of the 30 directly targeted firms, through email modification fraud, phishing and vishing.
• MFA and separated admin accounts are baseline. Both the SRA and NCSC call for MFA, least privilege, separate administrative accounts and a prompt leavers process.
• Plan for the breach you will report. Firms may need to notify the ICO, the SRA, law enforcement and clients; the SRA found 15 firms stored their disaster recovery plan on the systems an attack could disable.

Why law firms are targeted

The NCSC's report on the cyber threat to the UK legal sector sets out why attackers choose law firms. The reasons shape the controls that matter most.

The SRA visited 40 firms in 2019, all of which had been subject to a cybercrime report. Thirty said they had been directly targeted, and in the other ten criminals targeted clients during a transaction. Email modification fraud, phishing and vishing were the most common attacks. The NCSC report also cites the November 2021 attack on Simplify Group, described as the UK's largest conveyancing firm, which took core systems offline and reportedly cost £6.8 million.

Regulatory duties that drive security

England and Wales

• Confidentiality (Code for Firms 6.3): Keep the affairs of current and former clients confidential unless disclosure is required or permitted by law or the client consents.
• Conflicts and former client information (6.5): A firm may not act against a current or former client whose material confidential information it holds unless "effective measures" mean there is no real risk of disclosure, or the client gives informed written consent. The Code does not use the phrase "information barrier", but effective measures in practice means ethical walls the firm can evidence.
• Governance and risk (2.1 and 2.5): Firms must have effective governance, systems and controls, and must identify, monitor and manage all material risks. Cyber risk falls within this.
• Reporting (3.9): Firms report promptly to the SRA facts they reasonably believe could amount to a serious breach of regulatory arrangements. The SRA review found seven significant incidents had gone unreported.
• UK GDPR breach notification: The ICO asks controllers to report a personal data breach without undue delay and, where feasible, within 72 hours when it is likely to result in a risk to people's rights and freedoms, and to tell affected individuals without undue delay when the risk is high. See the GDPR Compliance Guide for Security Teams.

United States

• ABA Model Rule 1.6(c): Requires a lawyer to make reasonable efforts to prevent the inadvertent or unauthorised disclosure of, or unauthorised access to, information relating to the representation of a client. States adopt their own versions of the Model Rules, so check the rule in each jurisdiction where the firm practises.
• ABA Formal Opinion 477R (2017): Addresses securing the electronic communication of client information. It treats "reasonable efforts" as a risk-based, fact-specific judgement, with stronger measures, such as encryption, expected for highly sensitive material.
• ABA Formal Opinion 483 (2018): Addresses lawyers' obligations after a data breach, including monitoring for breaches, acting reasonably to stop the breach and restore systems, establishing what happened, and informing current clients when their information is affected.
• State breach laws: Personal data in matter files triggers state breach notification laws as well. See the US State Privacy Laws Guide and the Data Breach Notification Checklist.

Matter-based access and ethical walls

Most firms grew up with an open-door document culture: any lawyer could find any precedent. That makes knowledge sharing easy and confidentiality hard. A modern access model keeps knowledge sharing for precedents and know-how while restricting live matter content.

Making ethical walls effective

1. Drive walls from conflicts: When the conflicts process clears a matter with a screen, the wall should be created automatically in every system, not requested by email to IT.
2. Cover every repository: The document management system (DMS), email archives, collaboration tools, time recording and billing, file shares and backups. Microsoft Purview information barriers, for example, can block chat, calls, file sharing and site access between segments in Teams, SharePoint and OneDrive, but Microsoft documents that they cannot restrict Exchange email, which needs mail flow rules instead.
3. Use identity attributes: Define segments or matter groups from authoritative attributes in the directory, fed by HR and the practice management system, so joiners and movers inherit the right walls.
4. Log and review: Record attempted access to walled matters and review breaches of the wall. A wall you cannot evidence will not help in a conflict challenge.
5. Re-certify: Matter teams change. Run periodic access reviews on live matters and remove access when a matter closes. See the Access Reviews Guide.

Document management systems and data protection

• Single source of truth: Keep matter content in the DMS rather than personal drives, email attachments and unsanctioned file sharing. The NCSC recommends sharing files through access-controlled cloud accounts rather than email attachments. See the Secure File Sharing Guide.
• Security classification on workspaces: Label matter workspaces by sensitivity so DLP, encryption and sharing restrictions follow the label. See the Data Classification Guide.
• Bulk download and export alerts: A user exporting hundreds of documents from matters they do not work on is the clearest insider and compromised-account signal a DMS produces.
• Encryption: Encrypt data at rest and in transit, and use encrypted portals or protected email for highly sensitive documents sent to clients and counterparties.
• Retention and legal hold: Apply retention schedules to closed matters and hold processes for litigation. Old matters held forever are pure breach liability. See the eDiscovery and Legal Hold Guide.
• Generative AI tools: Decide which AI tools may receive client material, under what contract terms, and block uploads to unapproved services. See the Generative AI Data Loss Prevention Guide.

Wire fraud, conveyancing and email compromise

Conveyancing and transactional teams handle large sums under time pressure, which the NCSC identifies as conditions for phishing and business email compromise. Fraudsters either hijack a mailbox (often by phishing a lawyer or client, then adding forwarding or hiding rules) or use a look-alike domain to send "updated" bank details.

• Tell clients early: The SRA recommends telling clients that the firm's bank details will not change and never sending bank details by email. Put it in the client care letter and email footers.
• Verify before paying out: Confirm any new or changed payee details by calling a number already held on file, never one in the email. The NCSC gives the same advice for payment change requests. A second person should approve outbound client account payments above a threshold.
• Check the client too: Clients' personal mailboxes are compromised as often as the firm's. Four firms in the SRA review used two-factor methods to verify clients during transactions.
• Know the loss route: In the SRA review insurers recovered about £3.6m and firms repaid about £400,000 from their own funds. See the Email Identity and BEC Guide, the Authorised Push Payment (APP) Fraud Guide and the DMARC, SPF and DKIM Guide.

Identity controls for people, privileged users and third parties

• MFA everywhere remote: Email, DMS, remote access and practice management. The SRA found 25 of 40 firms used two-factor authentication for some daily activities, which leaves gaps. Prefer phishing-resistant methods for partners, finance and IT. See the MFA Guide.
• Separate administrative accounts: The SRA recommends separating admin accounts from everyday work accounts. IT staff and outsourced providers should use named admin accounts with MFA, ideally with just-in-time elevation. See the Privileged Access Management Guide.
• Joiners, movers and leavers: Lateral partner hires, secondments and departing teams are high-risk moments. Departing lawyers should lose access promptly, and their recent downloads should be reviewed. See the Joiner-Mover-Leaver Guide.
• Third parties: Barristers, experts, e-discovery and litigation support providers, and outsourced IT all need access. Give guest accounts that expire with the matter, limit them to the matter workspace, and put security requirements in contracts. The SRA warns against total reliance on third-party IT providers. See the Third-Party Access Guide.
• Client portals and extranets: Client users need MFA, per-matter access and an owner who removes them when the matter closes.
• Service accounts and integrations: DMS connectors, billing integrations and e-discovery platforms run on service accounts and API tokens with access to many matters. Inventory them, give each an owner, and rotate their credentials. See the NHI Offboarding and Decommissioning Guide.

Implementation roadmap

1. Months 0 to 3, baseline: Enforce MFA on email, remote access and the DMS; separate admin accounts; publish the "our bank details never change" message; set DMARC to monitoring and fix legitimate senders; confirm backups are offline or immutable and that a recent copy can be restored. Consider Cyber Essentials, whose five control themes (firewalls, secure configuration, security update management, user access control, malware protection) are a practical floor; Cyber Essentials Plus adds independent technical testing. See the Cyber Essentials Guide.
2. Months 3 to 6, payments and email: Move DMARC to p=reject, block external auto-forwarding, alert on new inbox rules, and enforce dual approval and phone verification for payee changes.
3. Months 6 to 12, matter-based access: Pilot matter-centric permissions with one practice group in a test workspace, measure lawyer friction, then extend group by group. Connect conflicts clearance to automatic wall creation. Roll back a group to practice-group access if the staffing feed proves unreliable, and fix the feed before retrying.
4. Ongoing: Quarterly access reviews on sensitive matters, annual incident exercises, and training for all staff, with records kept.

Small firms versus large firms

• Small firms and sole practitioners: Focus on MFA, Cyber Essentials, a managed email security service, bank detail verification and an IT provider contract that states who does what in an incident. Matter-level restriction may be limited to sensitive matters.
• Large and international firms: Matter-centric access with automated walls, DLP, a security operations capability or managed detection, privileged access management, and processes to answer client security questionnaires and outside counsel guidelines.

Detection, measurement and framework mapping

What to monitor

• Sign-ins to email and the DMS from new countries, devices or anonymising networks.
• Creation of mailbox forwarding and inbox rules, especially rules that move messages mentioning "invoice", "completion" or "bank".
• DMS access to walled matters and bulk downloads by users outside the matter team.
• Changes to client and payee bank details in the accounts system.

Metrics

• Percentage of users and admin accounts protected by MFA (target: 100%).
• Percentage of live matters with matter-team access only.
• Median time to remove access for leavers (target: same day).
• Payee changes verified out of band before payment (target: 100%).
• Phishing report rate and time to report.
• Date and result of the last successful test restore.

Framework mapping

Common failure patterns

• Bank details changed on the strength of an email: The single most expensive pattern in the SRA review. Fix it with process, not training alone.
• Walls on paper only: A conflicts memo says a screen exists, but the DMS, Teams and email archive still let the screened lawyer search the matter.
• Recovery plans stored on the systems they recover: 15 of the 27 firms with a disaster recovery plan in the SRA review kept it where an attack could disable it, and 17 firms could not access a copy of their latest backup.
• Training that skips the partners: The SRA found senior staff often performed worse than others on basic cyber security terminology, and eight firms had never given specific cyber training.
• Blame culture: Staff who fear consequences report late. Both the SRA and NCSC recommend a no-blame approach to reporting.
• Unmanaged third-party and service accounts: Outsourced IT admin accounts without MFA and integration accounts with firm-wide DMS access are common paths, as the Scania insurance portal breach showed when an IT partner's stolen login exposed claim documents.

Practitioner checklist

• Enforce MFA on email, DMS, remote access and client portals, with phishing-resistant methods for partners, finance and IT.
• Separate administrative accounts from everyday accounts, including those used by outsourced IT.
• Tell clients in writing that bank details will not change by email, and verify every payee change by phone on a known number with dual approval.
• Set DMARC to p=reject on every firm domain and block external auto-forwarding.
• Move live sensitive matters to matter-team access, and create ethical walls automatically from conflicts clearance across DMS, collaboration tools and email.
• Alert on bulk DMS downloads, access attempts to walled matters and new mailbox rules.
• Give third parties and client users expiring, matter-scoped access, and inventory integration service accounts.
• Keep offline or immutable backups, test restores, and store the incident plan off the main systems.
• Document who reports to the ICO, SRA, law enforcement, insurers and clients, and rehearse it annually.

Standards and references

• SRA: Code of Conduct for Firms
• SRA: Cyber security thematic review
• NCSC: The cyber threat to the UK legal sector
• ICO: Personal data breach reporting
• NCSC: Phishing attacks, defending your organisation
• NCSC: Cyber Essentials overview
• Microsoft Learn: Information barriers in Microsoft Purview
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Email Identity and BEC Guide · Data Loss Prevention (DLP) Guide · Insider Threat and Identity Guide · US State Privacy Laws Guide. This guide summarises professional conduct and data protection duties for law firms and is not legal advice.