Your License.
Your Firm. Your Clients.

Attorneys must understand the technology they use — its benefits and its risks. "I didn't know" is not a valid defense.

• Know how email, software, and cloud storage can be compromised
• Understand threats: phishing, ransomware, credential theft
• Earn CLE credits covering cybersecurity topics
• Consult IT professionals when expertise exceeds your own

Make reasonable efforts to prevent unauthorized access to all client data — emails, files, scanned documents, and practice software.

• Protection scales with sensitivity — SSN vs. billing address need different care
• If a client contractually requires stricter security, you must comply
• Duty continues after representation ends — former client data must remain protected

Standard unencrypted email is no longer presumed safe for sensitive client data. Evaluate each communication individually.

• Routine scheduling — standard email is generally acceptable
• Sensitive materials (SSNs, financial records, litigation strategy) — encrypted email or secure portal required
• Required for all attorneys:
  • Multi-factor authentication (MFA) on all email accounts
  • Password-protect confidential attachments before sending
  • No sensitive data over public Wi-Fi without a VPN
  • Train all staff to recognize phishing attempts
• Document client's preferred communication method for sensitive matters

Cloud is permitted — but only after proper vendor due diligence. Using a vendor without vetting it is itself an ethics violation.

• Verify encryption at rest and in transit before uploading any client data
• Confirm SOC 2 certification or equivalent independent security audit
• Know server locations — overseas data has different legal protections
• Require contractual breach notification obligations from every vendor
• Sign a data protection agreement before use
• Keep written records of your security review for every vendor
• Remote work carries identical obligations — same duties as in the office

You are responsible even when staff or a vendor makes the mistake. Delegation does not transfer ethical responsibility.

• Covers paralegals, assistants, contract attorneys, IT vendors, billing platforms
• Provide written security policies before staff access any client files
• Train new hires before access; annual refresher training for all staff
• Review vendor contracts for data protection and breach notification terms

Your duty to safeguard client property applies equally to digital and paper files.

• Access controls — only authorized personnel can open files
• Regular backups with verified restores
• Retain files for the legally required period before deletion
• Use secure deletion — moving to Recycle Bin is not sufficient

If you receive a misdirected email, document, or electronic file, immediately notify the sender.

• Applies to misdirected emails, documents with confidential metadata, forwarded privileged chains
• Read only enough to identify the mistake
• Do not use or retain the information — wait for sender instructions

Notify clients the moment you have reason to believe a breach occurred — you cannot wait for a completed investigation.

• Tell clients: what happened, when you discovered it, what data was involved, what you are doing to stop it
• Tell clients what protective steps to take (credit monitoring, account freezes)
• Keep a documented log of when and how each client was notified

Legal obligation under Ohio Revised Code — separate from and in addition to your ethics duties.

• "Personal information" = name + SSN; name + driver's license/state ID; or name + financial account + access credentials
• Notify every affected Ohio resident within 45 days of discovery
• Clock starts when you become aware — not when investigation concludes
• If 1,000+ residents affected: also notify Experian, Equifax, and TransUnion

Ohio's Data Protection Act provides an affirmative defense against civil breach lawsuits — if you have a qualifying written program.

• Administrative: Written policies, employee training, vendor oversight, incident response plan
• Technical: Encryption, MFA, access controls, software patching, network monitoring
• Physical: Office access controls, secure device disposal, screen privacy filters, laptop locks