Law Firm Data Breach Notification: What Solo & Small Firms Must Do

The ethical foundation: ABA Formal Opinion 483

In October 2018, the ABA Standing Committee on Ethics and Professional Responsibility issued Formal Opinion 483, which addresses attorney obligations following an electronic data breach. The opinion interprets three existing Model Rules as creating a breach response and notification duty:

• 1.1Competence — requires attorneys to understand how they store and protect client information, and to have the technical knowledge or assistance to respond when systems are compromised.
• 1.4Communication — requires attorneys to promptly inform clients of circumstances that may require them to take protective action regarding their information.
• 1.6Confidentiality — requires reasonable efforts to prevent unauthorized access to client information, and to respond appropriately when a breach occurs.

Opinion 483 does not create a bright-line notification requirement in every case — it concludes that the duty to notify is triggered when the breach involves information that requires the client to take protective action. But in practice, a breach that exposes client files, correspondence, or identifying information will typically trigger that duty.

Your state bar controls which ethics opinions are authoritative in your jurisdiction. Some state bars have issued their own opinions on breach notification that may be more or less prescriptive than Formal Opinion 483. Check with your state bar’s ethics resources.

State breach notification statutes: all 50 states have one

Separate from ethics rules, every U.S. state has enacted a data breach notification statute. These are consumer protection laws, not bar rules — they apply to businesses and organizations generally, and law firms are not exempt.

The statutes differ significantly across states on key dimensions:

• →Trigger definition — what types of personal information trigger the law (most cover Social Security numbers, financial account numbers, and driver’s license numbers; some extend to health information, biometrics, or login credentials).
• →Notification timeline — most states require notification “in the most expedient time possible” or within a specified period (commonly 30, 45, or 60 days) after discovery of the breach, though some allow time for an investigation first.
• →Who gets notified — affected individuals always; many states also require notifying the state attorney general or a consumer protection agency when the breach exceeds a certain number of affected residents.
• →Encrypted data exceptions — most states carve out breaches where the accessed data was encrypted and the encryption key was not also compromised.

The National Conference of State Legislatures (NCSL) maintains a regularly updated tracker of all state breach notification laws. If you practice in a state you are not familiar with, that is the right starting point for identifying the applicable statute. This article does not provide state-specific legal advice — know your state’s statute.

Practical incident response for a small firm

Solo and small-firm attorneys often lack the IT infrastructure that larger firms use for incident response. That does not reduce the legal obligation — it raises the importance of having a basic plan before an incident occurs, not after.

Here are the practical steps that apply to most small-firm breach scenarios:

Prevention is cheaper than response

The incident response checklist above is necessary to know, but the better outcome is not needing it. Most breaches that affect small law firms are not sophisticated — they are phishing attacks that succeed because of reused passwords, stolen credentials from a breach elsewhere, or ransomware delivered through a malicious email attachment.

Basic controls that remove the most common attack vectors:

• +Multi-factor authentication on email, practice management software, and cloud storage
• +Unique passwords for every service account (a password manager removes the friction)
• +Regular backups stored offline or in a separate cloud account — your only defense against ransomware
• +Encrypted storage for client files — most breach notification statutes have an encryption exception
• +A written incident response plan, even a one-page document, so you know what to do at 2am when something goes wrong

If you are not sure which of these are in place at your firm, or whether your AI tool usage creates additional exposure, a CyberFrad audit identifies the gaps and delivers a prioritized remediation plan.

AI tools as a breach vector

One increasingly relevant source of law firm data exposure is the AI tools attorneys use for drafting, research, and client communication. Consumer AI products — including the default tiers of ChatGPT — retain conversation data and, in some cases, use it for model training. If an attorney pastes client documents or facts into one of these tools, that data leaves the firm’s control.

Whether this constitutes a “breach” under a state statute depends on the statute’s definition of breach and the nature of the information disclosed. But it clearly raises Rule 1.6 concerns, and ABA Formal Opinion 512 (2024) confirms that existing confidentiality duties apply when attorneys use generative AI.

For a detailed breakdown of which ChatGPT tiers train on your data and what safer patterns look like, see our article Is ChatGPT Confidential?

Frequently asked questions