Attorney-client privilege turns GDPR into a heavier obligation for a law firm than for most businesses: every case file holds personal data about your client, and often about third parties too — the opposing party, witnesses, minors. Yet the reality inside thousands of small firms is an unencrypted laptop, a USB drive with “the 2023 files” sitting in a drawer, and a client spreadsheet that has never once been backed up. This guide covers what GDPR actually requires from a law firm, where the real risks sit in both digital and paper files, and how to build automated backup so that losing data stops being a possibility at all.

Disclaimer: this is practical guidance, not legal advice. For a risk assessment specific to your firm, consult a data protection specialist.

🔎 This article contains affiliate links. If you sign up through them we earn a commission at no extra cost to you. Read our affiliate policy.

Why GDPR weighs more heavily on a law firm than on most businesses

A law firm doesn’t handle generic personal data: it handles data that, combined with the simple fact of “is a client of this firm,” already reveals sensitive information — a divorce filing, a criminal proceeding, a disability claim. On top of that sits professional secrecy obligations under bar association rules, which turn any leak into a double problem: a data protection fine, and potentially a disciplinary case with the bar.

Starting from there, GDPR asks for three concrete things, not vague ones:

• A clear legal basis for each type of processing. The attorney-client relationship is covered by contract performance (Art. 6.1.b GDPR); marketing or newsletters need separate consent.
• Security measures “appropriate to the risk” (Art. 32 GDPR): encryption, access control, and the ability to restore data after an incident. This is what almost no small firm has actually documented.
• An up-to-date Record of Processing Activities, and, if the firm handles special-category data (health data in disability cases, information touching sexual orientation in some family matters, ethnic origin in immigration work), an assessment of whether a full impact assessment is needed.

Where case files actually get lost or leaked

It’s rarely a sophisticated hack that gets small firms in trouble. It’s this:

1. The managing partner’s laptop, unencrypted. It gets lost or stolen from a car, and every active case file walks out with it, with no barrier at all.
2. The only backup is “a copy on an external drive” nobody has ever tried to restore. The day the main computer fails — and it will — you discover the drive was also damaged, or the last copy is eight months old.
3. A client spreadsheet on the front desk computer, emailed around whenever someone asks for it, with no record of who edited what or when.
4. Practice management software with no real automated backup, or with backup nobody has ever verified by actually restoring it. We cover this in our law firm management software guide: tested automated backup is a purchase criterion, not a nice-to-have.
5. Unencrypted email attachments between attorney and client, including complaints, expert reports, or medical documentation in disability proceedings.
6. Ransomware. A firm that treats IT as an afterthought is exactly the profile ransomware targets: with no backup outside the affected machine, paying the ransom becomes the only option — and it doesn’t even guarantee recovery, while the attack itself is a notifiable incident either way.

The pattern behind all six risks is the same: the backup doesn’t exist, exists but is never tested, or lives in the same place as the original (if ransomware encrypts the backup drive too, you never had a backup).

The fix: automated backup outside the firm, with no one relying on memory

The gold standard among security consultants is the 3-2-1 rule: 3 copies of your data, on 2 different types of storage, with 1 copy off-site. For a small firm, doing this manually — copying folders to a drive every Friday — is exactly the kind of task that gets skipped the first busy trial week. The sane answer is to automate it.

Option 1: native backup inside your practice management software

If you run a cloud platform like Clio, daily backup is already built into the provider’s infrastructure, with redundant data centers. We cover this in our Clio pricing breakdown: a serious cloud provider solves most of this problem for case data that lives inside the software. The blind spot: everything outside the software — emails, loose documents on a local machine, the client spreadsheet nobody ever migrated.

Option 2: automated backup with Make.com for everything else

This is where an automation scenario covers the gap that no practice management software closes on its own: files living in Google Drive, Outlook, a shared drive, or synced local folders.

With Make.com you can build, with no code, a flow that:

1. Watches a case files folder (Google Drive, OneDrive, or Dropbox) and, every time a document is added or changed, automatically copies it to a second, separate cloud provider (the “2 different storage types” rule).
2. Generates a weekly compressed snapshot of the whole active-cases folder and uploads it to cold storage (an encrypted bucket, for example), with the date in the filename so you can roll back to any specific week.
3. Sends an email or WhatsApp alert to whoever owns IT if the backup scenario fails — say, the source provider stops responding — so the failure is caught the same day, not six months later.
4. Logs every backup run to a spreadsheet or database: date, file count, result. This is exactly the evidence a data protection authority will ask for if you ever need to demonstrate that “appropriate” security measures were actually in place.

If you already have a Make.com scenario running for deadline reminders, you reuse the same account — the marginal cost of adding the backup scenario is close to zero, and Make.com Core starting at $10.59/month comfortably covers the operations for both flows in a 2-5 attorney firm.

Option 3: encryption, the piece nobody should skip

Backup solves availability (“I don’t lose the data”); encryption solves confidentiality (“if someone steals the drive, they can’t read anything”). Three minimum measures:

• Full-disk encryption (BitLocker on Windows, FileVault on Mac) on every laptop in the firm: free, takes five minutes to turn on, and is the difference between a stolen laptop and a notifiable data breach.
• Encryption in transit and at rest for any cloud software or backup destination: get it in writing from the provider (it belongs in their DPA).
• Two-factor authentication (2FA) on the firm’s email, the practice management software, and the Make.com or cloud account holding the backup. It’s the barrier that prevents the most incidents for the least effort.

GDPR checklist for the firm: security and backup

• [ ] Signed DPA with every vendor that touches client data (practice management software, email, Make.com, cloud storage).
• [ ] Full-disk encryption enabled on every firm laptop and workstation.
• [ ] Automated backup (not manual), with an off-site copy — the 3-2-1 rule.
• [ ] Tested restore, at least once a quarter: if you’ve never restored a backup, you don’t actually know it works.
• [ ] 2FA enabled on email, practice management software, and automation accounts.
• [ ] Individual user accounts with role-based permissions — no shared “firm account” logins.
• [ ] Record of Processing Activities, kept current and accessible.
• [ ] Documented breach protocol, including the 72-hour window to notify the data protection authority when there’s risk to those affected.
• [ ] Encrypted email policy for sending sensitive documents to clients.
• [ ] Confidentiality and data protection clause in contracts with any outside collaborator (experts, process servers, freelance paralegals).

Implementation guide: from zero to compliant in three weeks

Week 1 — Audit and encryption. Map out where the firm’s data actually lives (practice management software, email, local drives, loose spreadsheets). Turn on disk encryption on every machine and 2FA on critical accounts. Cost: $0, just time.

Week 2 — Automated backup. If your practice management software already includes cloud backup, get written confirmation from the provider. For everything outside it — local documents, spreadsheets, email — build the Make.com scenario described above: watched folder → copy to a second provider → weekly snapshot → failure alert. Cost: from $10.59/month.

Week 3 — Documentation and testing. Draft or update the Record of Processing Activities, sign any outstanding DPAs, and run the first test restore of the backup to confirm it actually works. If the firm has multiple partners, document the breach protocol too, so everyone knows what to do the day something fails.

This order isn’t arbitrary: there’s no point automating backup if laptops are still unencrypted, and no point having a perfect processing record if you’ve never tested restoring a copy. If you haven’t digitized the rest of the firm yet, this guide slots in as the final step of our complete guide to digitizing a small law firm: build the workflow first, then lock it down.

Frequently asked questions

Does a small firm need a Data Protection Officer? Not unless large-scale processing of special-category data is your core activity. Most firms aren’t required to appoint one, but designating an internal owner for data protection — even informally — is good practice regardless.

Is cloud backup safe for client data covered by attorney-client privilege? Yes, provided the provider offers a signable DPA, encryption in transit and at rest, and ideally EU or equivalent data centers. A properly configured cloud setup is usually safer than a hard drive in a firm’s filing cabinet.

How often should I back up? For active case files, daily automated backup at minimum; for the full firm archive, a weekly full snapshot is reasonable. The key isn’t the exact frequency — it’s that it’s automated and actually tested.

What happens if I get hit by ransomware and have no backup? It’s a notifiable security incident if there’s risk to those affected, typically within 72 hours, and you’ll likely need to inform the clients whose data was compromised too. Without backup, you also lose the case file outright — the only remaining option is usually paying the ransom, with no guarantee of recovery.

Does Make.com replace dedicated backup software? No — it’s not a dedicated backup product, it’s an automation layer that connects your data sources (Drive, Outlook, local folders) to a backup destination on a schedule, with alerts. For case files that already live inside a management platform with native backup (like Clio), Make.com covers everything that sits outside that platform.

---

🔎 This article contains affiliate links to Make.com. Read our affiliate policy.