Law firm IT: confidentiality is a professional duty
In a German law firm, IT is more than a tool. Client confidentiality applies to computers, mailboxes and cloud services too. At the same time, communication with the courts now runs electronically through the special electronic lawyer's mailbox (beA). If the technology fails, deadlines can be at risk.
This article is a practical overview, not legal advice. The rules of the Federal Bar (BRAK) and your regional bar are what count.
Running beA reliably
Since 2022, lawyers in Germany generally have to file documents with the courts electronically. That makes beA a critical system.
- Track cards and certificates: note expiry dates of the beA card and software certificate and renew in time.
- Set up deputies: give staff suitable rights so incoming mail is seen during holidays or illness.
- Plan a fallback: for technical failures there is a substitute filing route with credible proof. Write down how this works in your firm and document outages immediately (screenshot, time).
- Keep firm software up to date: beA interfaces change, so install updates promptly.
Accounts and permissions
- Personal accounts for everyone, no shared logins
- Two-step sign-in (MFA) for email, remote access and cloud services
- Permissions by matter and role; trainees and temps only for a limited time
- Disable all access on the day someone leaves, see onboarding and offboarding
Email with clients
Unencrypted email is common but not always appropriate. A tiered approach makes sense:
- Agree on the preferred communication channel with each client and document it.
- Offer encrypted options for sensitive documents, such as a secure client portal or encrypted files.
- Protect your own domain against spoofed senders, see SPF, DKIM and DMARC.
Cloud and service providers
German lawyers may give service providers access to client data if they are chosen carefully and bound to confidentiality (Section 43e BRAO). In practice:
- A written confidentiality undertaking from IT providers
- A data processing agreement under the GDPR
- Prefer EU data centres and log access
Backup and emergencies
- Daily backup of firm software and files
- One copy separated from the office network, one encrypted off-site
- Test restores regularly
- A short IT emergency plan with phone numbers and the beA fallback
Quick checklist
FAQ
Can I use Microsoft 365 in a law firm? Many firms do. What matters is the right configuration, contracts with the provider and a judgement about which data is stored there. Check your bar's guidance.
Who handles beA when it jams? The card and mailbox are part of the BRAK infrastructure; your computers and firm software are your IT provider's job. Agree on the boundary in advance.
Conclusion
Law firm IT doesn't need big projects, but clear responsibilities, protected accounts and a rehearsed plan for outages. Learn more on our IT for law firms page.
