The short answer: a small law firm can share confidential client documents securely by keeping files in one managed system, sharing through controlled links rather than open attachments, requiring multi-factor sign-in, encrypting laptops and reviewing who can open each matter. None of this needs specialist software, but it does need a clear setup and someone keeping it in order.
This guide to secure file sharing for solicitors is written for partners and practice managers at firms of roughly five to 50 people across Meath, Cavan, Westmeath, Louth and Dublin. It looks at what the Law Society of Ireland and the Data Protection Commission expect, where client documents tend to go astray, and what a practical arrangement looks like for a busy practice.
What do your professional and data protection obligations expect?
Confidentiality is not new to any solicitor, but the way files move has changed. Chapter 4 of the Law Society’s Solicitor’s Guide to Professional Conduct says solicitors must take all reasonable steps to keep client information confidential when storing records, that the duty extends to staff, and that it follows a file out of the office, to court or to someone working from home. It also recognises that IT contractors will sometimes need limited access to client data, and says appropriate agreements that comply with GDPR should be in place.
On the data protection side, the Data Protection Commission’s data security guidance explains that GDPR does not list specific tools. Instead, it requires “appropriate technical and organisational measures”, including the ability to restore access to data after an incident, and the obligation applies to every organisation regardless of size.
The Law Society’s GDPR Guide for Small Law Firms is more specific. Its baseline for a law firm includes multi-factor authentication on email, case management and cloud storage, encrypted laptops, regular patching, phishing training, and sending documents by secure means where possible rather than as unprotected attachments by unencrypted email.
Where do client documents usually go astray?
In most small practices the risk is not a dramatic hack. It is ordinary habits that grew up over years. The Law Society’s GDPR guide lists common law firm breaches: a document sent to the wrong email address, a lost unencrypted laptop or USB key, ransomware, and a former staff member who still had access to the case management system.
Other patterns worth checking in your own office include:
- Sensitive documents attached to ordinary emails, with no protection if autocomplete picks the wrong recipient.
- Staff using personal email or free file-sharing accounts to send large bundles when the office system feels awkward.
- Shared folders where everyone can open every matter, including family law or medical files that should be restricted.
- Scanned documents saved to desktops or Downloads folders, outside the case management system and outside any backup.
- Accounts left active after a trainee, locum or fee earner leaves.
If a breach does happen, the DPC’s breach notification guidance requires notification without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals. Knowing where files live makes that assessment much faster.
What does a practical setup for sharing client files look like?
For most firms already on Microsoft 365, the building blocks are already there. The work lies in configuring them carefully and agreeing a few simple house rules.
Store files in one place, with access by matter or team
Keep client documents in your case management system or in SharePoint, not on individual desktops. Set permissions so that fee earners and support staff see the matters they work on, with tighter access for sensitive files. Review access whenever someone joins, changes role or leaves.
Share with links, not loose attachments
Instead of attaching a contract or medical report, share a link restricted to named people, so the recipient has to sign in or verify their email. Where your settings allow, add an expiry date to links, and remove access when the matter closes. Depending on your Microsoft 365 licence, email encryption and sensitivity labels may also be available for documents that must go by email.
Protect accounts and devices
Multi-factor sign-in on every account, encrypted laptops, up-to-date patching and security software on every device that holds client data. This matters most for laptops that travel to court, client meetings or home.
Know what is backed up and what is not
Backup needs depend on where your data lives. A Microsoft 365 backup covers email, OneDrive and SharePoint, but it does not automatically cover your case management or legal accounts software, files saved locally or every other cloud platform. Check each system separately and test a restore of an old matter.
Hypothetical example
A 12-person practice in Navan emails signed documents as attachments and keeps scans in a shared drive that everyone can open. It moves active matters into SharePoint libraries by team, switches client sharing to named-person links that expire after 30 days, turns on multi-factor sign-in for all staff and encrypts every laptop. Nothing about the fee earners’ daily work changes much, but the partners can now see who has access to each file.
How Sweeney Computer Services can help
We look after IT for professional practices from our base in Hurdlestown, Co. Meath. For solicitors, that means keeping Microsoft 365, laptops and backups in order so that confidentiality depends on a sound setup rather than on everyone remembering the rules. You can read more about how we work with solicitors and law firms.
We offer two managed packages. Silver, from €45 per user per month excl. VAT, covers remote support, monitoring, patching, antivirus, endpoint detection and response, ransomware protection and Microsoft 365 backup of email, OneDrive and SharePoint. Gold, from €70 per user per month excl. VAT, adds email security, Microsoft 365 administration, 24/7 security monitoring through a partner, application control, phishing training, leaked-password alerts and a business password manager. Microsoft 365 licences are charged separately.
Our helpdesk runs Monday to Friday, 9am to 5:30pm. We test restores every two weeks and can share the records on request, and backup for devices and servers is scoped in your proposal. For the wider picture, see our cybersecurity and managed IT support pages. We support the IT side; your professional and data protection decisions remain with the firm and its advisers.
A quick sense-check
Not sure who can open your client files?
Book a short call with Michael Sweeney to talk through how your practice stores and shares documents, and where the gaps might be.
