The short answer: good law firm backup and recovery means a separate, tested copy of every place client data lives. That includes Microsoft 365 email and files, your case or practice management data and any office server. Without that copy, a ransomware attack or a bad deletion could leave files gone for good.
This guide is for partners and practice managers at solicitors’ practices in Meath, Cavan, Westmeath, Louth and Dublin. It explains what to protect, how to test it and what to ask your IT provider.
Why law firm backup and recovery matters for client files
A solicitors’ practice runs on its files. Correspondence, title documents, wills and court papers often exist only in digital form now. So if they disappear, the practice can’t simply reprint them.
Data protection law also applies. The DPC’s data security guidance calls a back-up system “an essential means” of recovering lost or destroyed data. It also mentions the ability to restore access to personal data in a timely manner after an incident. In short, law firm backup and recovery is part of protecting client data, not an optional extra.
Microsoft 365 retention isn’t the same as a backup
Many practices assume Microsoft keeps a copy of everything. In fact, the Law Society’s Cyber Security Essentials checklist warns against that. It says: “Don’t assume that your data is backed up by your cloud provider”.
Recycle bins and version history help with recent, small mistakes. However, they keep items for limited periods, and they sit inside the same accounts as the live data. If an attacker or a leaver deletes mailboxes or folders, those features may not bring everything back.
A separate Microsoft 365 backup keeps copies of email, OneDrive and SharePoint outside the normal deletion path. Therefore, you can restore a mailbox, a folder or a single file from an earlier date. For law firm backup and recovery, that separate copy is the starting point.
Case management data and the office server
A Microsoft 365 backup doesn’t automatically cover everything. For example, it doesn’t cover case or practice management software or legal accounts data. Nor does it cover files saved on PCs or other cloud platforms. So law firm backup and recovery needs a plan for each.
If your practice software runs on an office server, that server needs device and server backup. If the vendor hosts the software, ask how they back it up and how you’d get data back. Similarly, check for scanned documents saved to desktops, outside any backup. Our guide to secure file sharing for solicitors covers keeping files in one place.
Testing law firm backup and recovery
A backup only matters if it restores. The Law Society checklist asks plainly: “How are these backups tested?”
Likewise, the National Cyber Security Centre’s guidance for SMEs agrees. It says to keep backups separate from the original data and test them regularly.
For our part, we restore-test backups every two weeks, and you can request the records. A good test restores a real matter folder or mailbox, not just a single file. As a result, you find gaps before an incident does.
How long would recovery actually take?
Nobody can promise a recovery time in advance. It depends on how much data the incident affected, where it lives and how you set up the backup. Restoring one deleted folder is usually quick. By contrast, rebuilding a server after ransomware takes much longer, because someone must also clean and check every machine.
So law firm backup and recovery planning means deciding priorities ahead of time. Which systems do fee earners need first? Which client matters have deadlines this week? Writing those answers down saves time on the worst day.
Hypothetical example
A 12-person practice in Mullingar loses its office server to ransomware on a Monday. The IT provider restores email and SharePoint files from the Microsoft 365 backup first, so staff can keep working. Meanwhile, the server is rebuilt and the practice management data is restored from its separate server backup.
A ransomware attack is also likely to be a personal data breach. The Data Protection Commission’s breach notification guidance explains when to notify, generally within 72 hours. Fraud risks often follow an attack, too, so see our guide to conveyancing fraud.
Questions to ask about law firm backup and recovery
Put these questions to your current IT provider, and ask for the answers in writing:
- Is our Microsoft 365 email, OneDrive and SharePoint backed up separately?
- Who covers our case or practice management data?
- Do you keep a backup copy separate from our main systems?
- How often do you test restores, and can we see the records?
- Which systems would you restore first after an attack?
Vague answers are a sign that law firm backup and recovery needs attention. Equally, clear answers give partners something concrete to review each year.
How Sweeney Computer Services can help
Oliver Sweeney founded the company in 1985. Today, we support more than 50 businesses and more than 10 schools from Hurdlestown, Kells, Co. Meath. We provide backup only as part of our managed packages, not as a separate product.
Silver, from €45 per user per month excluding VAT, includes Microsoft 365 backup of email, OneDrive and SharePoint. It also covers remote support, monitoring, patching, and antivirus and EDR with ransomware protection. Gold, from €70 per user per month excluding VAT, adds email security and phishing awareness training. It also adds 24/7 security monitoring through a partner. Device and server backup is available only within a managed package, scoped in the proposal. Microsoft 365 licences are billed separately.
Read more about our IT support for solicitors and our managed IT support. Ultimately, law firm backup and recovery works best when someone checks it regularly.
A quick sense-check
Not sure your client files would come back?
Book a short call with Michael Sweeney to talk through your files, email and practice software.
