Every professional body imposes some version of the same two duties: keep client information confidential, and remain competent in how you practise. Both were drafted with paper in mind and have been stretched, one guidance note at a time, to cover technology.
Very few firms have sat down and mapped the duty against what their systems actually do. It is a short exercise, it does not require a technologist to start, and it consistently surfaces two or three things worth fixing.
Six questions that expose most of it
Who can open a client's file today? Not who should. In most document systems the default is broad access across the partnership, refined only where somebody remembered to restrict it. Run the report.
What happens when somebody leaves? Between the last day and the account being disabled, how long, and across how many systems. Every system not covered by one offboarding process is a former employee with standing access.
Where does client information physically live? The document system, yes. Also personal drives, also mailboxes, also the file-sharing tool a partner uses because it is easier, also the laptops. Confidentiality obligations follow the information, not the system you intended it to be in.
What did you promise, specifically? Engagement letters and outside counsel guidelines frequently contain security commitments: encryption, retention, breach notification within a stated period, sometimes restrictions on subcontractors and offshore access. Those are contractual, they vary by client, and most firms have never collated them.
Who would you have to tell, and how fast? Breach notification obligations arrive from three directions: regulator, professional body, and client contract. The tightest of the three sets your real deadline, and it is usually a client contract with a 24 or 48 hour clock.
Can you prove any of this? Competence is judged after the fact. Contemporaneous records of decisions taken and reviews performed are what turn "we were careful" into evidence.
The retention problem firms avoid
Here is the one that makes people uncomfortable, so it gets deferred indefinitely.
Most firms keep everything, for ever, because deleting feels risky and nobody wants to own the decision. The result is a document store containing decades of client material, much of it past any retention obligation, all of it inside the blast radius of an incident.
Data you no longer need is pure liability. It cannot help you and it can be stolen. A retention schedule that somebody actually applies is one of the few security measures that reduces both risk and cost at the same time, and it is almost always deferred because it requires a partner decision rather than a purchase.
Make it somebody's job
The failure pattern is not ignorance. Most partners know these questions are worth asking. The failure is that the duty sits with everyone, which means it sits with nobody, and the questions get asked in the week after an incident rather than the year before one.
The fix is unglamorous: a named owner, a register of the obligations with a review date against each, and fifteen minutes at a partners' meeting once a quarter.