Encryption and devices outside the office
Disk encryption on laptops, rules for phones carrying email and the ability to wipe lost hardware remotely. A baseline that can be rolled out in a week.
Who holds your case files in the procedural sense. It sounds like a legal question, but the answer is technical and depends on where the server stands and who holds the keys to it. On it rests whether, if storage media are seized, anyone will be in a position to invoke professional privilege before the documents are read.
We are not a law firm and we issue no legal opinions; what is covered by privilege is for you to decide. Our job is to build the IT so that your assessment can be enforced technically rather than depending on the goodwill of somebody else's supplier. Below are the three subjects that come up most often in law firms.
This is the only reason a conversation about hosting in a law firm differs from one in an ordinary company. The protection under criminal procedure is triggered when the person subject to the measure declares that the documents are covered by privilege. The whole problem is who that person will be.
Once it is declared that the papers concern the exercise of the defence function, the authority leaves them without acquainting itself with their content. For ordinary professional privilege the documents go to the prosecutor or court in a sealed package, unread. That is real and strong protection.
An order to seize the contents of a mailbox is sometimes addressed not to the advocate but to the hosting company, the cloud provider or the outside IT firm. Such a party usually makes no declaration, because it is not obliged to and often does not know what the data concerns. The protection simply never engages.
We do not claim the cloud is forbidden, because that is untrue. We claim that with case files it is worth knowing who can physically hand data over without asking you, and keeping that list short. The fewer parties hold decrypted files, the fewer places where nobody will make the declaration.
Honestly about our own role: in running your IT we have access to the systems holding case files, and we are precisely the kind of outside party described above. That is why we work on named accounts with session recording rather than a shared administrator password, agree in writing that we notify you immediately of any demand to hand over data, and build access so that it does not require the content of the files at all. Legal basis: article 225 of the Polish Code of Criminal Procedure.
Practising advocates and legal counsel have had to hold an electronic delivery address since 1 January 2025. From an IT standpoint one sentence matters: delivery to such a mailbox has the same effect as registered post with confirmation of receipt.
A letter delivered to the mailbox is delivered even if nobody opened it that day. So we treat it as a critical channel rather than an add-on: notifications go where somebody looks daily, and to more than one person.
The mailbox allows an administrator and authorised people to be designated for receiving and sending, an office employee for instance. It is worth doing in advance. The authorisation does not include the right to designate further people, so a chain of cover cannot be built that way.
The professional address is separate from the business one, and a law firm registered as a company has its own obligation. In practice one firm runs several mailboxes and each needs a named person, otherwise one of them ends up unattended.
The duty covers practising advocates and legal counsel, and also tax advisers, restructuring advisers, patent attorneys and notaries; it does not cover trainees or those who have suspended practice. The act on electronic delivery provides no financial penalty for failing to register, but the duty follows from professional regulations, so disciplinary liability remains in play. Letters from the common courts still travel by a separate channel through the court information portal.
In a law firm separating access is not a matter of tidiness but sometimes a condition of running a case. The need is the reverse of an ordinary company: it is not about people reaching everything they work on, but about being able to show that part of the team was cut off.
When a matter arrives that calls for separating teams, what is needed is a barrier visible in the system rather than an understanding in the corridor. We set it at the level of permissions to folders and matters, along with a record of who looked and when.
The most painful moment in a firm. What counts is how quickly you withdraw access and whether you know what was copied beforehand. So withdrawing permissions should be one item on a list, not a tour of ten systems one after another.
A laptop at court and a phone with email are the commonest source of a leak and the easiest to secure. Disk encryption, a screen lock and the ability to wipe a device remotely are cheap and work in the case that actually happens, which is hardware simply disappearing.
We did this at a thirty-person firm where a departure took the administration out of action for a week and a half, mostly through manually reassigning recurring tasks in the trade system. After writing a tool that walks the system itself, offboarding now closes in three to four hours. That project is described on the home page.
Six areas we usually start from. Under each one is a link to the page with the detail.
Disk encryption on laptops, rules for phones carrying email and the ability to wipe lost hardware remotely. A baseline that can be rolled out in a week.
Most case management systems are installed locally. We publish them remotely so the files stay on your server and only the screen image reaches the laptop.
Mailboxes, calendars and documents in Microsoft 365, configured for a law firm: separated permissions, forwarding rules and control over where attachments end up.
Repetitive steps, from opening a matter to deadline reminders, can be automated with a tool running on your own server. Case files then never pass through somebody else's service.
Copies that survive an encryption attack plus an archive of closed matters, kept apart from current work. We test restoring rather than assume it will work.
Requests, updates, hardware and accounts on one retainer, with named accounts on our side and a record of who entered your systems.
What we do not do: advise on legal matters, judge what is covered by privilege, or sell case management software. Nor do we keep your register or enter data for you. We do help you talk to the maker of the program you use when the problem sits on their side.
The first conversation requires showing us nothing from any case file. It is enough to describe where things sit and who can reach them.
We record where the files physically sit, who outside the firm can reach them and how the electronic delivery mailbox is handled. We come back with a list of risks. Free, and the list stays with you whatever you decide.
We check whether anything can actually be restored from the existing copies and switch on encryption across the laptops. These two give the best return for the cost and can be done straight away.
We separate access to matters, switch on a second sign-in factor and tidy up the withdrawal of permissions, so that a lawyer leaving is one task rather than a week-long project.
Requests, updates away from hearing dates, restore tests and a report. Work needing a break is agreed against the firm's calendar, because a court deadline does not wait for a maintenance window.
Pages that come up in conversations with law firms.
Pick your industry and see how comprehensive IT support and IT outsourcing for SMEs can help your company.
There is no prohibition and many firms do, but the consequence is worth understanding. When a supplier holds the data, the demand to produce it may go to them, and they will make no declaration of professional privilege, because they are under no duty to. The decision is yours; our role is to show who, in a given arrangement, can hand data over without asking you.
The honest answer is that we are exactly the kind of outside party we warn about above, and we do not pretend otherwise. So we work on named accounts with session recording, limit access to the technical layer rather than the content of files, and undertake in writing to notify you immediately of any demand to produce data.
Yes, a serious one, because delivery to the mailbox has the same effect as registered post with confirmation of receipt. The clock runs whether or not anyone opened the letter. We set notifications to go where somebody looks daily and assign at least two people to the mailbox.
Designate an administrator or people authorised to receive and send, and do it before leaving rather than from the airport. Worth knowing that an authorised person cannot designate anyone further, so cover cannot be passed along a chain. The configuration itself takes about a quarter of an hour.
With tidy accounts it is a matter of fifteen minutes; with untidy ones it takes several days and something is usually forgotten. At a thirty-person firm we cut offboarding from a week and a half to three or four hours by automating the reassignment of recurring tasks in their trade system.
Yes, and it is worth doing in the system rather than by word of mouth, because then the separation can be demonstrated. We set permissions to folders and matters plus a record of access, so it is clear who looked and when. When such a separation is needed is for you to judge.
Usually yes, by publishing the program from a server, where the laptop receives only the screen image and the data stays at the firm. With case files this has an extra benefit, because nothing is copied onto a device that could be left behind at court.
We price from the number of workstations and the scope, and law firms usually fit the standard retainer, because there are as many computers as people. We price separately the server running the practice software, if it is to be under ongoing care. The review before a quote is free.
The first meeting takes 30 minutes and commits you to nothing. We will tell you straight whether we can help and what we would propose.
2019 - 2024 Interactive Workspace Ltd. - All rights reserved.