A data breach at a law firm: the first 72 hours

A data breach at a law firm almost never starts with a red screen. It starts with a remark in the corridor: “did you send an email to every client in the criminal practice this morning?” Or with a taxi, a backpack and a laptop that is no longer there. From that moment a 72-hour clock is running, and most firms discover they do not even know when it started.

In our piece on the GDPR obligations firms most often miss, the breach protocol was number seven. This is the practical follow-up.

What the GDPR requires, plainly

Three articles and one paragraph:

• Article 33(1). The controller notifies a personal data breach to the supervisory authority “without undue delay and, where feasible, not later than 72 hours after having become aware of it”, unless the breach is unlikely to result in a risk to people’s rights and freedoms. A late notification must state the reasons for the delay.
• Article 33(4). If not all the information is available at once, it may be provided in phases.
• Article 34. If the breach is likely to result in a high risk, the data subjects must be told too, without undue delay and in plain language. That is not needed if the data was protected (encryption), if subsequent measures remove the high risk, or if telling people individually would involve disproportionate effort — in which case a public communication replaces it.
• Article 33(5). Every breach is documented — facts, effects and remedial action — including those that are not notified.

The Spanish DPA’s (AEPD) breach-notification guide settles two points. First, the 72 hours are clock hours, “including the hours that fall on weekends and public holidays”. There is no August court recess and no Civil Procedure Act grace day here. Second, the clock starts when the controller becomes aware that the incident has affected personal data, not when someone notices something odd. A few hours to confirm, not a week to “investigate”.

If the breach happens at a vendor — cloud email, document management — Article 33(2) requires it to alert the firm without undue delay; notifying the authority remains the firm’s job.

Where and how to notify

Notification is filed through the AEPD’s electronic office (sede electrónica), using its personal data breach notification form. The form distinguishes between a new notification and a modification of an earlier one, precisely so you can file an initial notification within 72 hours with what you know and complete it later. The AEPD guide sets a maximum of 30 days from the initial notice for that completion (working days, per the guide).

The AEPD also offers two free tools that do not store what you enter:

• Asesora Brecha, to decide whether to notify a supervisory authority, and which one.
• Comunica-Brecha RGPD, to decide whether to tell the people affected; it includes a template message.

Both produce a downloadable report of your answers and the outcome. That report makes a good first entry in the Article 33(5) log, though it does not replace the firm’s own assessment.

Hour by hour

Hours 0–2: contain and write it down. First, stop the bleeding: change passwords and kill every active session on the affected account, trigger remote wipe on the lost device, take the ransomware-hit machine off the network without switching it off or reinstalling it. Second: record the exact time the firm became aware, and who did. Everything else is counted from there.

Hours 2–24: assess. Five questions, in writing: what data (identity, financial, health, criminal, minors), how many people, was it encrypted, could an outsider have seen it or was access merely lost, and can it be recovered. At a law firm, the first answer usually aggravates all the others.

Hours 24–48: decide. Notify or not, tell clients or not, and why. A named person decides — the responsible partner, or the DPO if there is one — not “the firm”.

Before hour 72: notify. With whatever you have. An incomplete initial notice on time beats a perfect one that is late.

Where needed, without waiting for hour 72: tell clients. Article 34 is tied to “undue delay”, not to the 72 hours. If there is an immediate fraud risk, warning those affected comes first, not last.

Always: log it. Including the incident that closes with “no notification required”. The log is the only evidence that the conclusion was reasoned.

The four incidents that actually happen

The lost laptop. If the disk was encrypted with an uncompromised algorithm and a strong password, the AEPD guide accepts that the confidentiality risk can be considered mitigated; with a backup of the data as well, the usual outcome is to document and not notify. If it was unencrypted and held case files, it is notifiable — and with health, criminal or minors’ data, clients will probably need telling too.

The email to the wrong recipient. The guide lists it expressly as an accidental breach. What matters is who received it, what it contained, and whether you can get confirmation of deletion. A deed sent to the wrong court agent, who confirms deletion the same morning, is logged. A child’s psychological report sent to the other side in a divorce leaves no room for debate: notify the authority and tell the client.

The compromised mailbox. The most underrated case and one of the most serious, because a lawyer’s mailbox is the complete archive of their matters. If a third party had access, assume they could read everything. And they often use it: emails from the firm’s real account asking clients to pay the retainer into a new bank account.

Ransomware. If you can rule out exfiltration with certainty and have backups to restore, it is an availability breach, and whether it is notifiable depends on how long the outage lasts and whom it affects. If exfiltration cannot be ruled out — and with current ransomware it rarely can — it is a confidentiality breach as well.

A worked example, with the clock running

A six-lawyer firm. On a Tuesday at 10:30, the office administrator spots emails in a partner’s Sent folder that nobody wrote, sent at 03:12 that night. At 11:00 the IT contractor confirms a login from outside Spain following a phishing email the previous Friday. Awareness is Tuesday at 10:30, when it was already clear that the mailbox — full of client documents — had been in someone else’s hands. The deadline is Friday at 10:30.

• Tuesday, 11:20. Password changed, sessions closed, two-factor authentication enforced, forwarding rules checked (the attacker had created one).
• Tuesday, 16:00. Assessment: the mailbox holds correspondence with about 60 clients, including a custody case with two children’s school and medical reports, and three criminal matters.
• Wednesday, 09:00. It emerges that the attacker sent three clients an “invoice” with a different IBAN. Those three are phoned that morning, before anything else: fraud risk does not wait.
• Wednesday, 18:00. Documented decision: notification is required (special categories, minors, actual third-party access), and there is a high risk for the people in the custody case and the criminal matters.
• Thursday, 12:00. Initial notification filed at the AEPD, with the information available. Twenty-two and a half hours to spare.
• Thursday and Friday. Individual letters to affected clients, in plain language: what happened, which data, what has been done, what to watch for, whom to call.
• Following weeks. Modification notice with the final scope; internal log closed.

Had the partner spotted those emails on a Friday at 18:00, the deadline would have been Monday at 18:00. The whole weekend counts.

Professional secrecy does not pause

At a law firm a data breach is also a professional-secrecy problem: article 542.3 of the Judiciary Act (LOPJ) and articles 21 and 22 of the General Statute of the Spanish Legal Profession require lawyers to keep secret everything they learn through their professional work. Two consequences. The AEPD notification describes the nature of the breach and the categories and approximate number of people and records; it does not require transcribing the content of matters, and should not. And whatever Article 34 says, a client whose matter has been exposed should hear it from their lawyer.

This article’s view is simple: the expensive mistake is not over-notifying, it is deciding late and without a paper trail. A cautious notification that turns out unnecessary costs nothing; a silenced breach that surfaces later, in a client complaint, turns an accident into an infringement.

What to have ready beforehand

One page with four things: who decides, whom to call first (IT, vendor, insurer if there is a cyber policy), where the breach log lives, and the link to the AEPD’s electronic office. And knowing where client data lives: “what was in that mailbox?” can only be answered quickly if matters do not live in the mailbox, or on anyone’s personal phone (our WhatsApp Business guide for law firms explains how to avoid that).

Where Mandato fits

Case-management software will not stop a phishing email, but it changes the size of the breach. In Mandato documents live in the case file rather than in mailboxes, access is by role and by matter, there is two-factor authentication and an access log — which lets you answer “what was seen?” in hours, not days — and client communications, email and WhatsApp, sit in a single inbox linked to the matter.