Your clients' data,
under lock and key.

With three pieces that hold each other up: access control, encryption of anything sensitive and backups that genuinely restore. A firm handles case files containing third parties' financial, legal and sometimes medical data, so having antivirus and hoping for the best isn't enough. First, you need to know who can open each file and why: not everyone on the team needs to see every case. Second, laptops and drives that leave the office —for a court hearing, a client meeting— must be encrypted, because a lost device without encryption is a data breach, while the same device encrypted generally isn't. Third come the backups, properly tested, not just scheduled. On top of that there's something hardly anyone has signed: the contract with your IT provider as data processor. We explain it in more detail in IT maintenance and GDPR for businesses, and in your firm we carry out a full review before touching anything.

You stop working while it gets sorted out, unless there are reliable backups behind you. A firm lives on files that can't be recreated by hand: ransomware that encrypts the active cases folder, or a disk that dies without warning, brings the day's work to a halt and puts months of earlier work at risk if nothing was stored separately. We set up automatic backups on different media from the ones you use every day, with at least one copy off-site, and we check them by actually restoring, not just by seeing that the job finished without errors. And if the worst does happen, the first few hours after spotting encryption or suspicious access decide how much can be saved: isolate the affected machine, don't pay on impulse, and know who to call before it happens. We go into it in what to do in the first hours of a ransomware attack, which is worth reading before you need it, not after.

Yes, with a properly set-up connection, not with any old remote access. A partner who needs to open a file from a courthouse, from home or from a client's office shouldn't have to rely on sharing passwords by email or on a remote desktop exposed to the internet with no other protection. We configure encrypted remote access and VPNs, with two-factor authentication so that a leaked password isn't enough to get in, and we make case files accessible only from authorised devices and accounts, never from whatever computer someone has to hand. It also matters what happens when a partner's laptop is lost or stolen: if it's encrypted and remote access can be revoked immediately, an annoyance doesn't turn into a breach. We set it up together with the rest of the firm's infrastructure, in hosting and cloud, so that remote access and backups live in the same place rather than being two separate systems nobody quite manages to coordinate.

Yes, and in a firm it deserves special attention because email moves money: client transfers, payments on account, last-minute changes of bank details. We configure professional email on your own domain, anti-phishing filters and the technical records that make it harder for anyone to send email pretending to be your firm. But no filter stops one hundred per cent, and the fraud that hurts most usually comes in by phone or through an email that looks like it's from a real client asking to change the destination account for a payment. That's why the other half is training the team to be wary of any urgent change to payment instructions and always to verify it through a different channel from the one it arrived on, never by replying to the same message. The same manipulation pattern shows up with people who call claiming to be technical support so you'll give them access to your computer; we explain it in how to spot a fake tech support call, and the whole firm should know about it, not just whoever looks after the IT.

One copy isn't enough, and keeping it on the same disk you use every day doesn't count as a backup either. The benchmark we follow is to have several copies of anything you can't afford to lose, on different media, with at least one outside the physical office: that way a fire, a theft or ransomware that encrypts everything it finds connected doesn't take the backups down with it. In a firm, that means active case files, email and your own tax and employment records, not just what the client sees. What really proves a backup works is restoring it and checking that the file opens; a backup that has never been tested is an assumption, not a guarantee. We explain the full method in the 3-2-1 backup rule, and we set it up so that it checks itself, without depending on someone remembering every week.

Yes, if that provider accesses computers holding your clients' data, and to provide support, they do. The GDPR calls them a data processor, and requires that relationship to be set out in writing: what data they handle, for what purpose, what confidentiality their staff commit to, what security measures they apply and what happens to the data when the relationship ends. It's common to find firms with all their data protection paperwork in order and without this contract signed, precisely with whoever has the most technical access to their systems. It's one of the easiest things to fix and one of the most often overlooked, and it works both ways: if a provider is surprised when you ask for this contract, that already tells you something about how they work. We explain it in more detail, including a list of what it should cover, in what an IT maintenance contract should include.