The Small-Firm Lawyer’s Client-Confidentiality Cheat Sheet.
What California's confidentiality and technology-competence rules now expect of the systems holding your client files, for a 1 to 10 attorney firm, on one page. You already know Rule 1.6. What changed is that the duty now expressly reaches the technology that stores and transmits client confidences, and most small firms have never had that layer independently checked. Here’s the picture in plain English, so you can ask the right questions before a breach or a bar inquiry asks them for you.
One short form. Instant download. We never ask for privileged or client information.
Your cheat sheet is ready.
Download it now. We’ve also emailed you a copy so it’s easy to find later.
Download the Client-Confidentiality Cheat Sheet Book your free security review →
Not sure where your firm stands? The review is a free technical security review: a plain-English findings list, no obligation.
One page. The whole picture.
The mandate: the rules that reach your technology
Rule 1.6 and Bus. & Prof. Code §6068(e) read to require reasonable efforts to protect the electronic version of client confidences. Rule 1.1's technology-competence duty (effective March 2021). And Formal Opinions 2010-179 and 2020-203. Your obligation here is ethical, not statutory, which makes it broader, not narrower.
What "reasonable" actually looks like
Know where client confidences live and how they’re protected. Encryption, unique logins and MFA, least-privilege access, audit logging, vendor diligence, staff supervision (Rule 5.3), and a breach-response plan. On by default, and reviewed on a cadence, not once.
What it costs to get this wrong
No per-violation fine schedule. Instead: State Bar discipline against your license, malpractice civil liability (Op. 2020-203), and California’s breach-notice statute (Civil Code §1798.82), which under SB 446 requires notice within 30 days of discovery as of January 1, 2026. The consequences are open-ended and personal.
The "my IT guy handles this" myth
IT keeps the computers running; your practice-management vendor secures their platform, not your network, devices, backups, email, or who still has access after someone leaves. Ask: "Can you show me, in writing, that client data is encrypted on every device and that our backups would actually restore?" No document means no answer.
General information only, not legal or ethics advice. The free review is a technical assessment of your IT environment, not a legal-ethics opinion or a determination of your compliance with the Rules of Professional Conduct.
Written for law firms by people who speak your matter-management software.
Down the road, and built for firms your size.
- Based in Menifee. Craig answers the phone himself.
- Remote-first, on-site across Menifee, Sun City, Murrieta, Temecula, Wildomar, Lake Elsinore when you need it.
- Member, Menifee Valley Chamber of Commerce.
- We run and document the technical safeguards behind your confidentiality duty.