From Damir

What Supporting Law Firms Taught Me About Confidentiality and IT

Damir Grubisa shares practical lessons about legal IT, confidentiality, identity, document access, vendor ownership and dependable recovery.

In a law firm, technology is part of the trust relationship with every client. Confidentiality depends on more than a privacy policy. It depends on how accounts, documents, devices, vendors and recovery processes are managed every day.

I start with identity and access

I want every person to have an individual account, appropriate access and a clear offboarding process. Administrator privileges should be limited and reviewed. Multifactor authentication should protect remote access, Microsoft 365 and other sensitive systems.

Document access needs deliberate boundaries

Convenient collaboration can create unnecessary exposure when permissions are inherited, links remain active or matter workspaces are not reviewed. I encourage firms to make access understandable to the lawyers responsible for the file, not only to IT.

Technology vendors share operational responsibility

Legal practices depend on document management, practice management, accounting, email and specialized applications. When systems interact, the managed IT provider should coordinate vendors and own the technical path to resolution. The firm should not have to act as the help-desk dispatcher.

Recovery must preserve both availability and integrity

A backup is useful only if the firm can restore the correct information safely and within an acceptable timeframe. I look for monitored backups, protected copies, defined priorities and regular restoration tests.

AI adoption needs governance before speed

Tools such as ChatGPT, Claude and Microsoft Copilot can support research preparation, drafting and internal productivity, but firms need clear rules for confidential information, approved accounts, human review and record handling. A useful tool does not remove professional responsibility.

My standard is clear ownership

Lawyers should know who protects each critical system, who responds to suspicious activity and who coordinates recovery. Clear ownership turns policies into dependable operations.

Review our legal IT support and law firm cybersecurity approach.