Data Protection for Jamaican Law Firms

Law firms routinely handle highly confidential information. Files may contain identification documents, addresses, financial information, property information, health records, employment information, family information, criminal allegations or proceedings, witness information and litigation records.

Professional confidentiality obligations do not eliminate the need to consider the Data Protection Act, and much of this information is sensitive personal data.

Typical processing activities

• prospective-client enquiries and conflict checks;
• client onboarding and identity verification;
• legal case management and litigation;
• conveyancing, probate and family matters;
• corporate transactions;
• billing and, where applicable, client or trust accounting; and
• employee management.

Particular risks

Law firms can be attractive targets because one compromised account may expose information concerning numerous clients and matters. Risks include phishing, email compromise, fraudulent payment instructions, insecure document sharing, excessive access, physical files, portable storage, remote working and outdated access rights. Because the impact of an incident is high, a Data Protection Impact Assessment before adopting new systems and a rehearsed breach response are both worthwhile.

Build a real register

Do not create one entry called "client files." Map actual processing activities in your Personal Data Register. This makes it easier to understand the different purposes, information, recipients, retention requirements and risks.

Processors and retention

Document your data processors, document-management systems, cloud storage, e-signature, billing and IT providers, and review any international transfers. Set documented retention rules for closed matters rather than keeping everything indefinitely.