Three-quarters of law firms “unprepared” for EU data regulation with six months to go


Computer security: Firms that say they have not been subject to attack may well be wrong

Three quarters of law firms are still unprepared for the EU general data protection regulation (GDPR) which comes into force next May, potentially opening them up to large penalties, according to new research.

It also found that one in five law firms admitted to experiencing an attempted cyber attack in the last month and that fewer than a third of IT directors believed they were compliant with all cyber-security legislation.

The survey of 150 IT decision makers in the legal sector was commissioned by IT provider CenturyLink. In a report it said compliance with the GDPR was critical and that firms faced a maximum fine of €20m or 4% of turnover for data breaches.

The report cited Joanne Frears, consulting solicitor at Reading law firm Blandy & Blandy: “Those 75% of firms that admit they are not prepared… for these changes have a chance to get ready, but time is running out.”

She warned that Brexit would not help, because the UK would have to have “robust data protection compliance equivalent to GDPR” in any case, or else “most of the UK service and technology industries would fold as a result”.

As well as 20% of firms acknowledging recent cyber attacks, 44% said they had been the victim of one in the last year. Ms Frears cast doubt on the truth behind another finding, that a third of firms claimed they had never experienced a cyber attack.

“The average length of time it takes to discover a cybersecurity breach is 196 days… [Those firms] could simply be unaware that malware has been planted on their system, or that perhaps one of their accounts staff is currently being spear-phished [targeted with hackers’ emails].

“This lack of awareness and preparedness is one of the biggest risks the profession faces.”

The report noted that the two-thirds of firms possibly not compliant with existing legislation on data protection risked substantial fines.

A fine of up to £500,000 could be imposed by the Information Commissioner and data protection failures could also be punished with sanctions by the Solicitors Regulation Authority.

It suggested use of the cloud by firms could help improve data security because the technology was maintained properly by the provider. Also, internal firm behaviours with a cloud system were less likely to lead to breaches.

It found that 43% of firms had already moved to the cloud.

Tags:




Leave a Comment

By clicking Submit you consent to Legal Futures storing your personal data and confirm you have read our Privacy Policy and section 5 of our Terms & Conditions which deals with user-generated content. All comments will be moderated before posting.

Required fields are marked *
Email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Blog


The rise of zero-click searches: how to ensure your content is seen

Gone are the days when simply filling your written content with keywords would see returns. The bar for content has been raised and significantly so.


The FCA is trying to get to grips with motor finance mis-selling

The FCA will be urging the Supreme Court to move as quickly as possible in relation to a key ruling on motor finance. The regulator is taking an active approach to this important issue.


Embracing AI: The future of law firms

AI is set to fundamentally change how law firms operate, bringing about new efficiencies, enhancing strategic insights, and ultimately transforming the way legal services are delivered.


Loading animation