NetworkDefender
NetworkDefender
Most lawyers know they have a duty to protect client information. Fewer know that duty now carries specific technology obligations, that Wisconsin's breach notification law applies to your firm without the exemption CPAs get, or what happens when a breach hits a firm that never put these requirements in place. This covers all of it: the Wisconsin Supreme Court Rules, the state breach law, the ABA standards that define the standard of care, and the federal rules that apply to certain practice areas. If you run a law firm in Wisconsin, the core of this applies to you.
For lawyers, the equivalent of a regulatory framework is the Wisconsin Supreme Court Rules of Professional Conduct, found in SCR Chapter 20. These are not a trade association's suggestions. They are adopted by the Wisconsin Supreme Court, they carry the force of law, and they are enforced through the attorney discipline system. A violation can cost you your license.
Two rules form the spine of your cybersecurity obligation, and a few others fill in around them.
SCR 20:1.6 (Confidentiality) is the one with teeth. Wisconsin's confidentiality rule is broad. It protects all "information relating to the representation of a client," not just information a client marked confidential. Effective January 1, 2017, the Wisconsin Supreme Court added a new paragraph (d): a lawyer "shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client." That sentence sits in the binding rule text, not in a comment, so it is a disciplinable obligation. It does not require a guarantee against every breach. It requires reasonable efforts, judged against the sensitivity of the data, the likelihood of disclosure, and the cost of safeguards.
SCR 20:1.1 (Competence) now includes technology. By the same 2016 order, Wisconsin adopted the technology-competence language from the ABA Model Rules. The competence comment now says a lawyer should keep abreast of "the benefits and risks associated with relevant technology." Wisconsin is one of 40 states that have formally adopted this duty. The language lives in a comment, which is interpretive rather than binding, but it is the accepted benchmark for what competence means today.
The supporting rules. SCR 20:1.4 (Communication) requires you to keep clients reasonably informed, which is the basis for telling a client when a breach touches their matter. SCR 20:5.1, 5.2, and 5.3 make partners and supervising lawyers responsible for the conduct of other lawyers and nonlawyer assistants, including outside vendors. Your duty extends to your staff and to your IT provider or cloud host. You cannot outsource the obligation by outsourcing the work.
The State Bar of Wisconsin's ethics committee has translated these rules into practical guidance through several formal opinions:
These opinions are guidance, not statutes, but they are the State Bar telling you how it reads the rules.
Two ABA formal opinions define the national standard of care. They are not binding in Wisconsin, but Wisconsin's own opinions cite them, and they are what a malpractice expert will measure your firm against.
ABA Formal Opinion 477R addresses secure communication. It retired the old assumption that ordinary unencrypted email is always fine. The current standard is fact-specific: ordinary email may be acceptable for routine matters, but stronger measures like encryption may be required when the information is especially sensitive or when the client or the law calls for it.
ABA Formal Opinion 483 is the breach-response playbook. It requires lawyers to make reasonable efforts to monitor for breaches, to act promptly to stop a breach and restore systems once one is detected, to investigate what happened and what data was affected, and to notify current clients when a breach involves their material confidential information. The standard is not perfection, but a firm that took no reasonable steps to detect or prevent an intrusion has a problem. Opinion 483 also strongly recommends a written incident response plan built before a breach, with roles assigned and a backup way to communicate if your email goes down.
Wisconsin Statute 134.98 is the hard legal mandate. It applies to virtually any business holding Wisconsin residents' personal information, and that includes your firm.
If you discover that personal information in your possession has been acquired by an unauthorized person, you must notify each affected individual within a reasonable time, not to exceed 45 days. If a single incident requires notifying 1,000 or more people, you must also notify the nationwide credit bureaus. Law enforcement can request a delay during an active investigation, but only on an explicit request.
Here is the part that separates law firms from accounting firms. The statute exempts entities that comply with GLBA or HIPAA. CPA firms are GLBA financial institutions, so they can use that compliance path and the federal notification rules instead. Law firms generally are not, because practicing law is not a financial activity and any financial aspect is incidental to legal services. That means most general-practice firms cannot rely on a GLBA exemption. Wisconsin's own 45-day rule applies to you directly.
"Personal information" under the statute means a person's name combined with an unencrypted Social Security number, driver's license number, financial account number with access code, or biometric data. Note the word unencrypted. The statute does not apply to data that is encrypted or otherwise rendered unreadable, which is one of the strongest reasons to encrypt everything. A lost or stolen encrypted laptop is generally not a reportable breach.
One more detail worth knowing: a failure to notify is not automatically negligence under Wisconsin law, but it is admissible as evidence of negligence or breach of a legal duty, and the State Bar has warned it could give rise to a malpractice claim. That matters when your firm ends up in civil litigation.
The rules above apply to nearly every firm. Depending on what you practice, federal overlays stack on top.
HIPAA, if you handle health information. When you create, receive, or maintain protected health information on behalf of a healthcare client, such as defending a hospital or physician, you become a "business associate" and must sign a Business Associate Agreement and comply with the HIPAA Security Rule. Personal injury, medical malpractice, insurance defense, and elder law are most likely to trigger this.
CJIS, if you touch criminal justice data. Criminal defense firms and firms with government contracts that access criminal justice information must meet the FBI's CJIS Security Policy: encryption, multi-factor authentication, access controls, audit logging, and fingerprint-based background checks for staff with unescorted access.
PCI DSS, if you take card payments. Any firm that accepts credit cards for fees or retainers must comply with the Payment Card Industry Data Security Standard. Using a payment processor built for law firms, one that collects card data on its own secure pages and never stores it on your systems, dramatically reduces your scope. Watch the edge cases: card numbers taken by phone or email pull you back in.
NIST 800-171 and CMMC, if you do federal contract work. Firms handling Controlled Unclassified Information for federal agencies or defense contractors must implement the NIST SP 800-171 controls, and for Department of Defense work, achieve CMMC certification. This is a heavy lift, but it applies only to firms in that supply chain.
If your firm holds client funds in an IOLTA trust account, and especially if you practice real estate, estate planning, or handle settlements, you are a prime target for wire fraud. The pattern is consistent: a criminal compromises an email account in a transaction, watches the thread, then sends fraudulent wire instructions right before closing. Business email compromise was one of the costliest cybercrime categories tracked by the FBI in 2024, and many cyber policies exclude funds held in trust and losses from transfers an employee was tricked into making. The defense is procedural and cheap: never accept or change wire instructions by email alone, verbally verify every instruction using a phone number you obtained independently, and require dual approval on trust-account wires. Wisconsin's trust accounting rule, SCR 20:1.15, sits on top of this.
Cyber liability and legal malpractice insurers have tightened their requirements sharply. Multi-factor authentication is now effectively mandatory, along with endpoint detection, tested backups, and a written incident response plan. The majority of cyber claims involve organizations that lacked MFA. Two things follow. First, answer your insurance application honestly, because an inaccurate answer can void a claim. Second, the documented security program your insurer wants is the same program that proves you made the "reasonable efforts" SCR 20:1.6(d) requires. The work counts twice.
Your firm needs these in place:
Start with multi-factor authentication. If it is not on every account that touches client data, that is your most urgent and least expensive gap, and the single control insurers and attackers care about most.
Next, write your incident response plan and a short security program, so your "reasonable efforts" are documented, not just intended. If you hold client funds, put the wire-verification policy in writing this week and train your staff on it; those losses are immediate, often uninsured, and entirely preventable.
Then map your practice area. If you handle health information, criminal justice data, card payments, or federal CUI, identify which overlay applies and treat it as a separate project. And if a breach has already happened at your firm without a documented response, talk to your malpractice carrier and your own counsel about your exposure now.
None of this is optional. Your duty to safeguard client information is written into the binding text of SCR 20:1.6(d), your competence duty now includes technology, and Wisconsin Statute 134.98 gives you 45 days to notify after a breach without the exemption CPAs rely on. The ABA opinions define what reasonable looks like, and your insurer increasingly requires it in writing. A firm that has not addressed these obligations faces the full stack when something goes wrong: disciplinary exposure, a malpractice claim, an insurance dispute, and the reputational damage that follows a confidentiality breach in a profession built on confidentiality.
The firms that handle this well are not the ones with the biggest IT budgets. They are the ones that document their security the same way they document their cases.
NetworkDefender Security helps Wisconsin law firms meet their confidentiality, competence, and breach-notification obligations. We build security programs and incident response plans, conduct risk assessments, and implement the technical controls the rules require. Contact us to schedule a security review.
Want to see where you stand first? Run through our free Cyber Insurance & Compliance Readiness Checklist. It takes about five minutes and covers the same controls your malpractice carrier and cyber underwriters ask about.