IT for Law Firms: Client Data, the Wwft and the NOvA Rules of Conduct

Lawyers work with confidential material by definition: criminal case files, divorces, acquisition documents, arbitration papers and legal professional privilege. A single misdirected attachment or one ransomware incident immediately brings Article 11a of the Dutch Advocates Act (Advocatenwet), Rule 3 of the Netherlands Bar's (NOvA) Rules of Conduct and the GDPR into play. In this article you'll learn how to set up a law firm's IT so that confidentiality, Wwft obligations and day-to-day workability all stay intact at the same time.

Why law firms need a dedicated IT set-up

A law firm looks much like other professional services businesses, but the risks aren't comparable. The duty of confidentiality under Article 11a of the Advocates Act applies to everything entrusted to the lawyer, continues after the engagement ends and covers everyone in the firm: partners, associates, trainees and support staff. A leak isn't just a GDPR incident; it is a disciplinary risk and a reputational disaster.

On top of that, a new explanatory note to Rule 3 on confidentiality took effect on 1 January 2025. The NOvA expects you to choose carefully which communication tools you use, which supplier sits behind them, how the data is processed and what level of security applies. A professional email address on the firm's own domain, hosted by a professional provider, is explicitly mentioned. Free Gmail or Hotmail for firm documents doesn't fit that picture.

For services covered by the Wwft (think real estate, corporate structures, buying and selling companies), the requirements of the Dutch Anti-Money Laundering and Anti-Terrorist Financing Act (Wwft) also apply, with supervision by the local bar presidents (dekens) on behalf of the NOvA. That makes setting up IT for a law firm a different discipline from doing so for a trading company. You'll find more sector context on our page on IT for law firms.

What Rule 3 and the NOvA explanatory note mean in practice

The revised explanatory note isn't a technical standard, but it is a clear benchmark. Translated into IT choices, it comes down to four things:

1. A deliberate choice of communication tools. The lawyer chooses email, chat, file sharing and video conferencing themselves, knowing where the data is stored and which supplier processes it. Consumer options (WhatsApp, free cloud services) for client documents are hard to defend in a disciplinary complaint.
2. Your own professional domain. A yourfirm.nl address with a business provider, not a generic provider address. Ideally set up with SPF, DKIM and DMARC. See our introduction to email security with SPF, DKIM and DMARC.
3. Permissions and access. Who can access which case file, and who can't. A support employee has no read access to criminal case files, and a trainee only gets access to the files they are working on.
4. Documentation. Taking good measures is one thing; being able to demonstrate them during an investigation by the local bar president or in response to a disciplinary complaint is another. Policies, protocols and logs should be ready to hand.

The NOvA itself offers a security scan and information security tips. Useful as a starting point, but it is a self-assessment with no mandatory certification. What your firm does with it is its own responsibility.

The Wwft for lawyers: where IT comes in

The Wwft doesn't apply to all legal services, but it does apply to a list of designated services in which the lawyer acts as a non-financial gatekeeper. Think of buying and selling real estate, setting up or transferring legal entities, and managing funds on behalf of clients. For those services, thorough client due diligence is mandatory.

In concrete terms, the Wwft requires that for every Wwft relationship you:

• Record and verify the client's identity (passport or ID plus registered address).
• Identify the UBOs (ultimate beneficial owners) of legal entities (anyone with an economic interest of 25 percent or more) and verify their identity.
• Draw up a risk profile based on client characteristics, the nature of the service and the country.
• Carry out simplified, standard or enhanced due diligence, with a politically exposed person (PEP) requiring enhanced due diligence.
• Monitor the transaction and report unusual transactions to FIU-Netherlands (the Dutch Financial Intelligence Unit).

For your IT, this means you need a system (in most firms, the practice management software) that records per case file: which UBO check was carried out, which sanctions list was consulted, when the risk assessment was drawn up and who signed it off internally. A manual Excel sheet is no longer defensible. Whereas notaries are subject to a stricter cash limit, lawyers fall under the standard Wwft thresholds for designated services. If you're unsure about a specific transaction, the local bar president is your first point of contact. See also our sister article on IT for notary firms for the KNB (Royal Dutch Association of Civil-law Notaries) equivalent.

Putting confidentiality into practice technically

Confidentiality as a professional rule translates into six technical choices that every well-run law firm has in order.

MFA on every login. For lawyers, multi-factor authentication isn't optional. No case file should be reachable with just a password. Take a look at our practical guide to implementing MFA.

Endpoint management. Every laptop and phone is centrally managed with encryption, remote wipe and patch management. A stolen laptop is then an insurance matter rather than a data breach. Without MDM, every loss is potentially reportable to the AP (the Dutch Data Protection Authority).

Network segregation. Client case files and administration on logically separated storage, with access rights per role. A receptionist has no visibility of criminal case files.

Secure client portals. Exchanging large files via email attachments is outdated. A client portal with encrypted upload and download is now the professional standard.

Email filtering and anti-spoofing. Phishing and invoice fraud at law firms are a well-known pattern. A basic firewall and Defender configuration aren't enough without properly configured SPF, DKIM and DMARC and an anti-spoofing policy for your own domain.

Immutable backup. Ransomware in the legal sector isn't hypothetical. The Dutch National Cyber Security Centre (NCSC) published a case in which a law firm was held to ransom for €5,750 in bitcoin after a phishing click, and recovered quickly thanks to a decent backup. Backups should run daily, with retention of at least 30 days and an offline or immutable copy.

GDPR and data breaches: 72 hours means 72 hours

The GDPR continues to apply in full alongside the NOvA rules and the Wwft. For lawyers, the obligation to report data breaches to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) within 72 hours of becoming aware applies wherever there is a real risk to the individuals concerned. Ransomware counts as a data breach as soon as the attacker has had to access data in order to encrypt it, which in practice is always the case.

So here's what you need to have ready:

• An incident register recording every security incident, even if it turns out not to be a data breach.
• Data processing agreements with every IT supplier that processes personal data.
• An internal protocol for assessing and reporting data breaches, rehearsed with a tabletop exercise. See what to do after a data breach.

Lawyers know better than anyone that a half-hearted notification is often more damaging than the notification itself. For your IT set-up, that means: better a technically tight platform with logs that actually prove something than a notification to the AP based on little more than impressions.

Digital signing: what is and isn't allowed

Digital signatures are regulated by the eIDAS Regulation, which has three levels: simple electronic signature, advanced and qualified. For private documents (employment contracts, NDAs, litigation powers of attorney), the advanced level usually works fine. Not for a notarial deed, though: that remains the notary's domain. For lawyers, an advanced electronic signature through a DocuSign or Signhost workflow is a pragmatic standard for the majority of documents.

What does a KNB- or NOvA-compliant IT set-up cost?

There's no special NOvA rate, but the ranges in the Dutch market in 2026 look like this:

• Managed Microsoft 365 workplace for lawyers: €45 to €75 per user per month for a mid-range set-up (Business Premium, MFA, EDR, immutable backup).
• Client portal and secure file sharing: a few euros per case file or licence, depending on the provider.
• Practice management software: a separate cost item that depends heavily on the supplier (Advocado, Cicero, LegalSense).
• One-off project covering baseline assessment, policy and training: realistically in the range of a few thousand euros to the low five figures, depending on your starting position.

Be critical of providers promising a complete "NOvA-compliant package" without the underlying documentation. Responsibility lies with the firm itself, not with the IT partner. For more guidance, see what outsourcing IT costs an SME.

A practical approach for a law firm

Here's how to tackle it without turning it into a major IT project:

1. Baseline assessment. Go through the NOvA information security tips, Rule 3 and (for Wwft services) the Wwft checklist. For each point, record whether you comply fully, partly or not at all.
2. Quick wins. MFA on everything, a password manager, endpoint encryption, SPF/DKIM/DMARC, and retention on email and OneDrive. See also our cybersecurity checklist for SMEs.
3. Introduce a client portal. Standardise the exchange of large or sensitive documents through a portal, not email.
4. Documentation and protocols. Set down your information security policy, bring your record of processing activities up to date, and keep the incident protocol and data breach protocol available in one place.
5. Awareness. Annual training for everyone, partners included, with a phishing simulation to find out where the real weak spots are.
6. Annual rhythm. A restore test, a supplier audit and a review of access rights. It's a small job if you do it every year.

Frequently asked questions about IT for law firms

Which NOvA rules apply to my law firm's IT set-up? The most important is Rule 3 on confidentiality, whose explanatory note was tightened on 1 January 2025 with regard to digital communication. In addition, Article 11a of the Advocates Act (confidentiality) applies, as does the GDPR (with the obligation to report data breaches to the AP within 72 hours) and, for services covered by the Wwft, the Wwft itself, with supervision by the local bar presidents. The NOvA itself offers a security scan and information security tips.

Can I use WhatsApp for client communication as a lawyer? The NOvA expects a deliberate choice of communication tool, supplier and security level. Using WhatsApp for short arrangements isn't prohibited, but for client documents and legal content a secure channel (email on the firm's own domain, a client portal or a business messaging solution) is safer. Document your choice and your reasoning in your information security policy.

When does the Wwft apply to my legal practice? The Wwft doesn't apply to all legal services, but it does apply to a list of designated services: buying and selling real estate, setting up or managing legal entities, managing funds on behalf of clients, and advising on certain corporate structures. For pure litigation work, the Wwft generally doesn't apply. If you're unsure about a specific engagement, consult your local bar president or the NOvA's Wwft guidance.

Is ransomware at a law firm a data breach under the GDPR? Yes, in virtually every case. To deploy ransomware, the attacker must have accessed data in order to encrypt it, which qualifies as unauthorised processing. Where there is a risk to the individuals concerned (identity fraud, reputational damage), you report it to the Dutch Data Protection Authority within 72 hours. The NCSC published a case in which a law firm was extorted for €5,750 in bitcoin and recovered quickly thanks to good backups.

What does a NOvA-compliant IT workplace cost for a small law firm? Expect €45 to €75 per user per month for a managed mid-range workplace (Business Premium, MFA, EDR, immutable backup). A client portal and practice management software come on top of that. A one-off project covering baseline assessment, policy and training realistically falls in the range of a few thousand euros to the low five figures, depending on your starting position and the size of your firm.

Do I need my IT partner to sign a data processing agreement? Yes. Every IT supplier that processes personal data on your behalf (workplace management provider, backup provider, client portal, practice management software) needs a data processing agreement. Without one, you don't comply with Article 28 of the GDPR, however technically sound the service may be.

Conclusion

A law firm's IT is no side issue. Rule 3 requires demonstrably careful choices, the Wwft requires thorough client due diligence with an audit trail where it applies, the GDPR continues to apply in full, and the cyber threat level for professional services remains high. The good news: if you approach it as an annual rhythm (baseline assessment, quick wins, client portal, protocols, awareness), it's manageable without setting up a major programme.

TRON Group works as an IT partner for law firms and other legal professionals. Our approach: a baseline assessment against Rule 3 and (where applicable) the Wwft checklist, a managed workplace with immutable backup, data processing agreements in order and an annual supplier audit included. Take a look at our sector approach on IT for law firms or call +31 85 303 5869 for a no-obligation conversation. Moving IT Forward, in the legal sector too.