Law Firm IT Security Checklist for Hong Kong: PDPO, Document Systems and Cyber Insurance Evidence

The short answer: A Hong Kong law firm's IT security comes down to ten checks: multi-factor sign-in for everyone, email protected against payment fraud, document system access matched to who works on each matter, encrypted and managed devices, prompt removal of leavers, backups you have restored, regular vulnerability scans, logs you keep, contracts with your IT providers, and an evidence file for your cyber insurer. Most of this sits in Microsoft 365 and your document system already. The cheapest first step is a fixed-price review that shows which checks you fail.

This checklist is for the managing partner, practice manager or office manager of a Hong Kong law firm of a few to a few hundred people. It is written for people who run the firm, not for IT engineers. Each item says what to check, why it matters for a law firm, and what evidence to keep. Where a law or professional rule applies, the public source is named so you can read it yourself or pass it to your adviser. We implement controls and keep evidence; the legal interpretation is for your own legal and compliance advisers.

Why law firm cybersecurity in Hong Kong is different

Three things make a law firm a different IT customer from most offices of the same size.

• Confidentiality is a professional duty, not only a policy. The Hong Kong Solicitors' Guide to Professional Conduct has a full chapter on confidentiality (Chapter 8, published by the Law Society of Hong Kong). A leaked file is a client problem and a conduct problem.
• The data is valuable to criminals. Client funds, completion dates and deal documents make law firms a target for email fraud, where a criminal sends payment instructions that look like yours.
• Records must be kept for years. The Law Society's anti-money laundering guidance says client due diligence documents, records and client files should be kept for 5 years, with longer periods for some matters (15 years for conveyancing and 7 years for tenancy matters, per the Law Society's AML FAQ). Long retention means old files must stay both available and protected.

The rules to have in view

These are the public sources most relevant to a Hong Kong law firm's IT. This is a pointer list, not legal advice.

• Personal Data (Privacy) Ordinance (Cap. 486), Data Protection Principle 4. A data user must take practicable steps to protect personal data against unauthorised or accidental access. Under DPP4(2), if you engage a data processor, such as an IT provider or cloud service, you must use contractual or other means to protect the data it handles. Source: the PDPO on Hong Kong e-Legislation (elegislation.gov.hk, Cap. 486) and the PCPD's explanatory material.
• PCPD Guidance Note on Data Security Measures for Information and Communications Technology (August 2022). Recommended, not mandatory, but the PCPD says it may refer to it when assessing compliance. It covers governance, access control, vendor management, cloud, BYOD and portable devices. Source: pcpd.org.hk.
• Data breach notification. Under the current PDPO, notifying the PCPD of a data breach is voluntary, and the PCPD publishes guidance on handling breaches. Check the current position with your adviser, as this is an area of proposed reform.
• Law Society Practice Direction P (anti-money laundering and counter-terrorist financing), which sets client due diligence and record-keeping expectations for solicitors, alongside the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615). Source: hklawsoc.org.hk, AML resources.
• The Solicitors' Guide to Professional Conduct, Chapter 8 (Confidentiality). Source: hklawsoc.org.hk.

Law firm IT security checklist: identity and email

1. Multi-factor sign-in for every account

Every user, partner and trainee, signs in to Microsoft 365 and your document system with a second factor: an app prompt or a security key, not only a password. Add conditional access, which means rules that block sign-ins from unexpected places or unmanaged devices.

• Evidence to keep: a report of users without multi-factor sign-in (it should be empty) and a screenshot of the policy.
• Common gap: shared mailboxes and old service accounts left without it. Our guide on cyber insurance MFA requirements for Microsoft 365 explains what insurers check.

2. Email protected against payment fraud

Turn on DMARC, SPF and DKIM for your domain (settings that stop others sending email that looks like it came from you), filter incoming mail for impersonation, and set a rule that any change of bank details is confirmed by phone on a known number.

• Evidence to keep: your DMARC record and the written payment verification procedure.
• See our article on email security and supplier payment fraud in Hong Kong for how these frauds usually work.

Law firm IT security checklist: document systems and devices

3. Document system access matches the matter

Whether you use a dedicated document management system, SharePoint or a file server, access should follow the matter: the people working on it can open it, others cannot. Where you act for parties whose interests could conflict, set up information barriers (blocking access between teams) in the system itself, not just in a memo.

• Evidence to keep: a quarterly access review signed by a partner, and the list of matters with restricted access.
• Common gap: "everyone can see everything" folders left over from when the firm was smaller, and external sharing links that never expire.

4. Encrypted, managed devices

Every laptop and phone that opens client files is encrypted, enrolled in device management (such as Microsoft Intune), kept up to date and able to be wiped remotely. Personal phones used for email should be limited to work apps that can be wiped without touching personal data.

• Evidence to keep: a device compliance report showing encryption and patch status.

5. Leavers removed the same day

When a solicitor, trainee or secretary leaves, their accounts are disabled on their last day, their devices are returned and wiped, and access to shared mailboxes and client portals is removed.

• Evidence to keep: a leaver checklist signed for each departure.
• Our IT offboarding and access revocation guide gives a step-by-step list you can adapt.

Law firm IT security checklist: backup, scanning and logs

6. Backups you have restored

Back up Microsoft 365 mail and files and the document system, keep at least one copy that cannot be changed or deleted (an immutable copy), and test a restore every quarter. With 5 to 15-year retention needs, also confirm old matters can still be opened.

• Evidence to keep: the date and result of the last test restore.

7. Regular vulnerability scans

Scan internet-facing systems and the office network for known weaknesses on a schedule, not only before a renewal. Our article on a failed vulnerability scan at a Hong Kong law firm's cyber-insurance renewal shows what happens when this is left until the insurer asks. The monthly price of a managed scan is on our vulnerability scanning pricing page.

• Evidence to keep: the latest scan report and the list of findings fixed since.

8. Logs you keep

Keep sign-in and audit logs from Microsoft 365 and the document system long enough to investigate an incident after it is discovered, which is often weeks later. Check your licence: the default log retention on some Microsoft 365 plans is shorter than firms assume.

• Evidence to keep: the retention setting and who reviews alerts.

Law firm IT security checklist: provider contracts and cyber insurance evidence

9. Data processor terms in every IT contract

Because of DPP4(2), each IT provider, cloud service and outsourced help desk that can see client data should have written terms on security measures, confidentiality, where data is stored, sub-contractors, breach reporting to you, and return or deletion of data at the end. Our PDPO compliance checklist for IT outsourcing in Hong Kong lists the clauses.

• Evidence to keep: the signed contracts and a list of which provider can access which data.

10. An evidence file for your insurer

Renewal questionnaires ask yes or no questions, but underwriters increasingly ask for proof. Keep one folder with the evidence from items 1 to 9: multi-factor report, device compliance, backup test, scan report, access review, leaver checklists and provider contracts. Our guide to answering a cyber insurance questionnaire with Microsoft 365 evidence maps common questions to the reports that answer them.

How to check your firm, and what it costs

You do not need to fix all ten at once. Find out which you fail first.

• A Microsoft 365 security audit. This checks most of items 1, 2, 4, 5 and 8 against the CIS Microsoft 365 benchmark, with read-only access. It is a fixed price, starting at US$450 for up to 10 users; the full price bands are on the Microsoft 365 security audit page. Our article on the Microsoft 365 security audit in Hong Kong explains what the report contains.
• A wider IT assessment. Covers the network, servers, backups and providers as well as Microsoft 365. See our IT assessment and audit service.
• Ongoing cover. Monthly managed IT plans include several of these checks as routine work: monitoring and patching on every plan, endpoint protection, backup and a multi-factor policy from Business, and email security and round-the-clock monitoring on Premium. Our IT support for law firms in Hong Kong page explains how this works for a firm.

The cheapest order for most small firms: audit first, fix the failures, then decide whether you need a monthly plan to keep them fixed.

A typical first 90 days

This is an illustration of a common sequence, not a client case.

• Month 1: Microsoft 365 security audit; switch on multi-factor sign-in and DMARC; remove old accounts.
• Month 2: document system access review; device enrolment and encryption; first vulnerability scan.
• Month 3: backup restore test; provider contract review; assemble the insurance evidence file before renewal.

FAQ

What should a law firm IT security checklist include?

At minimum: multi-factor sign-in, email fraud protection, document access by matter, encrypted managed devices, same-day removal of leavers, tested backups, regular vulnerability scans, retained logs, data processor terms with IT providers, and an evidence file for your insurer.

Does the PDPO apply to a law firm's IT provider?

The law firm is the data user and stays responsible. Under DPP4(2), it must use contractual or other means to make sure a data processor, such as an IT provider, protects the personal data it handles. Ask your adviser how this applies to your contracts.

Do we have to report a data breach in Hong Kong?

Under the current PDPO, notification to the PCPD is voluntary, and the PCPD publishes guidance on handling breaches. Your professional obligations to clients and your insurance policy may require you to act or notify. Check with your adviser and insurer.

How long must law firms keep records?

The Law Society's AML guidance states 5 years for client due diligence documents, records and client files, with longer periods for some matters, such as 15 years for conveyancing and 7 years for tenancy. Confirm the current figures against the Law Society's latest AML guidance.

What do cyber insurers ask Hong Kong law firms for?

Typically multi-factor sign-in, endpoint protection, backups with an offline or immutable copy, patching and email security, and increasingly evidence such as reports and scan results rather than yes or no answers.

How much does a law firm cybersecurity review cost?

A Microsoft 365 security audit starts at US$450 for up to 10 users, at a fixed price. Wider assessments are scoped to your firm.

Can Brocent support our document management system?

We support the devices, accounts, network and Microsoft 365 around it, and work with your document system vendor when the fault sits with their product.

Next step

Start with a fixed-price Microsoft 365 security audit to see which of the ten checks your firm fails, then read how we provide IT support for law firms in Hong Kong.