£60,000, 194 emails and 43 days: what law firms keep getting wrong on data protection.

The above numbers are taken from the plethora of examples of law firms that have fallen foul of data protection laws and subsequently made the headlines.

One was fined £60,000 after a cyber attacker got into its network through an old admin account that had no multi-factor authentication. Client data ended up on the dark web, and it took the firm 43 days to report the breach once it knew. Another firm, acting on a compensation scheme for victims of historic abuse, sent an email to 194 people using CC instead of BCC, exposing every recipient’s address to everyone else on the list. A third mistakenly disclosed thousands of privileged documents in response to a subject access request, and had to go to court to get them back.

None of these firms set out to fail. They failed because, somewhere along the way, someone didn’t recognise the risk in front of them, or didn’t know what to do once they had.

That gap is exactly what our new suite of data protection courses is built to close.

We’ve developed three short, practical e-learning courses designed specifically for law firms:

• Data Protection for Law firms gives all staff a working grasp of the data protection principles, third party data, privacy notices, dealing with SARs, and the new statutory complaints process introduced by the Data (Use and Access) Act 2025.

• Data Breaches for All Staff trains every fee-earner and support staff member to recognise a breach the moment it happens, and to know what to do (and what not to do) immediately. Timing matters because taking steps quickly often reduces any potential harm early on.

• Data Breaches for Managers equips managers and decision-makers to triage a breach properly: containing risk, deciding whether it meets the threshold for ICO or individual notification, and keeping the clear record of decision-making that regulators expect to see.

Data protection failures aren’t rare, and they aren’t confined to firms with weak systems. They happen because good people, under pressure, make mistakes. Training built around how breaches actually happen in a law firm and what to do about them, rather than generic compliance content, is what makes the difference.

Get in touch with the Kinch Robinson team to find out more about the courses, or to arrange a trial login.