Florida Law Firms Have a Tech Competence Obligation — Here's What It Means for Your IT

Your Ethical Duty Now Includes Your Technology

Florida lawyers have an ethical obligation that goes beyond knowing the law. The Florida Bar's Rules of Professional Conduct require attorneys to maintain competence in technology and to safeguard client information — and these aren't aspirational guidelines. They are enforceable rules that can result in discipline up to disbarment.

For managing partners, this means your IT infrastructure isn't just an operational concern. It's an ethical one. The security of your client data, the integrity of your communications, and the reliability of your document systems are all now part of your professional responsibility.

This guide translates the relevant Florida Bar rules into concrete IT requirements, so you know exactly what your technology needs to do to keep your firm compliant.

The Technology Competence Requirement

Florida Bar Rule 4-1.1 addresses competence. The comment to that rule — Comment 8 — explicitly states that to maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology.

This isn't a passing reference. The Florida Bar was one of the first states to adopt this technology competence language, and it has been in effect since 2012. What it means in practice is that a lawyer cannot simply claim ignorance of technology as a defense. If client data is compromised because you didn't understand the risks of your firm's technology, that's an ethical violation, not just an IT problem.

The Confidentiality Obligation

Rule 4-1.6 requires lawyers to make reasonable efforts to prevent unauthorized access to, or unauthorized disclosure of, information relating to the representation of a client. The comment to this rule provides factors to consider when determining reasonableness: the sensitivity of the information, the likelihood of disclosure, the cost and burden of additional safeguards, and the difficulty of implementing those safeguards.

"Reasonable efforts" doesn't mean perfect security. It means security appropriate to the sensitivity of the data and the size and resources of the firm. But for a law firm handling confidential client matters, the bar is higher than for a general small business. Here's what that translates to in IT terms.

Client File Encryption

Client files must be encrypted — both at rest and in transit. This means:

• Full-disk encryption on every laptop, desktop, and mobile device that could access client files. If an attorney's laptop is stolen from a coffee shop or a car, the client data on it must be unreadable without the encryption key.
• Encrypted email for any communication containing confidential client information. Standard email is sent in plain text and can be intercepted. Encryption ensures only the intended recipient can read it.
• Encrypted remote access. If attorneys work from home or travel, their connection to the firm's network must use a VPN or similarly encrypted channel.

Email Security Beyond Encryption

Email is the most common entry point for attacks on law firms. Your email system needs:

• Multi-factor authentication on every account, especially partner and administrative accounts.
• Anti-phishing filtering that catches spoofed emails and malicious attachments before they reach the inbox.
• External sender warnings that flag emails coming from outside the firm, so attorneys can quickly identify potential impersonation attempts.
• Mailbox auditing enabled so you can investigate if a breach occurs.

The Personal Device Problem

Many attorneys use personal phones or tablets to check email, review documents, or access the firm's network. This creates a significant confidentiality risk. If a personal device is lost, stolen, or compromised, client data on it is exposed — and the firm may not even know what data was accessible.

At minimum, personal devices used for work should have:

• Mobile device management (MDM) that allows the firm to remotely wipe work data if the device is lost or stolen.
• A separation between personal and work data, so the firm controls its own apps and information without accessing the employee's personal content.
• A passcode and biometric lock on the device itself.

What to Ask Your IT Provider

Your IT provider should be able to answer these questions clearly and specifically. If they can't, or if the answers are vague, that's a sign your firm's technology may not be meeting your ethical obligations.

1. 1Is every device that touches client data encrypted? Ask for a report showing encryption status across all firm devices.
2. 2Is email encryption enabled for outgoing client communications? How does it work, and is it easy for attorneys to use?
3. 3Is multi-factor authentication enforced on every account? Not just available — enforced.
4. 4What email security filtering is in place? What percentage of malicious emails does it catch?
5. 5Are our backups tested? When was the last successful test restore, and what were the results?
6. 6Is there an air-gapped or offline backup? If ransomware hits, can we recover from a copy the attackers can't reach?
7. 7Do we have mobile device management on all phones that access firm email?
8. 8What is our incident response plan? If we discover a breach, who do we call and what happens in the first hour?
9. 9How do we handle offboarding? When an attorney or staff member leaves, how quickly is their access revoked across all systems?
10. 10When was our last security assessment? What vulnerabilities were found, and have they been remediated?

Florida Bar CLE Requirement

The Florida Bar also requires attorneys to complete continuing legal education (CLE) that includes technology training. Three of the 33 required CLE hours must be in technology, recognizing that competence in technology is now fundamental to practicing law competently. This isn't just about learning new software — it's about understanding the security and confidentiality implications of the tools you use.

Your ethical obligation to maintain technology competence and protect client confidentiality isn't going away. It's expanding as the threat landscape grows and as the Bar updates its guidance. For Florida law firms, the question isn't whether your IT meets the standard — it's whether you can demonstrate that it does.

Dytech Group provides managed IT services designed around the confidentiality and security requirements of Central Florida law firms. Our cybersecurity services address the specific threats that target legal practices. If you want a security assessment that maps your current IT against your professional obligations, we can help.