By Charles Odendaal
In the fast-paced world of legal practice, speed is often a priority. When a client needs a document immediately, an associate might find the firm’s official server too slow. Consequently, they might use their personal Gmail to send the file. Or, perhaps they upload a large discovery folder to a personal Dropbox account to share it with co-counsel.
In the tech world, this is called “Shadow IT.” It refers to the use of any software or cloud service that has not been approved by the firm. While it might seem like a harmless way to “get the job done,” it is actually a major ethical and security risk. For a law firm, Shadow IT is not just a tech problem; it is a breach of your fiduciary duty.
The “Custody and Control” Problem
As a lawyer, you have an ethical obligation to maintain “custody and control” over client data. However, when an associate moves data into a personal account, the firm loses that control. Specifically, you no longer know who has access to that file or where it is stored.
For example, if that personal Dropbox account is hacked, the firm may not even know a breach occurred. Additionally, if the firm is sued or faces an audit, you cannot easily search personal accounts for relevant documents. Therefore, Shadow IT creates a massive blind spot in your firm’s defensibility.
The Departing Associate Risk
One of the greatest dangers of Shadow IT occurs when an employee leaves the firm. If an associate has been using a personal Gmail account for client communication, that history stays with them. As a result, your firm loses vital institutional knowledge.
More importantly, the departing employee still has copies of sensitive client files on their personal devices. In a professional environment, an IT Lead can “remote wipe” a firm-managed account. In contrast, you have no legal or technical way to wipe an employee’s personal cloud storage. This leaves your firm’s reputation in the hands of a former staff member.
Why Staff Resort to Shadow IT
Most employees do not use Shadow IT out of malice. Instead, they do it out of frustration. If your firm’s official tools are clunky or difficult to use, staff will find a workaround. For instance, if your file-sharing system has a 10MB limit, they will naturally look for an alternative to send a 50MB PDF.
Therefore, the solution is not just to “ban” personal accounts. You must provide a better, more secure alternative. This is a core part of [What Small Law Firms Get Wrong About IT]. If you give your team a fast, secure, and integrated platform like Microsoft 365 Business Premium, the need for “shadow” accounts disappears.
Professionalism Over Convenience
Convenience is a powerful motivator. However, in the legal profession, convenience must never come at the expense of privilege. Shadow IT is a “ticking time bomb” for many small law firms. By the time you realize it is a problem, the data is already gone.
Protecting your firm requires more than just policies; it requires the right infrastructure. It is time to shine a light on Shadow IT and bring your data back under your control. This shift is vital for building a defensible and professional modern practice.
