Email confidentiality rules for law firms, explained.
What the ABA, Canadian law societies, and privacy statutes actually require when client information moves by email — in plain language, with the primary sources.
First principles
The duty, in plain terms.
Every jurisdiction starts from the same two obligations: keep client information confidential, and be competent with the technology you use to handle it. Neither rule says the word "email." Both reach it. A lawyer does not breach the duty because an email goes to the wrong place — the duty is about the efforts made before it went wrong. That is why nearly every rule below turns on two words: reasonable efforts.
Jurisdiction · United States
Four rules do the work.
The anchor obligation
Model Rule 1.6(c)
"A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client."1
Note inadvertent. The rule is not only about hackers — it explicitly covers accidental disclosure, which in practice most often means a misdirected email.
When ordinary email stops being enough
Formal Opinion 477R (2017)
Retired the 1999-era comfort that blessed unencrypted email generally. The standard is now fact-based, matter by matter: routine communications may be fine over ordinary email; sensitive matters may require "particularly strong protective measures" — including encryption — and the lawyer is expected to make that judgment deliberately, not by default.2
After something goes wrong
Formal Opinion 483 (2018)
When a breach involving material client confidences occurs, the lawyer must act promptly to stop it, assess it, and notify affected current clients — silence violates the duty to communicate under Rule 1.4. The clock starts when the firm knows.3 Firms with no systematic way of detecting a misdirected email carry the most risk.
The competence layer
Rules 1.1, 5.1 & 5.3
Comment 8 to Rule 1.1 requires keeping abreast of "the benefits and risks associated with relevant technology" — adopted in some form by the vast majority of states. Rules 5.1 and 5.3 make supervising lawyers responsible for staff and vendors, turning email practice into a firm-level obligation.4
Jurisdiction · Canada
Three regimes stack.
Model Code · s. 3.3
Strict confidence
The FLSC Model Code requires holding "in strict confidence all information concerning the business and affairs of a client" — with commentary on accidental disclosure, and technological competence written into the Code since 2019. Provincial law societies enforce it.5
PIPEDA · Federal
Report & record
A breach of security safeguards creating a "real risk of significant harm" must be reported to the Privacy Commissioner and affected individuals — and every breach, reportable or not, must be recorded for 24 months. Knowingly failing to do either carries fines up to $100,000.6
Law 25 · Quebec
The strictest regime
A confidentiality incident presenting a risk of serious injury must be reported to the Commission d'accès à l'information and the persons concerned — and firms must keep an incident register. Diligence expectations around outgoing communications are correspondingly higher.7
What "reasonable efforts" actually means
No rule hands firms a checklist. Both the comment to Rule 1.6 and Opinion 477R describe a weighing exercise.1,2
The factors:
- The sensitivity of the information
- The likelihood of disclosure without added safeguards
- The cost and difficulty of the safeguards
- Whether they would impair the representation
The practical translation: the more sensitive the matter and the cheaper the safeguard, the harder it is to defend not having it.
The failure mode
Where firms actually fail is not exotic.
52%
of legal-sector data breaches come from sharing information with the wrong person — most often by email.8
#1
Misdirected email is the leading cause of inadvertent privilege waiver in legal practice.9
39%
year-over-year increase in reported data breaches across the legal sector.10
Everyone makes mistakes — the rules quoted above assume it. What they do not forgive is a workflow with no safeguards around the mistake: no policy, no friction where it matters, and no way of knowing an email crossed the line until a client or a regulator says so.
In practice
What compliance looks like operationally.
A written email policy.
What categories of client information may move by email, to whom, and when encryption is required. This is the document that turns 477R's matter-by-matter judgment into something associates can actually follow.
Training and a mistake-tolerant culture.
Incidents surface fastest when the person who noticed the error is not afraid to report it. Notification clocks under Opinion 483, PIPEDA, and Law 25 all start from knowledge — a culture of silence extends exposure.
Pre-send friction where warranted.
Send delays, external-recipient warnings, and attachment checks — native settings in Outlook and Gmail, or dedicated data-loss-prevention tools. Effective for the errors a sender can catch in the moment; limited against the ones they cannot see.
Encryption for sensitive matters.
The "particularly strong protective measure" 477R contemplates when the sensitivity of a matter warrants it.
Systematic post-send review.
The gap most firms miss. Pre-send tools depend on the sender noticing; the rules' notification duties depend on the firm knowing. A systematic review of outgoing email after it leaves, which flags misdirected recipients, privileged content sent externally, or policy violations while there is still time to act, is how firms close the distance between an error occurring and the firm knowing. This is the specific problem Super's email compliance review is built for.
An incident-response plan mapped to your clocks.
Who assesses materiality, who notifies clients under Opinion 483, who reports under PIPEDA or Law 25, and where the 24-month record lives — decided before the incident, not during it.
Questions firms ask.
What comes up when firms put these rules into practice — answered from the sources above.
Is unencrypted email ever acceptable for client communication?
Yes. Opinion 477R does not ban ordinary email — it requires a fact-based judgment. Routine communications on non-sensitive matters may be fine over standard email; highly sensitive matters may require stronger measures, including encryption. What is no longer defensible is never making the judgment at all.
Does a misdirected email always have to be reported?
No — the trigger depends on the regime. Opinion 483 turns on whether material client confidences were compromised; PIPEDA turns on a real risk of significant harm; Quebec's Law 25 turns on a risk of serious injury. But under PIPEDA a record must be kept of every breach regardless, and every regime assumes the firm actually knows the email went astray — which is the operational gap.
Does privilege survive a misdirected email?
Sometimes. In US federal practice, whether inadvertent disclosure waives privilege typically depends on the reasonableness of the precautions taken and how promptly the error was addressed once discovered. Fast detection and a prompt response are not just damage control — they are part of the legal argument that privilege was preserved.
Do the rules require any specific technology?
No. Neither the ABA rules nor the Canadian codes name products or mandate particular tools. The duties are outcome-based: reasonable efforts, calibrated to sensitivity, cost, and practicality. Technology choices are the firm's — what gets scrutinized is whether the overall efforts were reasonable.
What about AI tools that touch client information?
ABA Formal Opinion 512 (2024) requires lawyers to understand whether an AI tool is self-learning — whether client data is used to train it — and to obtain informed consent where client information is involved. When evaluating any vendor, ask that question in exactly those terms.
The rules expect you to know. Most firms can't.
Super reviews every outgoing email the moment it's sent and delivers an immediate compliance audit — closing the post-send gap the regimes above all assume you've covered.
Sources
- ABA Model Rule 1.6: Confidentiality of Information, including Comment [18].
- ABA Standing Committee on Ethics and Professional Responsibility, Formal Opinion 477R, "Securing Communication of Protected Client Information" (2017).
- ABA Formal Opinion 483, "Lawyers' Obligations After an Electronic Data Breach or Cyberattack" (2018).
- ABA Model Rule 1.1, Comment [8]; Model Rules 5.1 and 5.3.
- Federation of Law Societies of Canada, Model Code of Professional Conduct, s. 3.3 (Confidentiality) and competence commentary.
- Office of the Privacy Commissioner of Canada, mandatory breach reporting under PIPEDA (in force November 1, 2018).
- Commission d'accès à l'information du Québec — confidentiality-incident obligations under Law 25.
- Information Commissioner's Office data analyzed by NetDocuments, reported by Legal IT Insider.
- Verizon Data Breach Investigations Report and ALM Intelligence Legal Malpractice Report analyses of misdirected email and privilege waiver in professional services.
- ICO data security incident trends analyzed by NetDocuments, Q3 2023 – Q2 2024.
This guide is general information for law firm operations, not legal advice. Rules vary by state and province; consult your bar or law society's current guidance for your jurisdiction.
