South African attorneys and conveyancers

Compliance and data protection for legal practices.

Matter files, client instructions and trust-account records need controlled access and reliable retrieval. Plan for lost devices, compromised email and unavailable practice systems without treating a backup as proof of professional compliance.

The regulatory context

Separate professional duties from the technical support behind them.

This guide focuses on attorneys' practices, including conveyancing and notarial work. The form of practice matters: LPC trust-account rules and FIC Schedule 1 do not apply identically to every person providing legal services.

Legal Practice Act and LPC

Preserve confidentiality and required records.

The LPC Code of Conduct addresses client confidentiality and legal professional privilege. The applicable rules also govern accounting records, client files and storage. Outsourcing IT does not transfer the practitioner's professional responsibilities.

Confidentiality and privilege are distinct. The practice must direct access and obtain legal assessment of disclosure or privilege questions; a support provider should not make those decisions.

Sources: Legal Practice Act; LPC rules and amendments.

FIC Act

Confirm the accountable institution and its duties.

FIC Schedule 1 item 1 covers attorneys, including conveyancers and notaries, practising for their own account, specified advocates and commercial juristic entities. PCC 47A explains the categories and registration arrangements; it does not classify every employee or advocate in the same way.

The practice needs the applicable due-diligence, recordkeeping, risk management and reporting arrangements. Secure storage supports these duties but does not establish that a client was properly assessed or a report correctly submitted.

Sources: FIC PCC 47A; FIC Guidance Note 7B.

POPIA

Limit access to the purpose and the matter.

Identity documents, financial information, family disputes and medical or criminal-history material can appear in the same matter. Assess the lawful grounds and additional restrictions for the information involved.

Sections 19–21 address safeguards and operators. Limit supplier access, agree written responsibilities and check foreign storage or support access under section 72 rather than assuming every cloud arrangement is acceptable.

Sources: POPIA.

This guide covers selected information and IT matters. It is not a complete legal checklist or a finding that your organisation complies. Confirm applicability with the people responsible for your legal, regulatory and operational duties. See the general Compliance page for the wider context, including PAIA.

Keep what is required, for the right reason

Keep the record, its history and the means to retrieve it.

Apply the relevant LPC and FIC requirements together. A minimum period is not an instruction to destroy a file when that period ends; the responsible practitioner must check continuing duties and holds.

Selected records to include in your retention schedule
Record category	Rule or decision to confirm	Useful evidence
Accounting records and client matter files	For firms within rule 54's trust-account practice scope, rule 54.9.1 requires at least seven years from the last entry in the particular record or file. Use that trigger, not an assumed seven years from invoice payment or matter closure. Confirm any longer requirement before disposal. Sources: LPC rules and amendments.	Record inventory, last-entry trigger, approved holds and a readable retrieval test.
Electronic records and files hosted offsite	Rule 54.9.2.1 addresses confidentiality, reasonable security and continuing immediate access for authorised persons from the firm's office, the Council and persons entitled by law. A service-provider contract must bind the provider to the relevant requirements. Sources: LPC offsite-storage amendment.	Reviewed storage agreement, authorised-access arrangements and retrieval evidence; a backup test alone does not prove immediate access.
FIC due-diligence, transaction and report records	Where the FIC Act applies, Guidance Note 7B distinguishes five-year minimums linked to relationship termination, transaction conclusion or report submission. Map the category and trigger alongside the LPC requirement and any continuing hold. Sources: FIC PCC 47A; FIC Guidance Note 7B.	Category-specific schedule, restricted access and traceable retrieval without exposing sensitive reports unnecessarily.
Original documents and files subject to a hold	Do not treat scanning or a backup as authority to destroy an original will, deed or other entrusted document. Have the responsible practitioner assess custody, return, evidential requirements and any dispute or legal hold before authorising disposal. Sources: Legal Practice Act; LPC rules and amendments; POPIA.	Custody register, documented practitioner decisions, holds and authorised return or disposal records.

A backup retention setting is not a complete records policy. Record the owner, retention trigger, access rules, storage location, legal holds and authorised disposal for each category. Test retrieval, including the application or licence needed to read it. POPIA section 14 requires a lawful reason for continued retention; avoid keeping personal information indefinitely by default.

From risks to working controls

Focus on matter access, payment instructions and usable recovery.

These are practical measures to assess against your environment and agreed service scope. Evidence should show what was checked, when, by whom and what still needs attention.

A person can read matters outside their role

Use named accounts and matter-level permissions where supported. Apply the practice's access restrictions, review administrator and supplier rights, and remove departed staff or temporary users promptly.

Possible evidence: Access approvals, periodic reviews and removal records.

A changed banking instruction diverts client funds

Verify new or changed payment details through an independently established contact route using details already known. Use the practice's approval procedure for release of funds. Do not rely only on a reply to the email requesting the change.

Possible evidence: Verification record, approved payment process and staff briefing.

A practice-system backup cannot restore a matter

Agree application-supported coverage for matter documents, email, databases and attachments. Include the supplier's restoration steps and required licences. Test a representative matter and have the practice validate its contents before relying on the result.

Possible evidence: Coverage map, recovery test, practice validation and outstanding gaps.

Email or remote support gives an intruder access

Assess multi-factor authentication, device protection and restricted administrative access. Require authorised support sessions and review supplier accounts and escalation contacts. An urgent support request still needs identity and authority checks.

Possible evidence: Approved settings, session records, access reviews and exceptions.

Recovery is mistaken for accounting assurance

Include trust and business-account system dependencies in the recovery plan. The responsible practitioner and accounting staff must validate restored balances and records through their normal checks; successful file restoration is not a reconciliation or audit.

Possible evidence: Recovery plan, validation responsibilities and recorded test outcomes.

The control examples draw on POPIA and banking-detail fraud guidance and NIST CSF 2.0. Technical guidance is not itself South African legislation or a compliance certificate.

What to check

Availability and backup solve different problems.

An offsite backup does not by itself provide immediate access to the working records required by LPC rule 54.9.2.1. Review access to the live archive, internet and power dependencies, recovery arrangements and supplier exit terms as separate questions.

A court, conveyancing or third-party portal should not be assumed to be the practice's complete matter archive. Confirm which documents, communications and transaction history remain under the practice's control, and how they will be retrieved if access ends.

Prepare before an incident

Assess disclosure, client funds and service disruption together.

Escalate compromised email, exposed matter files or suspected payment diversion to the responsible practitioner and Information Officer promptly. Use established bank contacts where funds may be at risk. Preserve messages, access logs and the timeline through controlled access; involve the practice's legal and compliance advisers in disclosure and reporting decisions.

Under POPIA section 22, reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person trigger notification duties. The responsible party must notify the Information Regulator and affected data subjects as soon as reasonably possible, subject to the Act's provisions. An operator must notify the responsible party immediately under section 21(2). There is no general 72-hour POPIA deadline. Sources: POPIA; Regulator guidance.

Agree who assesses the facts, preserves relevant evidence, makes notifications and authorises recovery. A technical incident report supports those decisions; it does not replace them.

Bastion Backups' role

Agree technical support around the practice's responsibilities.

Subject to an agreed scope, Bastion provides managed backup, recovery planning and testing, security checks and reporting, and controlled remote support. Start with your systems, record locations, authorised users and recovery priorities.

Define covered applications, matter and email locations, supplier dependencies and access restrictions. Specify who validates a restored file or accounting system and who authorises reconnection. Support access should follow the practice's confidentiality requirements and the written operator arrangement.

Agree coverage, exclusions, responsibilities, storage and supplier arrangements, reporting, testing, support availability and any costs in writing before work begins. Where we process personal information as an operator, the written arrangement must address the applicable POPIA duties.

The practice retains professional judgments, privilege and disclosure decisions, trust accounting, FIC compliance and regulatory submissions. Legal advice, an independent trust-account audit and compliance certification are not included merely by appointing an MSP. We do not certify regulatory compliance, promise that incidents will be prevented or guarantee recovery times without a specific agreed commitment.

Explore our supported solutions

Common questions

Decisions to make before selecting a service.

Does every employed attorney need a separate FIC registration?

PCC 47A distinguishes the accountable institution from its employees. It states that legal practitioners employed by a section 34(7) commercial juristic entity registered with the FIC need not register separately. Confirm the actual practice structure and current FIC guidance rather than registering every staff member by default.

Can we delete every client file after seven years?

No automatic deletion follows from the minimum. Apply the last-entry trigger where rule 54.9.1 applies, then check continuing duties, originals held in custody, instructions and legal holds. Keep an approved disposal decision and align backup retention with the resulting schedule.

Is every advocate an accountable institution under item 1?

No. Item 1 identifies advocates contemplated in section 34(2)(a)(ii) of the Legal Practice Act, alongside the other specified categories. PCC 47A explains the distinction. Do not extend that classification to every advocate without checking the statutory category.

Legislation and guidance

Check the source and its scope.

Content reviewed 16 October 2026.

Legal Practice Act 28 of 2014 — professional framework, forms of practice and trust-account responsibilities. Read with the LPC rules and subsequent amendments.
Legal Practice Council: rules, Code of Conduct and amendments — rule 54.9 covers accounting records and client files in its scope; rule 54.9.1 uses at least seven years from the last entry in the particular record or file. Code clause 3.6 addresses confidentiality and privilege.
LPC rule 54.9.2.1: electronic records and files hosted offsite — Gazette 44427, Notice 191 of 9 April 2021, linked by the LPC. Addresses confidentiality, reasonable security, authorised access and binding arrangements with the storage provider.
FIC PCC 47A: legal practitioners under Schedule 1 item 1 — final guidance on attorneys, conveyancers and notaries practising for their own account, specified advocates and commercial juristic entities; includes registration and risk guidance.
FIC Guidance Note 7B — issued 3 August 2026; customer due diligence, recordkeeping and risk management and compliance programmes for accountable institutions.
Protection of Personal Information Act 4 of 2013 — sections 14, 19–22, 26–33 and 72: retention, safeguards, operators, incidents, special personal information and cross-border transfers.
Information Regulator: handling security compromises — notification roles and reporting process; read with POPIA sections 21 and 22.
Standard Bank: change-of-banking-details scams — independent verification of changed payment instructions using contact details already known.
NIST Cybersecurity Framework 2.0 — voluntary guidance for risk management, access, protection, recovery and evidence; not South African legislation.

Check current legislation, regulator notices and your own contracts before acting. The practical examples describe matters to review; they are not a statement that every listed control is legally required for every business.

View all industry guides

Discuss your practice systems

Begin with your matter records, access and recovery priorities.

Tell us which systems you use and what you need to review. Please do not send client files, identity documents, sensitive system configurations, passwords or access codes with an initial enquiry.

Email us Call +27 83 651 6444