How to Protect Client Data Without Breaking ABA Rules
A law firm hired me to build their invoicing system. The first thing their compliance officer asked wasn't about features or pricing. It was: "How do you protect our clients' data?" I didn't have a good answer. That conversation changed how I think about every piece of software I use.
What are the ABA Model Rules?
The American Bar Association publishes the Model Rules of Professional Conduct. These rules define how lawyers should behave. Most US states adopt them with minor variations.
The rule that matters for data protection is Rule 1.6: Confidentiality of Information.
A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.
Read that again. "Reasonable efforts." Not perfect efforts. Not impossible-to-breaches efforts. Reasonable ones.
In 2012, the ABA amended the rule to add Comment 18, which explicitly addresses technology:
"When transmitting a communication that includes information relating to the representation of a client, the lawyer must take precautions reasonable under the circumstances to minimize the risk of inadvertent or unauthorized disclosure." — Comment 18, Rule 1.6
In 2017, the ABA issued Formal Opinion 477R, which went further. It stated that lawyers must:
- Understand how their data is transmitted and stored
- Know the security measures of any cloud provider they use
- Use encryption for sensitive data in transit and at rest
- Regularly review their security measures
This is not optional guidance. This is the professional standard.
Do ABA rules apply to freelancers?
Strictly speaking, no. The ABA Model Rules bind licensed attorneys. If you are a freelance designer, developer, writer, or consultant, you are not subject to Rule 1.6.
But here is what most freelancers miss:
Your clients may be.
If you work with law firms, their compliance officers will ask you to meet ABA-equivalent standards. If you work with healthcare providers, HIPAA applies. If you work with EU clients, GDPR applies. If you work with financial services, SEC rules apply.
Even if you are not legally bound, the ABA standard is a reasonable benchmark for professional care. It answers the question: "What would a reasonable professional do?"
More importantly, many clients now include data protection clauses in their contracts. They require you to use encryption, maintain backups, and notify them of breaches. These contractual requirements often reference ABA, NIST, or ISO standards.
If you cannot explain how you protect client data, you will lose contracts. Not because you are doing something wrong. Because you cannot prove you are doing something right.
What are "reasonable measures"?
The ABA does not prescribe specific technologies. It prescribes outcomes. You must make reasonable efforts to prevent unauthorized access.
What counts as reasonable depends on:
- The sensitivity of the information. Client names are different from medical records. Medical records are different from trade secrets.
- The cost of additional precautions. A solo freelancer has different resources than a large firm.
- The difficulty of implementation. Some measures are trivial. Others require expertise.
- The extent to which the measure protects confidentiality. Encryption is more protective than a password.
- The likelihood of unauthorized access. Storing data on a public server is different from storing it on an encrypted local drive.
This is a balancing test. Not a checklist. But the ABA and ethics committees have given enough guidance that we can identify a baseline.
At minimum: encryption of sensitive data at rest and in transit, strong access controls (passwords, 2FA), regular backups with encryption, documented security policies, and ongoing review of security measures. This is the floor, not the ceiling.
If you cannot explain what you do to protect client data, you are below the baseline. Not because you are negligent. Because you have not thought about it.
The cloud risk nobody talks about
Most freelancers store client data in cloud tools. Invoicing software. Project management. Email. File storage. Communication platforms.
Cloud tools are convenient. They are also a risk.
When you store client data in the cloud, you transfer three controls to a vendor:
Control of the data. The vendor decides where it is stored. Who has access. When it is deleted.
Control of the keys. If the vendor holds the encryption keys, they can access your data. Even if they promise not to.
Control of the backups. If the vendor's backup fails, your data is gone. You have no independent copy.
The ABA Formal Opinion 477R explicitly addresses this. It states that lawyers must conduct due diligence on cloud providers. They must understand:
- Where the data is stored (jurisdiction matters)
- Who has access (employees, contractors, third parties)
- How it is encrypted (at rest and in transit)
- What happens in a breach (notification, liability)
- What happens if the provider shuts down (data portability)
Most freelancers have never asked these questions about their tools. Most cloud providers would struggle to answer them clearly.
This is not a condemnation of cloud software. Cloud tools solve real problems. But they also transfer risk. And risk must be managed, not ignored.
| Factor | Cloud-only | Local-first + encrypted backup | Hybrid |
|---|---|---|---|
| Physical control | Vendor controls location | You control location | Split control |
| Encryption keys | Vendor-held (usually) | Client-side only | Mixed |
| ABA Rule 1.6 compliance | Requires vendor due diligence | Easiest to demonstrate | Moderate complexity |
| Breach risk | Single vendor = single point of failure | No third-party access to live data | Depends on implementation |
| Recovery speed | Fast (if vendor available) | Fast (local restore) | Fast |
| Cost (3 years) | $180–$684+ (subscriptions) | $49 (software) + $60 (drive) + $72 (backup) | $200–$400 |
Practical steps for freelancers
After that conversation with the law firm, I rebuilt how I handle client data. Here is what I do now.
1. Inventory your client data
Before you can protect data, you need to know what you have. List every type of client data you hold:
- Contracts and agreements
- Invoices and payment records
- Client communications (emails, messages)
- Project files and deliverables
- Client contact information
- Financial data (bank details, tax IDs)
Classify each by sensitivity. Client names are low sensitivity. Bank details are high sensitivity. Medical records (if you work with healthcare) are critical sensitivity.
This inventory is the foundation. You cannot protect what you have not identified.
2. Move sensitive data to local storage
For high-sensitivity data, use encrypted local storage. Your machine is the first line of defense.
Local storage gives you physical control. You know where the data is. You know who has access. You control the backups.
This is not about avoiding cloud entirely. It is about placing sensitive data where you control it. Less sensitive data can live in the cloud. Highly sensitive data should not.
For invoicing and financial records, this means using a tool that stores data locally. LockMargin does this. Your database lives on your machine. It is encrypted with AES-256-GCM. The keys are derived with Argon2id and stored in your system keychain. No cloud. No third-party access. No vendor dependency.
If you want client-side encryption without configuring it yourself, LockMargin uses AES-256-GCM out of the box. Your keys never leave your machine.
3. Encrypt backups with client-side keys
Backups are critical. But backups must be encrypted before they leave your machine.
If your backup provider holds the encryption keys, your backups are not secure. They are accessible to the provider. To their employees. To anyone who compromises the provider.
Use a backup service that supports client-side encryption. The encryption key should live only on your machine. The provider should see only encrypted data.
This is defense in depth. If your machine is compromised, the attacker still needs the encryption key. If the backup provider is breached, the attacker gets encrypted noise.
4. Document your security measures
This is the step most freelancers skip. But it is the one that matters most in an audit or complaint.
Write down what you do to protect client data. What encryption you use. Where data is stored. How backups work. Who has access. When you last reviewed your security.
If you cannot explain your security measures, you cannot defend them. Documentation is not bureaucracy. It is evidence of reasonable efforts.
The ABA expects ongoing diligence. Not one-time compliance. Review your security measures at least quarterly. Update your documentation when you change tools or processes.
Encryption: the baseline, not the ceiling
Encryption is the foundation of data protection. But not all encryption is equal.
The current industry standard for data at rest. AES (Advanced Encryption Standard) with 256-bit keys in GCM (Galois/Counter Mode). GCM provides both confidentiality and integrity — it detects tampering. This is the standard used by banks, governments, and security-conscious software.
A modern key derivation function that is memory-hard, meaning it resists GPU and ASIC attacks. It is the winner of the Password Hashing Competition and is recommended by the NIST Digital Identity Guidelines. Older methods are still acceptable but less resistant to modern attacks.
When evaluating a tool, ask:
- What encryption algorithm is used? (AES-256-GCM is the standard)
- How are encryption keys derived? (Argon2id is the modern standard)
- Where are the keys stored? (System keychain is secure; vendor-held keys are not)
- Is encryption applied at rest and in transit? (Both are required)
If a tool cannot answer these questions, it is not suitable for sensitive client data. Not because it is malicious. Because you cannot verify it is secure.
Documentation: the invisible requirement
Most freelancers think data protection is about technology. It is not. It is about process.
Technology fails. People make mistakes. Vendors get breached. The question is not whether something will go wrong. It is whether you can demonstrate reasonable efforts when it does.
Documentation is how you demonstrate reasonable efforts.
Here is what you should document:
This documentation does not need to be complex. A single page is enough. But it must exist. And it must be updated.
If a client asks how you protect their data, you can show them this document. If a regulator asks, you can show them this document. If you are audited, you can show them this document.
Documentation is not proof of perfect security. It is proof of reasonable efforts. And reasonable efforts are what the law requires.
The Landlord Test for client data
I have a test I apply to every tool that holds client data. I call it the Landlord Test.
Five questions to determine whether you own your client data or are renting it. If you answer "no" to any of these, you are renting. And when something goes wrong, you will be at the mercy of the vendor.
- If the vendor disappeared tomorrow, could you still access your client data? Not eventually. Tomorrow morning. Could you open your invoices? Read client records? Generate reports?
- Can you read your data without their software? If the answer is no, your data is locked in their format. You do not own it. You have permission to use it.
- Can you back up your data without their permission? If you need to ask, you do not control your data. Control is the difference between ownership and rental.
- Do you know where your data physically lives? Not "the cloud." The cloud is marketing language. Every byte exists on a physical machine somewhere. Who controls it? Who can copy it? Who can delete it?
- Can you prove what you sent and received? If a client disputes an invoice, can you show the original? With a timestamp? With evidence it has not been changed?
Most cloud invoicing tools fail the Landlord Test. If the company shuts down, your data is trapped in their format. You get an export, maybe. A CSV. A PDF. But you do not get your Business Memory. You do not get the relationships, the history, the context.
Local-first tools pass the Landlord Test by default. Your data lives on your machine. In a format you can read without permission. SQLite was invented in 2000. It will exist in 2040. Your cloud tool might not.
The Landlord Test is not about paranoia. It is about time horizons. Client relationships last years. Tax authorities require records for seven years or more. Tools last years. Your data should outlive your tools.
If you want to understand the philosophy behind this, read The Ownership Manifesto. It explains why local-first architecture matters more than features.
An honest limitation
I am not a lawyer. I am not a security professional. I am a freelancer who had to figure this out after a client asked a question I could not answer.
This guide is based on my research and experience. It is not legal advice. If you handle highly regulated data — healthcare, legal, financial — consult a professional. The cost of a one-hour consultation is usually less than the cost of a single breach.
The ABA rules are complex. They vary by jurisdiction. They evolve over time. What was reasonable five years ago may not be reasonable today. What is reasonable today may not be reasonable in five years.
This guide gives you a baseline. It does not give you certainty. Certainty requires ongoing diligence. And ongoing diligence is what the law requires.
What I know is this: protecting client data is not optional. It is not a feature. It is the foundation of professional practice. Clients trust you with their information. That trust is the most valuable asset you have. Lose it, and you lose everything.
Frequently asked questions
Do ABA rules apply to freelancers who aren't lawyers?
The ABA Model Rules bind licensed attorneys. But the underlying principle — protect confidential information — applies to any freelancer handling sensitive client data. Many clients (law firms, consultancies, healthcare providers) contractually require you to meet ABA-equivalent standards. Even if you are not legally bound, the standard is a reasonable benchmark for professional care.
What is ABA Model Rule 1.6?
Rule 1.6 of the ABA Model Rules of Professional Conduct requires lawyers to make reasonable efforts to prevent unauthorized access to client information. In 2012 and 2017 (Formal Opinion 477R), the ABA clarified that "reasonable efforts" include understanding how data is transmitted, stored, and protected — including the security of any cloud tools used.
Is cloud storage allowed under ABA rules?
Yes, with conditions. The ABA permits cloud storage if the lawyer (or freelancer acting on behalf of a lawyer) makes reasonable efforts to ensure the provider maintains confidentiality. This means understanding where data is stored, who has access, how it's encrypted, and what happens if the provider is breached. Many ethics committees require due diligence before using cloud services.
What encryption standard should freelancers use?
AES-256-GCM is the current industry standard for data at rest. For key derivation, Argon2id is recommended over older methods because it is memory-hard and resistant to GPU attacks. The NIST Cybersecurity Framework and ABA Formal Opinion 477R both reference encryption as a reasonable measure. The key detail: encryption must be client-side. If the vendor holds the key, it's not your security — it's theirs.
What happens if a freelancer leaks client data?
Consequences depend on jurisdiction and contract. A lawyer could face disbarment. A freelancer could face breach-of-contract lawsuits, regulatory fines (under GDPR, HIPAA, or state laws), and reputational damage. Even without legal liability, a single data breach can end a freelance career. Clients talk. Reputation is the most valuable asset a freelancer has.
Does GDPR apply to US freelancers?
Yes, if you have EU clients. GDPR applies to any business processing personal data of EU residents, regardless of where the business is located. This means encryption, data minimization, breach notification within 72 hours, and the right to deletion. For US freelancers with international clients, GDPR compliance is not optional — it's a business requirement.
Is local storage safer than cloud storage?
Local storage gives you physical control. Cloud storage gives you accessibility. Neither is universally safer. The right answer depends on your threat model. For sensitive client data, local-first with encrypted offsite backups is the strongest position. You control the data, you control the keys, and you control the backups. Cloud-only storage transfers all three controls to a vendor.
What is the Landlord Test for client data?
The Landlord Test asks five questions about any tool holding client data: If the company disappeared tomorrow, could you still access your data? Can you read it without their software? Can you prove what you sent and received? Do you know where the data physically lives? Can you back it up without their permission? If you answer "no" to any, you're renting your client data — not owning it.
How often should I review my security measures?
At least quarterly. Technology changes. Threats evolve. A security setup that was reasonable 18 months ago may not be today. The ABA expects ongoing diligence, not one-time compliance. Document your review. If you can't show when you last checked your encryption, backups, or access controls, you cannot demonstrate reasonable efforts.
Do I need a lawyer to set up data protection?
No. Data protection is a technical discipline, not a legal one. You need encryption, backups, access controls, and documentation. However, if you handle highly regulated data (healthcare, legal, financial), consult a professional. The cost of a one-hour consultation is usually less than the cost of a single breach.
What to do next
If you have not thought about client data protection, start today. Not tomorrow. Today.
Inventory your client data. Write down what you hold. Where it lives. Who has access. This takes 30 minutes. It is the foundation of everything else.
Move sensitive data to local storage. Use encrypted tools. LockMargin stores your data locally with AES-256-GCM encryption. Your database lives on your machine. Your keys live in your system keychain. No cloud. No third-party access. No vendor dependency.
Set up encrypted backups. Use a service that supports client-side encryption. The encryption key should live only on your machine. Test your backups monthly. A backup you cannot restore is not a backup. It is a false promise.
Document your security measures. Write down what you do. Update it quarterly. If you cannot explain your security, you cannot defend it.
Apply the Landlord Test to every tool that holds client data. If you answer "no" to any of the five questions, you are renting your client data. And when something goes wrong, you will be at the mercy of the vendor.
Protecting client data is not about technology. It is about trust. Clients trust you with their information. That trust is the most valuable asset you have. Lose it, and you lose everything.
Read the Ownership Manifesto to understand why local-first architecture matters more than features. Or start with LockMargin today — one file, no subscriptions, and your client data stays yours.
Client data protection is not a feature. It is the foundation of professional practice.
Download the Client Data Protection Checklist (PDF)
One page. No email required. The 12 questions every freelancer should answer before handling sensitive client data.