Law firms: client files, privilege and what sits on local drives

Most small firms have a place where client files are supposed to live: a document management system, a matter folder on a server, or a cloud workspace. Real life adds more locations. A lawyer drafts on a laptop, saves a working copy to the desktop, emails a draft, downloads a scanned exhibit, and keeps a backup of "the important ones" on a thumb drive.

This article stays on one narrow topic: where client information sits on your computers and how to keep that tidy. It does not address professional-responsibility questions, privilege rulings or ethics opinions. Those belong with your bar's guidance and your own counsel. This is general education, not legal advice. Your firm page is at /for/legal/.

Why the location matters

You cannot protect or retire what you cannot find. Client matters typically involve names, dates of birth, Social Security numbers, financial account details, and in some practice areas, health information. When those appear in files scattered across drives, three things get harder: knowing what you hold, controlling who can reach it, and closing out a matter cleanly when it ends.

In Nevada, NRS Chapter 603A requires businesses holding Nevada residents' personal information to maintain reasonable security measures and to notify of breaches. Every US state has its own breach-notification law, with different triggers and deadlines, so check the current law for the states where your clients live. If a firm handles health information for a client in a way that brings HIPAA into play, that is a question to settle with your own attorney before you assume anything.

Where copies tend to sit

• Desktop and Documents. Draft agreements, intake forms, spreadsheets of damages or asset schedules.
• Downloads. Records received by email or from a client portal, including identity documents and financial statements.
• Synced cloud folders. A shared folder created for one matter that continues to sync to a paralegal's home laptop.
• Exported case-list reports. Contact lists and billing exports, which carry client details in bulk.
• Saved email. Messages saved out of the mail program as .eml or .msg files with attachments.
• External disks and USB drives. Trial or hearing exhibit sets, matter archives, and one-off backups.
• Closed-matter leftovers. Working copies that were never deleted after the matter closed and the file was archived.

What a scan reports

MyVaultMate checks local drives, synced OneDrive and Google Drive folders and external disks for Social Security numbers and ITINs by pattern, payment card numbers (pattern plus a Luhn check), and driver's license, passport and date-of-birth values when they sit beside their labels. It also gives a keyword signal when a file reads like a medical record, without identifying individual records. Word and Excel (new and old formats), PDF, text, CSV, JSON, XML, HTML, .eml and Outlook .msg files are read. Pictures, videos, recordings and scanned PDFs are not read; they are listed as “Not scanned” with a risk score of 70. RTF and PowerPoint files, Outlook .pst data files, and zip archives are not scanned yet.

The product reads files for patterns. It does not know what is privileged, and it does not assess the content of your legal work. Each finding records the file path, the kind of data, a severity and, at most, a short redacted sample. The files and full values never leave the computer, and no field in the product holds a raw value. Detection is rule-based, so an occasional false alarm happens, and you decide what each file is.

Hygiene for the firm

1. Choose the home. Write down the one place matter documents belong and tell everyone.
2. Scan to learn. Run a first scan across every computer, including the partners' laptops and any external disks.
3. Triage. Work through the highest-severity findings first: bulk spreadsheets, then single ID copies.
4. Consolidate. Move legitimate working files into the matter system. Confirm the move before removing the stray copy.
5. Close matters properly. Add a step to the closing checklist: clear local working copies, Downloads and shared folders tied to the matter.
6. Follow your retention policy. Your counsel or your bar guidance governs how long files must be kept; do not delete files in bulk on a guess.
7. Repeat. Schedule scans so new strays surface quickly. Scans can run manually, hourly, daily or weekly.

A quick checklist

• One designated location for matter files, in writing.
• An inventory of laptops, desktops, external disks and synced folders.
• Downloads emptied on every machine at the end of each week.
• A closed-matter step that includes removing local working copies.
• Someone named as owner for the cleanup and for the follow-up scan.
• A conversation with your own counsel on retention, notification and any client-contract requirements.

The tool helps you find where personal data sits so these decisions are informed. The moving, encrypting and deleting remain yours or your IT provider's, and the legal questions remain with your counsel. A sample report is at /sample.