The law firm software is prompting an update. A new feature is a button that can consolidate entire client files. It’s pleasingly easy to spot. Where the file is sent, however, is less prominently displayed.
This is precisely where it becomes clear why data protection in tax firms involves more than just privacy notices and data processing agreements. A new feature may transmit data to other providers, alter access to client confidentiality, or create additional dependencies. The practical question, therefore, is: Is our firm permitted to use this feature for this process with this data?
When implementing a digital law firm process, three questions should be addressed separately:
These checks complement each other. A service provider may have robust technical security measures in place but still receive more data than it needs to perform its tasks. Conversely, a well-defined contractual framework is of little use if the archive cannot be restored after a failure.
When processing their clients’ personal data, tax advisors and the registered professional service firms referred to in Section 11(2) of the Tax Advisors Act (StBerG) are data controllers under data protection law. They are therefore not merely data processors acting on behalf of their clients in this context.
The situation may be different for technical service providers. For example, if a hosting provider processes personal data exclusively on behalf of and in accordance with the law firm’s instructions, data processing on behalf of a client may apply. What matters is the actual processing, not the title of the contract. In the case of data processing on behalf of a client, an agreement pursuant to Article 28 of the GDPR is required.
This does not yet resolve the issue of client confidentiality. If external service providers are granted access to client confidential information, the professional requirements of Section 62a of the StBerG also apply. These include, in particular, careful selection, access limited to what is strictly necessary, and contractual provisions regarding confidentiality and the use of other service providers. If the service directly serves a single client matter, the client’s consent is generally required for access to third-party confidential information. Whether this is the case with an AI function depends on the specific service provided.
Let’s go back to the example of the document summary. The law firm should first clarify what content the feature actually processes. Are only selected text passages transmitted, or are attachments and metadata included as well? Which providers are granted access? Are user inputs stored or used for the provider’s own purposes? Are data transfers to third countries taking place?
An existing contract for law firm software does not automatically answer these questions for every new add-on module. And even without a name, a file can still be identified based on amounts, dates, or unusual circumstances.
A good way to get started is to conduct a test using fictitious documents. For actual use, the law firm then determines which functions are enabled for which purposes and data. Anyone who uses a summary for professional purposes should verify it against the original. Especially with official notices, an omitted provision may be more important than the rest of the summary.
As the operator of an AI system, the law firm must also take steps to promote AI literacy among the individuals who work with it on behalf of the firm. This requirement stems from Article 4 of the EU AI Act, as amended. For the team, a hands-on exercise involving typical law firm cases is usually more helpful than a general introduction that ends with the question of how to handle the first real client file.
The German NIS2 Implementation Act has been in effect since December 6, 2025. Whether an entity is directly affected is determined by the BSI Act. The classification is determined primarily by the services offered, the types of entities covered, and, where applicable, the size of the entity . Tax advisory services alone do not make a law firm an entity subject to NIS2 requirements. Additional activities may require a separate assessment.
In practice, however, this issue can still come up at the law firm. For example, a registered industrial company can ask its service providers about access controls, data backup, and incident reporting procedures. This stems from the supply chain security requirements under Section 30 of the BSIG.
A security questionnaire alone does not make the law firm subject to NIS2 requirements. However, requirements that the firm contractually agrees to may become binding. Before making a commitment, it is therefore worth assessing what the firm can actually deliver and demonstrate.
If the law firm switches providers, can it export its documents in a usable format? Can assignments and required metadata also be transferred? Who can help if the import into the new system fails?
For covered data processing services, Chapter VI of the EU Data Act sets forth, among other things, requirements regarding provider switching and contract drafting. Regardless of this, it is worth conducting a practical export test. A downloaded file does not yet constitute a restored archive.
Here’s an example: The law firm notices that a link to payroll documents was accessible to unauthorized individuals. The first step is to block the link. Next, the firm must determine what personal data was affected, who may have had access to it, and what consequences the affected individuals may face.
If a personal data breach occurs, it must be documented. If the breach is likely to result in a risk to the rights and freedoms of natural persons, the law firm, as the data controller, must notify the supervisory authority without delay and, if possible, within 72 hours of becoming aware of the breach. If the risk is likely to be high, the data subjects must generally also be notified without delay. Other statutory or contractual reporting obligations must be reviewed separately.
In everyday practice, this means: The team should know who to contact immediately, who is responsible for conducting the risk assessment, and who makes decisions regarding reports. It’s better to clarify these responsibilities when there’s plenty of time rather than at 5:40 p.m. on a Friday.
The broader Digital Omnibus package includes, among other things, proposed changes to the GDPR. The legislative process is still ongoing. The proposed changes therefore do not provide a basis for treating current reporting requirements differently. This should be distinguished from the Digital Omnibus Regulation on AI, which has already been adopted and amended the EU AI Act.
Start with a process that involves a large amount of sensitive information, such as payroll or digital client files. Track where the data comes from, who accesses it, which services are involved, and how the documents can be exported or restored.
For this process, document which AI functions are permitted, who approves new functions, and how the team responds in the event of an incident. Review the rules whenever changes are made to the service. This will create a framework that can be applied to other firm processes.
K11 Consulting helps law firms integrate data protection and information security into these processes.
A law firm does not have to turn every new set of EU regulations into a separate project. However, it should be able to explain, for its most important workflows, which data goes where, who is authorized to view it, and what happens if something goes wrong.
That's also a good guideline for the next AI feature: First, figure out what happens to the file. Then decide whether to press the button.
Effective Date: November 5, 2026.