DLP for law firms is data loss prevention (DLP) built into the document system in which a law firm keeps its client files. DLP is software that watches the ways that data can leave an organisation, such as email, downloads and file sharing, and blocks the data that must not leave. Here, it is a part of the legal document management system.
Law firms hold some of the most sensitive files in any business: unannounced mergers, evidence in court cases, family settlements and patent drafts. A leak can harm the client and end the firm's relationship with that client. So the rules are set by matter and by client, not only by the type of data.
A general DLP tool recognises sensitive data by patterns. It knows that a PAN number has five letters, four digits and a letter. DLP inside a legal document system knows something more useful. It knows which client and which matter each file belongs to, who is allowed to open it, and how that person normally uses it. So it can apply rules such as "no file from this matter may be shared outside the firm" or "board papers of this client may be viewed but not downloaded".
For instance, consider an associate at a law firm in Kolkata who is working late on a client's restructuring. She tries to share a folder of the client's board minutes with her personal email address, so that she can read it at home. The matter's rule allows sharing only with people at the firm and at the client. So the DMS blocks the share and shows her the reason. It also tells the partner in charge of the matter. Nothing has left the firm.
Some rules watch behaviour instead of single actions. Say the same firm sets a limit of 200 downloads an hour for each lawyer. On a Friday evening, one account downloads 600 files from four different matters in ten minutes. The DMS pauses the account's downloads and alerts the IT team. The account may have been taken over by an attacker, or a lawyer who is about to leave the firm may be copying files. Either way, a person checks before the downloads resume.
Other rules stay with the file after it leaves. A shared document can carry a watermark with the reader's name, or a link that expires in seven days. A file can also be encrypted, so that only permitted readers can open it. Under India's data protection law, a firm that loses clients' personal data can face large penalties, which gives the firm one more reason to set these rules.
Many firms also run company-wide DLP, which watches every other exit from the firm, such as email and USB drives. Companies keep their own documents in enterprise content management (ECM) systems, which have similar controls.