Paste your Bing Webmaster Tools verification code here

How and where do I encrypt sensitive client data?

Share it!
Reviewing how data is encrypted can get buried as a “to do” item – but it should be No. 1!

In Part 1 of this post I looked at what data encryption is, why its important for us to understand it, and what data should be encrypted where. This is Part 2, where I look at some encryption processes and software options.

You are most likely already using different encryption tools for different aspects of data storage and transit; so for example the software used to encrypt emails may be different to the software used for encrypting data stored on servers or PC’s. If you’re shopping for new encryption software, it may not be as simple as finding one provider that does a complete job everywhere.

Software marketing promises data security? Only the small print will tell you if the makers guarantee data security for business purposes

Specific software recommendations are beyond my expertise, but if you start by checking out reviews of encryption software for businesses, you’ll find a very mixed bag of offerings.

Local device Encryption

Some software packages, such as VeraCrypt, will encrypt data held on your local PC hard drive. This is essential for any device which could be stolen or misused by a third party. Another option for local devices is BitLocker, an encryption package that is part of Windows Pro operating systems.

Email encryption

Other encryption software, such as Cellcrypt, offers secure messages and encrypted voice calls for mobile devices. There are also numerous packages that offer end-to-end encryption for emails sent either from desktop computers or mobile devices. Microsoft Office 365 Enterprise E3 and E4 users can configure an email encryption service which does not require the email recipient to download software to unlock the encrypted email – instead they enter a pass-code.

Encryption of data in transit

Our sensitive data travels a lot, which means we need to know where it is going and whether its secure in transit

This is a complex but essential area of IT security and expert knowledge and input is essential. When our data travels, there’s a high risk of that data being accessed if it is not protected. Lower cost “network level” encryption and data protection is possible but it requires a combination of solutions which are beyond the remit of my basic knowledge.

One method is to create and use Virtual Private Networks to encrypt data in transit, commonly between local PC’s, mobile devices and servers on a work network. There is even a free worldwide network called Tor which claims to enable its users to use the internet anonymously and through encryption, and some commercial VPN options can be found here.

Encryption of data held “in the cloud”

So you’re using someone else’s computer to store your data. The provider says its secure and suitable for holding sensitive data, but is that assurance enough? Maybe not, especially if that guarantee cannot be found in the contractual small print. But there are software products which encrypt data you hold on someone else’s equipment, so if it is compromised it cannot be read. One of these products is BoxCryptor.

Encryption of data held on a server

Is the data “at rest” on your server encrypted? If not, it could be vulnerable. On Windows Servers, you can use Bitlocker to encrypt data at rest. Thales (formerly Vormetric) say their products offer encryption solutions for any server.  If you are not sure what server you have and whether data is encrypted on it, you need to know how it is encrypted, and also what the potential vulnerabilities are even if the data is encrypted.

What next?

You and I may be in deep water with this complex area of IT, but we need to know that we have the right solutions in place

As usual as with all IT related matters, this isn’t an easy decision making process and definitely one where you need to orientate yourself on the key issues then carefully assign the practicalities of choice and implementation to an impartial IT professional, with appropriate oversight from management. Now for the important disclaimer:  I cannot verify the suitability of any product mentioned in this post for use by law firms!

Some further guidance on encryption practicalities and the legal framework is provided by the Information Commissioner’s Office, and the Law Society provide comprehensive guidance on Cyber-Security issues for law firms.

If you haven’t done so already, the Law Society’s free online cyber-security course for Legal and Accountancy professionals is a great starting point for getting yourself orientated on the relevant issues. You could also complete a data/information security audit, where you work with IT professionals to complete a comprehensive report or map which shoes you how where your every aspect of your sensitive data is stored and sent, and addresses any potential vulnerabilities.

Whether you’re expert or inexpert on IT issues, your comments are welcome. Please also get in touch with me if you provide IT services to law firms and would like to write regular posts for this site on IT issues.

Share this post, like or follow
Follow by Email
Visit Us
Follow Me


I set up Law Practice Manager because I enjoy sharing fresh and original opinions and posts on law management issues. Facebook and Twitter: @LawManager1 LinkedIn group:

Leave a Reply

Specify LinkedIn Client ID and Secret in the Super Socializer > Social Login section in the admin panel for LinkedIn Login to work

Your email address will not be published. Required fields are marked *

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this. Please review the information under the heading "Information available to me about your use of this Site" for details of information collected about you and your use of this site: