Editorial Team The legal profession is constantly trying to keep up with a huge challenge: how do we maintain client confidentiality when all our tech is in the cloud? Georgia’s Rules of Professional Conduct, especially Rule 1.6 on confidentiality, have always been strict, but cloud-based practice management adds a whole new game. We now have to seriously vet the technology we depend on to stay compliant. The Georgia State Bar gets this, and on February 1, 2026, they issued Formal Advisory Opinion No. 23-1 which finally gives us some clear, and very demanding, guidance on our ethical duties when using third-party cloud services for client files. This new opinion requires Georgia attorneys to get proactive. So, how does this actually change what we have to do?
Key Takeaways
- As of February 1, 2026, Georgia’s Formal Advisory Opinion No. 23-1 requires you to perform specific due diligence before using any cloud service for client data.
- Attorneys have a duty to conduct a full risk assessment of a cloud vendor’s security systems, encryption methods, and any compliance certifications before a single client file is uploaded.
- To comply with Rule 1.6, your service agreements with cloud providers must now spell out data ownership, the exact procedure for breach notifications, and where the data is physically stored.
- Your firm needs to create and document mandatory training for every single staff member on cloud security practices and the firm’s own data policies.
- Regularly auditing your cloud vendors and your own internal security practices isn’t just a good idea anymore. It’s an essential part of ongoing ethical compliance.
Formal Advisory Opinion No. 23-1: A New Standard for Cloud Security
Formal Advisory Opinion No. 23-1 from the Georgia State Bar updates how we all must approach technology. It makes it perfectly clear that using cloud computing to store or process confidential client information is allowed, but only if the attorney uses reasonable care to keep that data secure and private. This is a reinforced ethical mandate. The opinion ties this directly back to Georgia Rule of Professional Conduct 1.6, which says we can’t “reveal information relating to representation of a client” without informed consent or other specific exceptions. When you put client data onto a cloud server, you’re handing it to a third party, but the opinion confirms that the ultimate responsibility for protecting it never leaves your desk.
The opinion lays out several factors that add up to “reasonable care,” including a real understanding of the tech you’re using, a thorough investigation into the provider’s security measures, and having solid contractual protections in place. This move brings Georgia in line with guidance from other states, though this opinion is tougher than most in its focus on continuous oversight. According to the American Bar Association’s Standing Committee on Ethics and Professional Responsibility, the expectation of technological competence has been a consistent trend, and Georgia has now put explicit directives behind that expectation.
Due Diligence in Vendor Selection and Management
Formal Advisory Opinion No. 23-1 demands rigorous due diligence for cloud service providers. Attorneys can’t just pick a popular platform and hope for the best anymore. We have to perform a real investigation into the vendor’s security. This means actually examining their data encryption protocols, finding out their server locations, looking at their backup and recovery procedures, and checking for certifications like ISO 27001 or SOC 2 Type II. If you’re thinking about a document management system like NetDocuments, for example, you have a duty to go past the marketing fluff and dig into their security whitepapers and audit reports. This is about understanding the technical architecture that protects your client’s information.
The opinion also stresses that you need to know where client data is physically stored. If your data ends up on servers outside the U.S., it could be subject to foreign laws that don’t offer anything close to the protections we have here. That’s a huge deal for firms handling sensitive matters. A firm with an office near the Fulton County Superior Court on Pryor Street SW in Atlanta has to be completely aware of where its cloud provider parks its data, because you might be shocked to learn some big-name services default to overseas servers, which could instantly complicate your ethical duties under Rule 1.6.
It’s also suggested that attorneys must ask about the provider’s incident response plan. What happens if a data breach hits their servers? How quickly will firms be notified? What assistance will the provider give to help contain the damage and get word to the affected clients? These aren’t just good questions to ask. They’re now ethical necessities.
Contractual Safeguards: Beyond the Click-Through Agreement
Attorneys must now ensure their service agreements with cloud providers contain specific contractual safeguards. The standard click-through agreement you get with most consumer-grade services isn’t going to cut it anymore. The Georgia State Bar’s opinion makes it clear that firms need to either negotiate terms or get explicit confirmation that the contract meets our professional obligations, addressing things like data ownership, confidentiality duties, data retention, and breach notifications.
Specifically, your contract must state that the client’s data belongs to the client and that the cloud provider can’t use it for any purpose other than providing the service you’re paying for. It also needs strong confidentiality clauses that hold the provider and its staff to the same standard of secrecy as the law firm. This is important because Georgia’s data breach law, O.C.G.A. Section 10-1-910, has tough notification requirements. If your cloud vendor gets breached and your client’s personal information is exposed, your firm is on the hook for compliance, and the contract must spell out the provider’s duty to help. Without that contractual clarity, firms could find themselves in a difficult position, ethically and legally.
Another point: what happens to the data if the firm decides to switch providers or close its doors? The contract has to guarantee you can retrieve all client data in a usable format and that it will be securely and completely returned or destroyed. This is about fulfilling your ethical duty to protect client information long after the representation is over.
Mandatory Training and Internal Policies
Formal Advisory Opinion No. 23-1 requires attorneys to establish internal policies and provide mandatory training for the entire staff on cloud security and data handling. It’s not enough for just the managing partner to get it. Every single person in the firm, paralegals, assistants, receptionists, who might touch client data in the cloud needs to be trained on things like creating strong passwords, spotting phishing emails, using secure file-sharing methods, and knowing the firm’s specific rules for approved cloud platforms.
The opinion points toward having a written information security policy. This document should map out exactly how client data is managed from intake to archiving, listing the approved cloud services, the procedures for uploading and accessing data, and the exact steps to take if someone suspects a security problem. For a small firm in Midtown Atlanta, that might sound like a lot of work, but there are resources. The State Bar of Georgia itself frequently offers CLE courses on tech ethics that are a good place to start when building these policies and training programs.
Think about it: the entire firm’s compliance is compromised if just one employee shares a login or uses a personal, unapproved cloud account to move a file. Documented, regular training sessions aren’t just a good idea. They’re now a baseline component of demonstrating reasonable care.
Ongoing Monitoring and Risk Assessment
The ethical duty continues long after a provider has been selected and a contract signed. Formal Advisory Opinion No. 23-1 makes clear there’s a need for ongoing monitoring and risk assessment. Technology and cyber threats are always changing. What’s secure today might have a gaping hole tomorrow. Since cloud providers update their services and new vulnerabilities are constantly being found, attorneys have to keep up with these changes and periodically reassess their vendors’ security.
This could mean subscribing to security alerts from your providers, actually reading their updated SOC 2 reports, or maybe even running your own periodic third-party security audits. The opinion doesn’t give a set schedule, but it implies a constant state of vigilance. For instance, if your firm uses a cloud-based case management system like MyCase, firms should be regularly checking their security bulletins to make sure their use of the platform aligns with the latest best practices and, more importantly, with our ethical duties. This proactive stance is essential for using technology ethically.
Bottom line: the Georgia State Bar’s Formal Advisory Opinion No. 23-1 means our ethical duties around cloud-based legal tech now demand proactive due diligence, tough contracts, mandatory staff training, and continuous monitoring to ensure we’re actually protecting our clients’ confidentiality.
What is the specific rule behind Formal Advisory Opinion No. 23-1?
Formal Advisory Opinion No. 23-1 directly interprets Georgia Rule of Professional Conduct 1.6 which covers an attorney’s duty to keep all information related to a client’s representation confidential.
What security certifications should I look for in a cloud vendor?
Attorneys should look for certifications like ISO 27001, which covers information security management systems, and especially for SOC 2 Type II reports, which audit a provider’s controls for security, availability, privacy, and confidentiality.
Are there geographic restrictions on where cloud providers can store client data?
There’s no outright ban on storing data outside the U.S., but the opinion requires attorneys to know where the data is physically located and to assess whether that foreign jurisdiction provides adequate legal protection for client confidentiality.
What must a firm’s internal security policy cover for cloud services?
A firm’s policy needs to detail its approved cloud services, clear protocols for uploading and accessing data, strong password rules, guidelines for secure file sharing, and an actionable incident response plan for any suspected data breach.
How often do I need to reassess my cloud provider’s security?
The opinion doesn’t set a fixed schedule, but it implies a continuous obligation. Attorneys must regularly review provider security updates, watch for new vulnerabilities, and consider periodic audits to ensure they remain compliant.
