In Germany, lawyers, tax advisors, and auditors are bound by professional secrecy under §203 of the German Criminal Code. Many firm owners still don't take one thing seriously enough in 2026. If client data leaks to third parties through a cyber incident, that is not just "bad luck with IT". It is a breach under both professional and criminal law. It hits you in person, and you risk a ban from your profession.
The Legal Situation in 2026
- §203 StGB (breach of private secrets): applies to intent and to negligence. "We didn't know the mailbox wasn't encrypted" does not hold up in court.
- BORA §2 (professional rules for lawyers): a clear duty of secrecy, plus a duty to take technical and organizational measures.
- StBerG §57 (Tax Advisors Act): the same for tax advisors. They also have to keep client data secret when they send it electronically.
- WPO §43 (Auditors' Code): the same for auditors. A breach leads to proceedings by the professional oversight body.
- GDPR Art. 32–34: data breach reporting, with special protection for data under professional secrecy.
- NIS-2: in 2026, it affects more and more large law firms that supply clients in critical infrastructure.
What Firm Owners Often Underestimate
1. Email Is the Main Channel
90 % of client communication runs over email. A hacked mailbox means full access to ongoing cases, defense plans, and draft contracts. Classic phishing attacks on firms still work amazingly well in 2026.
The fix: mail security with CAPE sandbox, LLM-based BEC detection, and DLP for outgoing mail. All of it self-hosted, because client mail must not sit in a US cloud.
2. Cloud Office Is a Minefield for Your Profession
Take Microsoft 365 or Google Workspace with client files. Schrems II makes this tricky under the GDPR, and BORA §2 makes it even stricter. In 2024 and 2025, bar associations issued several notices. They said that a US cloud for client data is not tenable without explicit extra measures.
The alternative: a self-hosted office suite (OnlyOffice, Collabora, Nextcloud) or a European provider with a setup that meets Schrems II.
3. Encrypted Client Mail, but How?
PGP works on the technical side. But it often fails with the client ("how do I install GPG?"). S/MIME has the same problem. A realistic fix for 2026 is an eIDAS-compliant keyring with OnlyOffice integration. Add a client portal for encrypted file transfer in the browser.
4. Suppliers Put Secrecy at Risk
Tax advisors use DATEV, which is GDPR-compliant. Lawyers use SaaS tools made for law firms (Lecare, RA-Micro, advoware). These are often GDPR-compliant too. But is their hosting in the EU? And who are their sub-processors? Even a firm with 5 staff needs a TPRM module with a review every year.
5. A Ransomware Attack Can Make Client Data Public
Modern ransomware gangs steal data before they encrypt it. If no one pays, client data ends up on the darknet. For a law firm, that means more than a GDPR report. It also brings proceedings by the oversight body, a wave of client lawsuits, and damage to your name.
The fix: prepare with the 72h plan, a 3-2-1-1-0 backup strategy, and an incident response tabletop exercise.
What a Platform Brings
One security platform covers all 5 pain points from a single source:
- Mail security with phishing and BEC detection: CAPE sandbox and a local LLM, self-hosted and GDPR-compliant.
- Client portal with encrypted file transfer: no more unencrypted mail attachments.
- OnlyOffice or Collabora as the office suite: with eIDAS signatures for contracts and powers of attorney.
- TPRM module for an overview of suppliers: including tracking of sub-processors.
- Backup with immutable storage: protects against ransomware and logs each restore test.
- Audit trail for access to client data: who opened which file, and when? This matters in a dispute.
What Setup Takes
- Solo practice (1–3 professionals): about 3 months of setup and about €25 k up front. Often it makes sense to team up with other firms.
- Mid-sized firm (10–30 professionals): about 6 months and about €80 k up front. It pays off within 2 years through oversight proceedings you avoid.
- Large firm (100+ professionals): about 9 months and about €200 k up front. Clients often require ISO 27001 certification of the firm.
Compliance Mapping
- §203 StGB: breach of secrecy, punished by prison or a fine.
- BORA §2 / StBerG §57 / WPO §43: duty of professional secrecy with technical and organizational measures.
- GDPR Art. 32–34: data breach reporting.
- NIS-2: matters more and more for large firms that supply critical infrastructure.
- BRAO §59b (German Federal Lawyers' Act): oversight proceedings after a breach.
Conclusion
In 2026, German professionals bound by secrecy face clear legal, regulatory, and criminal duties. "We're just a small firm" is no excuse, because §203 StGB does not care about firm size. Every serious firm needs a security and compliance platform in 2026. It should bring mail security, an encrypted client portal, eIDAS signatures, and a TPRM module. That is basic infrastructure, not a premium extra.