For many law firms, resilience is still treated as an IT issue. It sits with a service provider, it’s reduced to backups and it’s often assumed to be “handled”. But in 2026, that assumption is becoming increasingly difficult to justify. Resilience, the ability to withstand disruption and recover quickly, is no longer just about systems. It is becoming a legal and professional obligation.
From best practice to legal expectation
At its core, the law is built on duty of care, reasonableness, and foreseeability. Today, disruption is no longer hypothetical as cyberattacks, infrastructure failures, and data loss become expected risks in the South African operating environment. This changes the standard and if disruption is foreseeable, then so is the obligation to prepare for it. The question is no longer about having backups but rather, can you continue to operate when your systems fail? Resilience is no longer best practice, but rather an increasing measure of professional reasonableness.
POPIA, enforcement, and the risk of negligence
This shift is most evident in POPIA enforcement. With the Information Regulator moving into active enforcement, law firms must now demonstrate that they have taken appropriate and reasonable measures to protect client data. In practice, that means more than preventing breaches, it means being able to recover systems quickly; restore access to sensitive information and maintain continuity of service. If a firm cannot do this, the question becomes unavoidable about whether the controls are adequate. In this context, a lack of resilience may be interpreted as negligence, particularly where downtime or data loss impacts client confidentiality or access to information.
Downtime is legal exposure
For law firms, downtime is not just operational disruption, but legal exposure.
When systems are unavailable: deadlines can be missed, filings can be delayed, client mandates can be compromised, and in a profession built on trust and responsiveness, even short disruptions can have lasting consequences.
Clients may not ask about your infrastructure, but they will judge your availability.
The misconception of “we have backups”
Many firms still rely on the familiar reassurance that they have backups. But backups do not restore a working practice. They do not rebuild systems quickly nor restore applications and workflows and ensure access to case files under pressure. Without a tested disaster recovery capability, a firm may have its data but still be unable to operate. And in a legal practice, time is often the most critical factor.
Resilience as proof of due diligence
Perhaps the most important shift is that resilience is becoming evidence. In the event of a breach, outage, or dispute, firms are increasingly expected to demonstrate that risks were identified, controls were implemented, and that those controls were tested and effective. Having a plan is no longer enough; being able to prove it works is what matters.
A matter of survival — and trust
The stakes are significant. More than 90% of businesses that suffer prolonged data loss of more than 10 days go bankrupt within a year. For law firms, the impact extends further into reputation, client relationships, and professional standing. In a digital-first environment, downtime is visible, and when one firm is unavailable, another is not. Resilience, therefore, is not just protection; it is client retention, brand protection, and competitive advantage.
The bottom line
Resilience is no longer an IT conversation. It is a legal one, and it speaks directly to duty of care, regulatory compliance, and the ability to deliver on client mandates under pressure. And increasingly, it will determine not just how a firm recovers but how it is judged.
Where law firms should start
For many firms, the challenge is not recognising the risk, it’s knowing how to assess it. A practical first step is to move beyond assumptions and establish a clear view of your current resilience.
Metrofile Cloud’s Downtime Resilience Assessment is designed with professional services firms in mind, helping you:
- Evaluate your ability to recover critical systems and case data
- Identify gaps in your current backup and recovery approach
- Align your environment with POPIA expectations and insurer requirements
- Build a clear, defensible resilience strategy
Because in today’s legal environment, it’s not enough to believe you are protected; you need to be able to prove it.
