Law firms in New Zealand carry a regulatory load most other industries do not. Privileged communication, defensible retention, conflict checking, AML/CFT verification, OPC notification timelines, these are not best practices. They are obligations enforced by the Law Society, the Office of the Privacy Commissioner, and the Department of Internal Affairs.
Most managed IT providers can install Microsoft 365 and call it a day. We configure it for the way lawyers work: each matter partitioned, every access logged, sensitivity labels applied automatically, and the audit trail ready when an insurer or regulator asks.
The rules Australian law firms work under
Privacy Act 2020. Sets the baseline for how personal information is collected, stored, used, and disclosed. The Office of the Privacy Commissioner expects breach notification within 72 hours of confirming a notifiable privacy breach. For law firms, almost everything you handle is in scope, so the controls need to be both strong and verifiable.
Lawyers and Conveyancers Act 2006 and its Conduct and Client Care Rules 2008. Govern client confidentiality, conflict checking, file retention, and the trust-account discipline expected of every NZ practice. The Law Society audits against these.
AML/CFT Act 2009. Applies to most conveyancing and trust-account work. Requires identity verification, transaction monitoring, suspicious activity reporting, and an annual report to the DIA. Your IT setup needs to support evidence retention long enough to satisfy regulator inspection.
Privilege boundaries enforced in software, not just process.
