The Client Is Not the Data Subject, so Nobody Has to Tell Them

A law firm breach exposes a distinctive category of material: privileged communications, litigation strategy, draft agreements, internal investigation findings. This file concerns what obligation attaches to that, and finds the answer is very little.

Every regime in this corpus is triggered by the exposure of information about an identifiable individual. That is the definition the statutory clock runs on.

A stolen litigation file may contain very little of it. The strategy in a commercial dispute, the valuation model in an acquisition, the findings of an internal investigation — these concern corporate positions rather than personal data, and can be exposed without triggering a notification anywhere.

The professional duty of confidence to the client is a separate matter, enforced by regulators of the profession rather than by data authorities, and it does not generate a public record.

It does not appear in the breach registers, because no personal data threshold was crossed. And it is unlikely to be disclosed by the client, because acknowledging that an adversary holds your litigation strategy weakens your position in the matter.

A company facing a claim does not announce that the other side may know its settlement range. The incentive to stay quiet is strongest exactly where the consequence is most concrete.

Legal privilege generally depends on confidentiality being maintained. Whether a compromise waives it is jurisdiction-specific and contested, and this desk is not competent to resolve it.

The point that matters here is narrower: the breach may damage the client’s legal position through a mechanism entirely separate from the data being published — a form of harm nothing else in this database contains.

Graded medium. This is a structural argument about how notification law interacts with professional obligation, not a finding about a specific incident, and we have not identified reporting that quantifies it.