Data Breach Policy

The procedure below is designed as an internal policy for Azar Law Offices, LLC. It includes prevention, staff responsibilities, incident containment, investigation, client notification, recovery, and documentation. It also incorporates the key principle that a law firm must protect client confidentiality while responding promptly to a suspected breach.

Policy Number: IS-001
Effective Date: October 16, 2026
Approved By: Managing Attorney
Review Frequency: Annually and following any significant security incident
Policy Owner: Managing Attorney or Designated Information Security Officer

Article I. PURPOSE

The purpose of this Information Security and Data-Breach Response Procedure is to establish written standards for protecting the confidential, privileged, personal, financial, and legal information maintained by Azar Law Offices, LLC (“the Firm”).

As an Alabama criminal defense law firm, the Firm regularly handles sensitive information concerning criminal charges, arrests, investigations, clients, witnesses, alleged victims, co-defendants, court proceedings, and financial transactions. Unauthorized disclosure or loss of this information could harm clients, compromise legal proceedings, impair the Firm’s operations, or violate professional and legal obligations.

This policy establishes procedures to:

1. Protect confidential client information from unauthorized access, disclosure, alteration, loss, or destruction.
2. Establish appropriate safeguards for electronic and paper records.
3. Identify, report, contain, and investigate suspected security incidents.
4. Determine whether a security incident constitutes a reportable data breach.
5. Comply with applicable Alabama law, other applicable laws, court orders, and professional obligations.
6. Restore affected systems and maintain continuity of legal services.
7. Document incidents, corrective actions, and lessons learned.

Article II. SCOPE

This policy applies to:

• All attorneys employed by or affiliated with the Firm in their professional capacity.
• Paralegals, legal assistants, administrative personnel, and other employees.
• Temporary workers, contractors, and other authorized persons who access Firm information.
• Third-party technology providers and vendors to the extent their contracts or services involve Firm information.
• All information systems, computers, mobile devices, storage media, email accounts, cloud services, paper files, and physical locations used for Firm business.

This policy applies to information concerning current clients, former clients, prospective clients, employees, witnesses, opposing parties, and other individuals whose information the Firm maintains.

Article III. DEFINITIONS

A. Confidential Information: Information relating to the representation of a client that is protected by applicable professional-conduct rules, attorney-client privilege, work-product protection, contract, or law.

B. Personal Information: Information identifying, or reasonably capable of identifying, an individual, including information protected by applicable data-protection laws.

C. Security Incident: An actual or suspected event involving unauthorized access, attempted intrusion, malware, phishing, loss of equipment, accidental disclosure, destruction, alteration, or disruption of Firm information or systems.

D. Data Breach: A security incident involving unauthorized access to, acquisition of, disclosure of, loss of, or compromise of protected information, or another event that triggers legal, contractual, or professional response obligations.

E. Incident Response Lead: The Managing Attorney or another person designated in writing to coordinate the Firm’s response to a security incident.

F. Sensitive Client Information: Information requiring heightened protection, including criminal histories, case files, witness identities, investigative materials, Social Security numbers, financial account information, credentials, and information concerning minors.

Article IV. RESPONSIBILITIES

4.1 Managing Attorney

The Managing Attorney shall:

1. Maintain overall responsibility for implementing and enforcing this policy.
2. Designate an Incident Response Lead and an alternate.
3. Ensure that suspected security incidents are promptly evaluated.
4. Determine, with appropriate professional or technical assistance, whether client confidentiality or legal obligations may be affected.
5. Approve external notifications, subject to applicable legal requirements.
6. Authorize necessary expenditures for investigation, containment, recovery, and remediation.
7. Ensure that the policy is reviewed at least annually.

4.2 Incident Response Lead

The Incident Response Lead shall:

1. Receive reports of suspected security incidents.
2. Maintain an incident log and preserve relevant records.
3. Coordinate containment and investigation efforts.
4. Contact qualified information-technology or cybersecurity professionals when appropriate.
5. Coordinate with the Managing Attorney regarding notification obligations.
6. Track corrective actions and confirm that recovery measures are completed.

4.3 Attorneys and Staff

Every attorney and staff member shall:

1. Protect information entrusted to the Firm.
2. Use only authorized accounts, devices, software, and communication methods for Firm business.
3. Maintain the confidentiality of passwords and authentication credentials.
4. Promptly report suspected phishing, unauthorized access, lost devices, misdirected communications, or other security incidents.
5. Cooperate with investigations and remediation.
6. Refrain from independently notifying clients, the media, opposing counsel, or outside parties about an incident unless authorized or legally required to do so.

4.4 Third-Party Providers

Where appropriate, the Firm shall use written agreements, security reviews, or other reasonable measures to address third-party access to confidential information.

Contracts with relevant providers should address confidentiality, appropriate safeguards, access limitations, incident reporting, cooperation with investigations, and return or destruction of Firm information when appropriate.

Article V. INFORMATION SECURITY SAFEGUARDS

5.1 Access Controls

Access to Firm information shall be limited to persons with an authorized business or professional need.

The Firm shall, as appropriate:

• Assign individual user accounts rather than shared accounts.
• Require strong, unique passwords.
• Enable multifactor authentication for email, cloud storage, remote access, and other systems that support it, particularly those containing client information.
• Remove or modify access promptly when a person’s role changes or employment ends.
• Review access permissions periodically.
• Prohibit unauthorized sharing of accounts or credentials.

5.2 Computers and Mobile Devices

Firm computers and mobile devices used to access client information shall be protected through reasonable technical safeguards, including:

• Current operating-system and application security updates.
• Supported antivirus, endpoint protection, or equivalent security controls.
• Automatic screen locking.
• Device encryption where available and appropriate.
• Remote locking or wiping capabilities for eligible devices.
• Restrictions on unauthorized software and removable storage.

Lost or stolen devices must be reported immediately, even if the device is believed to be password-protected.

5.3 Email and Electronic Communications

Personnel shall exercise particular care when transmitting sensitive information electronically.

The Firm shall require personnel to:

1. Verify recipient email addresses before sending client documents.
2. Use secure file-sharing or encrypted communication methods when appropriate to the sensitivity of the information.
3. Avoid transmitting sensitive information through unapproved personal email accounts.
4. Verify unusual requests to change payment instructions or transfer funds through a separate, trusted communication channel.
5. Avoid opening suspicious attachments or following questionable links.
6. Report suspected phishing or account compromise promptly.

5.4 Paper Files and Physical Security

Paper files containing client information shall be stored in secure locations with access limited to authorized personnel.

Personnel shall:

• Secure files when leaving work areas unattended.
• Avoid leaving client documents in public or shared spaces.
• Protect documents during transport.
• Use secure shredding or an appropriate confidential-disposal service when records may lawfully be destroyed.
• Prevent unauthorized persons from viewing files or computer screens.

5.5 Cloud Services and Remote Access

The Firm shall use authorized cloud-storage, case-management, backup, and communication services appropriate to the sensitivity of its information.

Personnel shall not upload confidential client information to unapproved applications or services.

Before adopting a new technology that will receive sensitive client information, the Firm should consider the provider’s access controls, encryption, data retention, security practices, incident reporting, and contractual protections.

5.6 Artificial Intelligence and External Tools

Confidential client information shall not be entered into publicly accessible artificial-intelligence tools, consumer applications, or other external services unless the Firm has evaluated and authorized the use, including its confidentiality, retention, training, access, and security implications.

Personnel must follow applicable professional obligations and Firm procedures when using technology to assist with legal work.

5.7 Backups and Recovery

The Firm shall maintain reasonable backup and recovery arrangements for important electronic records.

Backups should be protected against unauthorized access and, where feasible, ransomware or other events affecting primary systems. Recovery arrangements should be tested periodically to confirm that critical legal records can be restored.

5.8 Personnel Training

Attorneys and staff shall receive security training upon beginning work with the Firm and periodically thereafter.

Training shall address phishing, password protection, secure handling of client information, device security, physical security, and incident reporting.

Article VI. INCIDENT REPORTING

6.1 Immediate Reporting

Any person who discovers or reasonably suspects a security incident shall notify the Incident Response Lead or Managing Attorney immediately.

Examples include:

• A suspicious email or suspected phishing attack.
• An email containing client information sent to the wrong recipient.
• A lost, stolen, or compromised computer, phone, or storage device.
• Unauthorized access to a case-management system or email account.
• A ransomware demand or unusual file encryption.
• Missing paper files or documents.
• A vendor notification concerning unauthorized access to Firm information.
• An unexpected change to payment instructions or suspected fraudulent transfer.
• Unexplained deletion, alteration, or disclosure of client records. If the Incident Response Lead is unavailable, the report shall be made directly to the Managing Attorney or designated alternate.

No employee shall delay reporting while attempting to determine whether the event legally qualifies as a breach.

6.2 Information to Include

The reporting person should provide, to the extent known:

• Date and time discovered.
• Description of the event.
• Systems, devices, accounts, or files potentially involved.
• Types of information potentially affected.
• Individuals who may have been affected.
• Actions already taken.
• Names of relevant witnesses or service providers.

Personnel shall not speculate about the scope of the incident or make unsupported statements about whether information was accessed or disclosed.

Article VII. DATA-BREACH RESPONSE PROCEDURE

The Firm shall follow the steps below whenever a material security incident is suspected.

Step 1: Initial Assessment

The Incident Response Lead shall promptly determine:

• What occurred and when it was discovered.
• Whether the incident is ongoing.
• Which systems, records, and individuals may be affected.
• Whether client confidentiality, privileged material, court deadlines, financial information, or legal representation may be at risk.
• Whether outside cybersecurity, legal, insurance, or law-enforcement assistance is appropriate. The initial assessment shall not delay reasonable containment measures.

Step 2: Containment

The Incident Response Lead, with qualified technical assistance when needed, shall take reasonable measures to prevent further unauthorized access or disclosure.

Depending on the incident, containment may include:

• Disabling compromised accounts or active sessions.
• Resetting affected credentials and authentication tokens.
• Isolating compromised devices from networks.
• Blocking malicious access or communications.
• Suspending affected integrations or third-party access.
• Securing misdirected documents or requesting that an unintended recipient refrain from further use or disclosure and delete the information when appropriate.
• Contacting banks or payment providers when financial fraud is suspected.

Personnel shall not delete files, wipe devices, or reformat affected systems without authorization from the response lead or qualified incident-response professional, unless immediate action is necessary to prevent imminent harm.

Step 3: Preservation of Evidence

The Firm shall take reasonable steps to preserve relevant evidence, including system logs, suspicious emails, access records, relevant communications, affected documents, and available forensic information.

Evidence should be preserved in a manner that maintains its integrity and records who collected or handled it.

The Firm shall consider applicable privilege, work-product protection, confidentiality, litigation-hold obligations, and restrictions on disclosure when preserving or sharing evidence.

Step 4: Investigation and Scope Determination The Incident Response Lead shall coordinate an investigation to determine, to the extent reasonably possible:

• The likely cause and method of the incident.
• The date range of unauthorized activity.
• Whether information was accessed, acquired, altered, deleted, encrypted, or disclosed.
• The types and approximate quantity of information involved.
• Whether current, former, or prospective clients or other individuals may be affected.
• Whether confidential client information, personal information, financial information, or information about minors was involved.
• Whether the incident remains active.
• Whether the Firm’s ability to provide legal services has been impaired.

Qualified outside cybersecurity professionals should be engaged when the Firm lacks the technical ability to investigate adequately.

The Firm shall document known facts, unresolved questions, and investigative limitations.

Step 5: Legal and Professional Assessment

The Managing Attorney shall assess applicable notification and professional obligations, including:

• The Alabama Data Breach Notification Act, Ala. Code §§ 8-38-1 et seq., where applicable.
• Alabama Rules of Professional Conduct, including Rule 1.6 concerning confidentiality and other applicable rules governing competence, communication, supervision, and client property.
• Applicable federal or other state laws.
• Contractual notification requirements.
• Court orders, protective orders, discovery restrictions, and preservation obligations.
• Applicable insurance policy requirements.

The Firm shall determine whether the information and circumstances trigger notification duties and identify the applicable deadlines, recipients, and required contents of notices.

The Firm shall not assume that every security incident is a legally reportable breach or that every breach is governed by the same notification deadline.

Step 6: Client and Other Required Notifications

Where required by law, professional obligations, contract, or the circumstances of representation, the Firm shall provide appropriate notification to affected clients, individuals, regulators, law-enforcement authorities, insurers, or other required recipients.

Client communications shall be coordinated by the Managing Attorney and handled in a manner that protects privileged and confidential information.

Where a breach involves, or creates a substantial likelihood of involving, material client information, the Firm shall promptly evaluate its duty to inform affected current clients and explain the matter sufficiently to permit informed decisions concerning the representation.

Notifications shall, as applicable:

• Describe the nature of the incident.
• Identify the types of information involved, to the extent known.
• Explain the steps taken to contain and investigate the incident.
• Identify reasonably appropriate protective steps for affected individuals.
• Provide contact information for questions.
• Explain any material effect on the client’s representation or the Firm’s ability to provide legal services.

The Firm shall avoid unnecessary disclosure of information concerning other clients, witnesses, co-defendants, investigations, or protected legal strategy.

The Firm shall not delay a legally required notification merely because the investigation is incomplete. Any permitted delay must have a lawful basis.

Step 7: System Recovery and Remediation

Before restoring affected systems to ordinary use, the Firm shall take reasonable steps to eliminate the cause of the incident and reduce the likelihood of recurrence.

Recovery measures may include:

• Removing malware or unauthorized access mechanisms.
• Patching vulnerabilities.
• Rebuilding or restoring affected devices and systems from trusted sources.
• Resetting credentials and reviewing access permissions.
• Confirming the integrity of restored files.
• Testing security controls.
• Increasing monitoring of affected accounts and systems.
• Requiring additional safeguards or corrective action from a service provider.

Critical legal deadlines, court appearances, client communications, and case-management functions shall be prioritized during recovery.

Step 8: Post-Incident Review

After containment and recovery, the Incident Response Lead shall prepare a written report for the Managing Attorney.

The report should document:

• A summary of the incident.
• The timeline of events and response actions.
• The systems and information involved.
• The findings and limitations of the investigation.
• The legal and professional assessments performed.
• Notifications made and the basis for those decisions.
• Recovery measures completed.
• Remaining risks and corrective actions.
• Recommendations to improve security and incident response.

The Managing Attorney shall review the report and assign responsibility for any remaining corrective actions.

Article VIII. NOTIFICATION DEADLINES AND LEGAL COMPLIANCE

The Firm shall maintain a process for promptly identifying and meeting applicable notification deadlines.

For incidents potentially subject to the Alabama Data Breach Notification Act, the Managing Attorney shall verify the current statutory requirements concerning the definition of a breach, affected information, exceptions, reasonable investigation, notice to affected Alabama residents, notice to the Alabama Attorney General or other authorities when applicable, and required timing.

The Firm shall also consider whether separate notification requirements arise under federal law, another state’s law, a contract, an insurance policy, or a professional obligation.

No provision of this policy shall be interpreted as authorizing the Firm to postpone or disregard a mandatory notification deadline.

Article IX. CONFIDENTIALITY DURING INCIDENT RESPONSE

Incident response activities must be conducted in a manner that preserves attorney-client privilege, work-product protection, and professional confidentiality to the extent applicable.

The Firm shall:

1. Limit access to incident information to persons who reasonably need it.
2. Use secure channels to communicate about incidents.
3. Avoid placing unnecessary client-identifying information in general incident reports.
4. Consider appropriate arrangements when retaining outside cybersecurity or legal professionals.
5. Evaluate confidentiality and privilege issues before providing client files or incident records to third parties.
6. Maintain incident documentation in an appropriately restricted location.

The Firm shall not assume that every communication with a cybersecurity vendor or every document created during an investigation is automatically privileged.

Article X. BUSINESS CONTINUITY

If a security incident materially disrupts the Firm’s operations, the Managing Attorney shall coordinate reasonable continuity measures, including:

• Identifying upcoming court dates and filing deadlines.
• Maintaining access to essential contact information and case schedules.
• Establishing alternative communication methods for clients.
• Arranging secure access to unaffected records.
• Prioritizing urgent criminal matters and time-sensitive legal obligations.
• Coordinating with courts and other authorized parties when necessary and appropriate.
• Restoring critical systems in a controlled and secure manner.

The Firm shall avoid actions that unnecessarily jeopardize client rights, legal deadlines, or the continuity of representation.

Article XI. RECORD RETENTION AND DESTRUCTION

Firm information shall be retained and destroyed according to applicable law, professional obligations, court requirements, litigation holds, and the Firm’s record-retention practices.

Personnel shall not destroy or alter information that may be relevant to a security investigation, legal proceeding, preservation obligation, or regulatory inquiry.

Electronic and paper records designated for lawful destruction shall be disposed of through reasonable methods designed to prevent unauthorized recovery or disclosure.

Article XII. VIOLATIONS AND ENFORCEMENT

Failure to comply with this policy may result in corrective action, restriction or removal of system access, termination of employment or contractual access, or other appropriate measures consistent with applicable law and agreements.

Nothing in this policy prevents a person from reporting suspected unlawful conduct or complying with a lawful reporting obligation.

No employee or contractor shall be retaliated against for making a good-faith report of a suspected security incident.

Article XIII. POLICY REVIEW

The Managing Attorney or designee shall review this policy at least annually and following a significant security incident, a material technology change, or a change in applicable legal requirements.

Revisions shall be documented and communicated to affected personnel.

APPENDIX A: DATA-BREACH RESPONSE CHECKLIST

Incident Number: __________________________

Date and Time Discovered: __________________________

Reported By: __________________________

Incident Response Lead: __________________________

Initial response

• Report received and incident logged.
• Managing Attorney notified.
• Incident severity assessed.
• Potentially affected systems and information identified.
• Ongoing unauthorized access contained.
• Evidence preserved.
• Outside technical assistance considered or engaged.

Investigation and legal assessment

• Scope and likely cause investigated.
• Potentially affected clients and individuals identified.
• Confidentiality and privilege concerns evaluated.
• Alabama breach-notification requirements evaluated.
• Other applicable legal and contractual requirements evaluated.
• Notification deadlines and responsible persons documented.
• Insurance carrier and law enforcement contacted if appropriate.

Notification and recovery

• Required notifications prepared and issued.
• Current-client communication obligations evaluated.
• Affected systems secured and restored.
• Critical case deadlines and court obligations addressed.
• Corrective actions assigned.
• Post-incident report completed.
• Lessons learned reviewed and documented.

Summary of Incident:

Containment and Recovery Actions:

Notification Decisions and Dates:

Corrective Actions and Responsible Persons:

Incident Closed By: __________________________

Closure Date: __________________________

APPENDIX B: EMPLOYEE ACKNOWLEDGMENT

I acknowledge that I have received and reviewed the Azar Law Offices, LLC Information Security and Data-Breach Response Procedure.

I understand that I am responsible for protecting confidential client information, following the Firm’s security requirements, using authorized technology, and promptly reporting suspected security incidents.

I understand that I may not independently disclose incident information to clients, the media, opposing counsel, or outside parties unless authorized or legally required to do so.

I agree to comply with this policy and understand that violations may result in appropriate corrective action.

Printed Name: __________________________________

Position: _______________________________________

Signature: _____________________________________

Date: __________________________________________

APPENDIX C: ADOPTION AND APPROVAL

The undersigned approves this Information Security and Data-Breach Response Procedure for use by Azar Law Offices, LLC, effective as of the date stated below.

Managing Attorney: Thomas J. Azar, Jr.

Signature: _____________________________________

Date: __________________________________________

Designated Incident Response Lead: _______________

Alternate Incident Response Contact: ______________

Date of Next Review: ____________________________

Implementation priorities