Law firms across South Africa are increasingly nervous of cybercrime risks, following a court case against a local law firm in January, the first major fine issued for not renewing security software, and enhanced European data protection requirements. The Legal Practitioners' Indemnity Insurance Fund NPC (LPIIF) claim statistics show that South African law firms have been the target of cybercriminals for over a decade. A common thread in the feedback from three South African law firmsBowmans, Norton Rose Fulbright South Africa, and Werksmans Attorneyson data protection regulations in the country is that phishing and email compromise are the top cybercrime risks there. All three said their firms have put in place various safeguards to mitigate against the risk of cybercrime incidents, and that human error is the weakest link in the data protection process. Clients need to be able to trust that the firm they work with can keep information secure, said Rosalind Lake, director at Norton Rose Fulbright South Africa. "A multidisciplinary team needs to be involved with the data protection function, and simulations should be carried out to test the incident response procedures," she said. Law firms are also conscious of South Africa's Protection of Personal Information Act (POPIA), which dates back to 2013, but only came into force in 2020. In South Africa, the financial risk of a data breach is two-fold, in that any legal entity can be fined by the regulator for failing to report