Legal Ethics in Practice: Conflicts, Confidentiality, Fees, and the Duty of Technological Competence

Summary. Every practicing lawyer is governed by rules that are short, widely available, and routinely misunderstood in exactly the places where discipline happens. This article works through the ones that matter most in daily practice: competence including the technology duty, communication, confidentiality and how it differs from privilege, the conflicts framework and the informed consent that resolves most of it, fee agreements and prohibited arrangements, trust accounting and why it produces more discipline than anything else, candor to the tribunal, the limits on advertising and solicitation, and supervisory responsibility — closing with the questions generative artificial intelligence has raised.

Ask a group of lawyers which ethical rule produces the most disciplinary actions and most will guess conflicts of interest, or maybe candor to the court.

The answer, in nearly every jurisdiction that publishes the data, is trust account violations — followed closely by neglect and failure to communicate. Not dramatic conflicts. Not lying to judges. Bookkeeping, and not returning calls.

That fact says something important about legal ethics as it is actually practiced. The rules that generate discipline are not the ones that require difficult moral judgment. They are the ones that require systems: a reconciliation performed monthly, a conflicts database checked before intake, a docketing system that catches a deadline, a written fee agreement, a returned phone call.

This article covers the rules that matter in daily practice, organized around where things actually go wrong.

Part I: The framework

The ABA Model Rules of Professional Conduct are a model. They bind no one. Every state adopts its own rules, most closely tracking the Model Rules, with meaningful variations — California's rules are numbered differently and diverge in several respects, and states differ on screening for lateral conflicts, on confidentiality exceptions, on advertising, and on trust accounting mechanics.

Which means the first rule of legal ethics is to read your own state's rules, not a summary of the Model Rules, and to check the ethics opinions of your state bar, which are where the rules meet actual practice.

The enforcement structure: a disciplinary agency, usually under the supervision of the state's highest court; sanctions ranging from private admonition through public reprimand, suspension, and disbarment; and a separate track of malpractice liability, which is civil, insured, and governed by a different standard. A rule violation is not automatically malpractice, and malpractice is not automatically a rule violation — though the same conduct frequently produces both.

And a third track: court sanctions. Fed. R. Civ. P. 11 permits sanctions for filings not warranted by existing law or lacking evidentiary support; 28 U.S.C. § 1927 imposes personal liability on counsel who "multiplies the proceedings in any case unreasonably and vexatiously"; and courts retain inherent authority to sanction bad-faith conduct. See Rule 11 and Inherent Power Sanctions.

Part II: Competence, diligence, and communication — the neglect cluster

Rule 1.1 — Competence. "A lawyer shall provide competent representation to a client," requiring "the legal knowledge, skill, thoroughness and preparation reasonably necessary."

Comment 8 added the technology duty: competence requires keeping abreast of changes in the law and its practice, "including the benefits and risks associated with relevant technology." That comment has been adopted in the great majority of states and it is not decorative. It has been applied to electronic discovery, to metadata, to the security of client communications, to cloud storage, to encryption, and now to generative artificial intelligence.

Rule 1.3 — Diligence. Reasonable diligence and promptness. This is the rule violated by the file that sits, the deadline that passes, the case that is never worked.

Rule 1.4 — Communication. Promptly inform the client of decisions requiring informed consent; reasonably consult about the means; keep the client reasonably informed about the status; promptly comply with reasonable requests for information; and explain matters to the extent reasonably necessary for the client to make informed decisions.

These three rules together account for the largest share of client complaints, and the pattern is nearly always the same: a matter the lawyer intended to work on, a client who called and did not hear back, a deadline that arrived, and then avoidance. The failure is rarely competence in the sense of legal knowledge. It is capacity and systems.

The practical protections: a docketing system with redundancy; a calendared file review at fixed intervals for every open matter; a rule that every client call is returned within one business day even if the answer is "no news"; a written status update at defined intervals in long matters; and — the hardest one — declining or withdrawing from matters the practice cannot staff.

And Rule 1.16 — Declining and terminating representation. Withdrawal is mandatory where the representation would violate the rules or the lawyer's condition materially impairs the ability to represent the client. Permissive withdrawal is available on several grounds, subject to court permission where a matter is pending. On withdrawal, the lawyer must take steps to protect the client: reasonable notice, time to obtain other counsel, surrender of papers and property to which the client is entitled, and refund of unearned fees.

Part III: Confidentiality, and how it differs from privilege

These are two different things and conflating them causes real errors.

Rule 1.6 — Confidentiality is an ethical duty. It covers all information relating to the representation, whatever the source, whether or not it is a communication, whether or not it is a secret, and whether or not anyone else knows it. It survives the representation and survives the client's death.

The attorney-client privilege is an evidentiary rule. It covers confidential communications between lawyer and client for the purpose of obtaining or providing legal advice, and it protects them from compelled disclosure. It is narrower in scope and it can be waived. See Attorney-Client Privilege and Work Product for Businesses, and Upjohn Co. v. United States, 449 U.S. 383 (1981), on its application within an organization.

The practical consequence: a lawyer may be free to testify about something (no privilege) and still forbidden to reveal it (confidentiality). Information learned from a third party, information in the public record, and the fact of the representation itself are all confidential even though none is privileged.

Rule 1.6's exceptions permit — and in a few instances require — disclosure: to prevent reasonably certain death or substantial bodily harm; to prevent or mitigate substantial financial injury from a crime or fraud in which the client used the lawyer's services; to secure legal advice about compliance with the rules; to establish a claim or defense in a controversy with the client or to respond to allegations concerning the representation; to comply with law or court order; and to detect and resolve conflicts on a change of employment or firm composition, within limits.

Rule 1.6(c) added a security obligation: a lawyer "shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation." That is a data security duty, and it interacts directly with the technology competence comment. Formal opinions have addressed encryption of client communications, the security of cloud services, and the obligations that follow a data breach — including, generally, notifying affected current clients. See Responding to a Data Breach: The First Seventy-Two Hours and Cybersecurity Program Toolkit.

Part IV: Conflicts of interest

The conflicts rules are the most intellectually demanding part of the framework, and the most systematically under-managed in small practices.

Rule 1.7 — Current clients. A concurrent conflict exists if (1) the representation of one client will be directly adverse to another client, or (2) there is a significant risk that the representation will be materially limited by responsibilities to another client, a former client, a third person, or the lawyer's own interests.

A conflict may be waived if the lawyer reasonably believes competent and diligent representation can be provided, the representation is not prohibited by law, it does not involve asserting a claim by one client against another in the same litigation, and each affected client gives informed consent, confirmed in writing.

Note what is not waivable: representing both sides of the same litigation, and situations where the lawyer cannot reasonably believe the representation will be competent. A client's willingness to consent does not cure those.

Rule 1.9 — Former clients. A lawyer may not represent a person in the same or a substantially related matter in which that person's interests are materially adverse to a former client, without informed consent confirmed in writing. Matters are substantially related if they involve the same transaction or dispute, or if there is a substantial risk that confidential information normally obtained in the prior representation would materially advance the new client's position.

Rule 1.10 — Imputation. A conflict of one lawyer in a firm is generally imputed to all lawyers in the firm. The Model Rules permit screening to avoid imputation when a lawyer moves between firms, subject to conditions — timely screening, no fee apportionment, and written notice to the affected former client. States differ sharply on whether screening is permitted, and this is one of the most important state-specific variations to know.

Rule 1.8 — Specific transactions, each with its own requirements:

1.8(a) Business transactions with a client — fair and reasonable terms, fully disclosed in writing in understandable language, written advice to seek independent counsel, and written informed consent to the essential terms and the lawyer's role.
1.8(b) No use of client information to the client's disadvantage.
1.8(c) No soliciting a substantial gift or preparing an instrument giving the lawyer a substantial gift, absent a close family relationship.
1.8(e) No financial assistance to a client in connection with pending litigation, except advancing court costs and expenses (contingent on outcome), and paying those for an indigent client. Several states have expanded this.
1.8(f) Third-party payment requires client informed consent, no interference with independence, and confidentiality.
1.8(g) — the aggregate settlement rule. No aggregate settlement of the claims of two or more clients unless each gives informed consent in a writing signed by the client, after disclosure of the existence and nature of all the claims and the participation of each person in the settlement. This is the central ethical constraint in mass tort practice. See Practicing in an MDL.
1.8(h) No prospective limitation of malpractice liability unless the client is independently represented; no settling a malpractice claim with an unrepresented client or former client without written advice to seek independent counsel and a reasonable opportunity to do so.
1.8(i) No proprietary interest in the cause of action, except a lien to secure fees and a contingent fee.

Rule 1.18 — Prospective clients. Information learned in a consultation is protected even if no representation follows, and a conflict can arise from a consultation alone — which is why intake systems must run a conflicts check before substantive discussion, and why "beauty contest" interviews and unsolicited emails through a website create real risk.

The system that prevents conflicts problems: a searchable database containing every client, every adverse party, every related entity and individual, and every prospective client consulted, checked before any substantive conversation and again when new parties appear. In a small practice this is a spreadsheet, and it is the difference between a conflicts practice and a hope.

Part V: Fees

Rule 1.5 — Fees must be reasonable, judged by factors including the time and labor required, the novelty and difficulty, the skill required, the preclusion of other employment, the customary fee, the amount involved and results obtained, time limitations, the professional relationship, the lawyer's experience and ability, and whether the fee is fixed or contingent.

The scope and basis of the fee must be communicated, preferably in writing, before or within a reasonable time after commencing the representation — and contingent fees must be in a writing signed by the client, stating the method of calculation, the percentages at each stage, the expenses to be deducted, and whether expenses are deducted before or after the contingent fee is calculated. That last item is money, and it is frequently left ambiguous.

Contingent fees are prohibited in domestic relations matters where the fee is contingent on securing a divorce or on the amount of alimony, support, or property settlement, and in criminal defense.

Fee division between lawyers not in the same firm requires that the division be proportional to services performed or that each lawyer assume joint responsibility, that the client agree in writing to the arrangement including the share each will receive, and that the total fee be reasonable.

Rule 5.4 — Professional independence prohibits sharing legal fees with a nonlawyer, forming a partnership with a nonlawyer where any activity consists of the practice of law, and permitting a person who recommends or pays for legal services to direct professional judgment. A small number of jurisdictions have created limited exceptions permitting nonlawyer ownership or fee sharing under regulatory supervision, which is one of the genuine structural developments in the field.

Fee agreement essentials, in every matter:

The scope of the representation, stated affirmatively and by exclusion
The fee structure, with the rate or percentage and how it changes at each stage
Costs and expenses, itemized by category, and whether they are deducted before or after the fee
Billing frequency and payment terms
The retainer's character — refundable advance held in trust, or a true earned-on-receipt fee where the jurisdiction permits it
Termination and withdrawal, and what happens to unearned fees and to the file
Communication expectations
Dispute resolution, including any fee arbitration program
Signature and date

See Attorneys Fees and Costs for fee shifting and court-awarded fees.

Part VI: Trust accounting — the rule that produces the most discipline

Rule 1.15 — Safekeeping property. Client funds and property must be held separate from the lawyer's own, in a designated trust account; complete records must be kept and preserved for a specified period after termination; the client must be notified promptly on receipt of funds and property; and funds must be promptly delivered and an accounting rendered on request.

Why this rule produces so much discipline: it is strict, it is objective, and it does not require intent. A lawyer who never intended to take a dollar can be suspended for a bookkeeping failure that produced a negative client balance, because the rule is about safeguarding funds rather than about honesty.

The operational requirements, in nearly every jurisdiction:

An IOLTA or trust account at an approved institution, with interest on pooled short-term deposits remitted to the state's legal services program.
A separate interest-bearing account for funds large enough or held long enough to earn net interest for the client.
No commingling. The lawyer's own funds may be in the trust account only in an amount sufficient to cover bank charges, where the jurisdiction permits.
A client ledger for every client, showing every receipt and disbursement and a running balance that never goes negative.
A three-way reconciliation, monthly: the bank statement, the trust account journal, and the sum of the individual client ledgers must agree.
Prompt withdrawal of earned fees, and no disbursement against uncollected deposits — the single most common route to an inadvertent shortage.
Overdraft notification, which most jurisdictions require the bank to report directly to the disciplinary agency.
Records retained for the period the rule specifies, typically five to seven years.

The recurring failures: disbursing against a deposit that has not cleared; paying an office expense from trust; failing to reconcile; leaving earned fees in trust; using a general operating account for a retainer; taking a flat fee into operating before it is earned in a jurisdiction that treats it as an advance; and failing to resolve a lien before disbursing settlement funds.

Disputed funds must be kept in trust until the dispute is resolved. Where a third party — a medical lien holder, a prior lawyer, a health plan — has a claim to funds the lawyer holds, the lawyer generally may not simply disburse to the client. See Personal Injury Claim Toolkit.

Part VII: Candor, fairness, and the tribunal

Rule 3.3 — Candor toward the tribunal. A lawyer shall not knowingly make a false statement of fact or law, or fail to correct one previously made; shall disclose legal authority in the controlling jurisdiction known to be directly adverse to the client's position and not disclosed by opposing counsel; and shall not offer evidence known to be false. If a lawyer comes to know of the falsity of material evidence already offered, the lawyer must take reasonable remedial measures, including if necessary disclosure to the tribunal — and these obligations apply even if compliance requires disclosure of otherwise confidential information.

That last clause makes Rule 3.3 the sharpest conflict in the rules, and the criminal defense context is the hardest version of it. Nix v. Whiteside, 475 U.S. 157 (1986), held that a defendant was not denied effective assistance when counsel refused to assist in presenting perjured testimony and threatened to disclose it — establishing that a lawyer's duty of loyalty does not extend to assisting perjury. The standard for ineffective assistance generally comes from Strickland v. Washington, 466 U.S. 668 (1984).

Rule 3.4 — Fairness to opposing party and counsel. No unlawful obstruction of access to evidence, no unlawful alteration or destruction of material with potential evidentiary value, no falsifying evidence, no counseling or assisting a witness to testify falsely, no frivolous discovery requests or failures to respond, and no alluding at trial to matters not reasonably believed to be supported by admissible evidence.

Rule 4.2 — Communication with a represented person. A lawyer shall not communicate about the subject of the representation with a person the lawyer knows to be represented by another lawyer, without that lawyer's consent or legal authorization. In the organizational context this reaches persons who supervise, direct, or regularly consult with the organization's lawyer, who have authority to obligate the organization, or whose act or omission may be imputed to it — a rule that governs how witnesses are interviewed and that is easy to violate inadvertently.

Rule 4.3 — Dealing with an unrepresented person. No implying disinterest, correction of any misunderstanding about the lawyer's role, and no legal advice other than the advice to secure counsel where the person's interests are or may be in conflict.

Part VIII: Advertising, solicitation, and the unauthorized practice of law

Commercial speech protection reshaped this area. Bates v. State Bar of Arizona, 433 U.S. 350 (1977), held that a blanket ban on lawyer advertising violated the First Amendment. In re Primus, 436 U.S. 412 (1978), distinguished in-person solicitation for pecuniary gain from political expression and association, protecting a lawyer's letter offering free representation on behalf of a civil liberties organization.

The rules that remain:

Rule 7.1 — no false or misleading communication about the lawyer or the lawyer's services. This is the operative rule, and it covers testimonials creating unjustified expectations, comparisons that cannot be substantiated, and results-based claims without appropriate context.
Rule 7.2 — permits advertising through any media, prohibits giving anything of value for a recommendation with defined exceptions (reasonable advertising costs, qualified referral services, reciprocal referral agreements that are non-exclusive and disclosed, and nominal gifts of appreciation), and requires identification of a responsible lawyer or firm.
Rule 7.3 — restricts live person-to-person solicitation where a significant motive is pecuniary gain, with exceptions for lawyers, family, close personal or prior professional relationships, and persons who routinely use the type of legal services involved.
Rule 5.5 — unauthorized practice and multijurisdictional practice. A lawyer may not practice where not admitted, or assist another in doing so, subject to defined safe harbors: association with local counsel, work reasonably related to a pending or potential proceeding in which the lawyer expects to be admitted, ADR services reasonably related to the lawyer's home practice, and services reasonably related to the lawyer's practice in a jurisdiction where admitted.

The remote-work question this raises — where a lawyer admitted in one state lives and works in another — has been addressed by a growing number of jurisdictions and by formal opinions, generally permitting a lawyer to practice the law of the admitting jurisdiction remotely from a state where not admitted, provided there is no holding out as licensed there and no local-law practice. Check the specific state. See Managing a Multistate Remote Workforce.

Part IX: Supervision, and responsibility for others

Rule 5.1 — Partners and lawyers with comparable managerial authority must make reasonable efforts to ensure the firm has measures giving reasonable assurance that all lawyers conform to the rules. Supervisory lawyers have the same obligation as to lawyers they supervise. And a lawyer is responsible for another lawyer's violation if the lawyer orders or ratifies it, or — being a partner, manager, or direct supervisor — knows of it at a time when its consequences can be avoided or mitigated and fails to take reasonable remedial action.

Rule 5.3 extends the same framework to nonlawyer assistants, including outsourced and contract personnel — which reaches vendors, virtual assistants, document review providers, and cloud services.

What "reasonable measures" means in practice: written policies on conflicts, confidentiality, trust accounting, and file management; a supervision structure with defined review points; onboarding and periodic training; and a mechanism by which a junior lawyer can raise a concern. Rule 5.2 provides that a subordinate lawyer is bound by the rules notwithstanding direction from a supervisor, but does not violate them by acting in accordance with a supervisor's reasonable resolution of an arguable question.

Part X: Generative artificial intelligence

The newest and fastest-moving application of old rules, and the analysis follows directly from them.

Competence (1.1). Using a tool whose limitations the lawyer does not understand is a competence problem. Large language models generate fluent text that can be confidently wrong, including citations to authorities that do not exist. Every citation must be independently verified in a real source before filing. Courts have sanctioned lawyers who filed briefs containing fabricated cases, and the sanction falls on the person who signed the document under Fed. R. Civ. P. 11. See Hallucinated Citations, Rule 11, and Generative AI in Legal Filings.

Confidentiality (1.6). Entering client information into a tool that retains inputs, trains on them, or exposes them to the provider's personnel may be an unauthorized disclosure. The lawyer must understand the tool's data handling, review the terms, and obtain client consent where required.

Candor (3.3) and fairness (3.4). Unverified output presented to a tribunal is a false statement risk.

Supervision (5.1 and 5.3). A firm deploying these tools must have a policy, training, and a verification requirement — the same obligations that attach to any nonlawyer resource.

Fees (1.5). Billing for time not actually expended because a tool performed the work in minutes raises a reasonableness question, and firms must decide deliberately how efficiency gains are shared.

The workable posture is neither prohibition nor uncritical adoption: a written policy identifying approved tools and prohibited uses; a rule that no citation or factual assertion reaches a client or a court without independent verification; a confidentiality screen governing what may be entered; disclosure to clients where their information is involved; and training. See AI Governance and Compliance and AI Vendor Procurement and Governance Checklist.

Part XI: A worked example

The situation. A three-lawyer firm represents a construction company in a payment dispute. Mid-case, the company's minority owner asks the firm to represent him personally in a dispute with his co-owners over the same company. He offers to pay a retainer that day.

The analysis, in order:

1. Conflicts check. The company is a current client. Rule 1.7 asks whether representing the owner would be directly adverse to the company or materially limit the representation of it. A dispute among owners about company control and distributions is at minimum materially limiting, and quite possibly directly adverse.

2. Is it consentable? Only if the firm reasonably believes it can provide competent and diligent representation to both, and both give informed consent confirmed in writing. The company's consent would have to come from someone other than the owner seeking the representation — which raises the question of who speaks for the entity under Rule 1.13.

3. Confidentiality. The firm holds information from the company representation that would be material to the owner dispute. Using it for the owner would violate 1.6 and 1.8(b); not using it would materially limit the owner's representation. That is a strong indication the conflict is not consentable.

4. The correct answer. Decline the individual representation, in writing, promptly. Explain that the firm represents the company and not the owner individually, that the firm cannot advise him personally, and that he should obtain independent counsel. Confirm this in a letter, because the conversation itself may have created a Rule 1.18 prospective-client problem if substantive information was disclosed — which is why the conflicts screen should have come before the discussion.

5. The entity clarification. Send the company a letter under Rule 1.13 confirming that the firm represents the entity, not its constituents individually, and that communications with the firm are not confidential as to the entity. That letter should have gone out at the beginning of the engagement, and its absence is the underlying failure here. See Corporate Governance for Closely Held Companies and Resolving Shareholder and Member Disputes in Closely Held Companies.

What went right: the conflict was identified before any work began. What went wrong: the substantive conversation preceded the conflicts check, and the entity-representation letter was never sent.

Part XII: The rules in specific practice settings

The same rules apply everywhere. The pressure points differ.

The solo and small firm. The dominant risks are capacity and systems: too many matters, no redundancy in docketing, no conflicts database, and trust accounting done by the same person who does everything else. The interventions that matter are unglamorous — a real calendar with second reminders, a written conflicts check before every intake, a monthly three-way trust reconciliation on a fixed date, and a hard limit on open matters. Also: a succession plan, which most jurisdictions now expect and some require. A solo who dies or becomes disabled without one leaves clients with files nobody can access and deadlines nobody is watching. Name a successor lawyer, execute the authorization the jurisdiction provides for, and tell someone where the passwords are.

In-house counsel. The client is the organization, not the executives who ask the questions — Rule 1.13. Two obligations follow. Corporate Miranda: when it becomes apparent that a constituent's interests are adverse to the organization's, the lawyer must explain the identity of the client. And reporting up: on knowledge that a constituent is engaged in action likely to result in substantial injury to the organization, the lawyer must ordinarily refer the matter to higher authority, up to the highest authority that can act. See Attorney-Client Privilege and Work Product for Businesses and Conducting an Internal Investigation. In-house lawyers also face multijurisdictional practice questions under Rule 5.5, which most states address through in-house registration.

Government lawyers. Rule 1.11 governs the movement between government and private practice, imposing conflicts and screening rules on matters in which the lawyer participated personally and substantially. Prosecutors carry the special responsibilities of Rule 3.8 — refraining from prosecuting charges not supported by probable cause, timely disclosure of exculpatory evidence (which overlaps with but is not identical to the constitutional obligation under Brady v. Maryland, 373 U.S. 83 (1963)), and — under the more recent additions — obligations on learning of new credible evidence that a convicted defendant is innocent.

Litigators. The pressure points are candor under 3.3, fairness under 3.4 (especially preservation and discovery responses), communication with represented persons under 4.2 during witness interviews, and expert and witness payment. Layered on top is the sanctions regime: Rule 11, § 1927, Rule 37 for discovery abuse, and inherent authority.

Transactional lawyers. Joint representation of multiple parties to a transaction, Rule 1.8(a) when the lawyer takes equity in a client, opinion letters, and the question of who the client is when a lawyer forms an entity for several founders. The last of those is the most common failure in startup practice: the lawyer forms the company and then advises individual founders about their own interests without ever clarifying the client. See Startup Formation and Fundraising Toolkit.

Family and estate practitioners. Joint representation of spouses in estate planning, which is common and which requires an explicit understanding about confidentiality between them; representation of a fiduciary versus the beneficiaries; and diminished capacity under Rule 1.14, which permits protective action including — as a last resort — seeking appointment of a guardian. See Planning for Incapacity and Trust Administration and the Trustee's Duties.

Part XIII: What to do when something goes wrong

Every lawyer will eventually make a mistake with ethical dimensions. The response determines the consequence far more than the error does.

A missed deadline or a potential malpractice error.

Determine whether it can be cured — a motion for relief, an extension, a refiling.
Tell the client, promptly and in writing. Rule 1.4 requires it, concealment converts a malpractice claim into a disciplinary matter, and the limitations period on the client's claim frequently runs from discovery.
Notify the malpractice carrier immediately; claims-made policies require notice of circumstances that may give rise to a claim, and late notice can forfeit coverage.
Recognize the conflict. Once the lawyer's own interest is at stake, Rule 1.7 is implicated — advise the client to seek independent advice, and do not attempt to settle a malpractice claim with an unrepresented client without written advice to consult counsel (Rule 1.8(h)).
Do not alter the file. Backdating or altering a document converts a survivable error into disbarment.

A trust account shortage.

Fund it immediately from personal or firm funds, and document the source and date.
Reconstruct: identify when the shortage arose, which client ledger it affected, and what caused it.
Self-report where the jurisdiction requires it, and understand that most disciplinary agencies treat prompt correction and disclosure very differently from concealment.
Fix the system — three-way monthly reconciliation, no disbursement against uncollected funds, separate ledgers.

A confidentiality breach or data incident. Investigate, contain, determine what client information was involved, notify affected current clients (the prevailing view of the obligation), assess statutory breach notification duties, and remediate. See Responding to a Data Breach.

A disciplinary complaint. Respond, on time and completely — failure to cooperate is itself a violation in most jurisdictions and frequently produces a harsher sanction than the underlying complaint. Retain counsel; lawyers represent themselves in these matters badly and often. Do not contact the complainant. And do not treat a complaint as an accusation of dishonesty; most are about communication.

When in doubt, call the ethics hotline. Nearly every state bar operates one, the advice is confidential in most jurisdictions, and a documented inquiry made in good faith before acting is itself meaningful protection.

Primary authority and further reading

ABA Model Rules of Professional Conduct, particularly Rules 1.1, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.13, 1.15, 1.16, 1.18, 3.3, 3.4, 4.2, 4.3, 5.1, 5.2, 5.3, 5.4, 5.5, 7.1, 7.2, and 7.3 — as adopted and modified by your jurisdiction.
Your state's rules of professional conduct and its ethics opinions, which are controlling and which differ from the Model Rules in material respects.
ABA Formal Opinions on technology, encryption, cloud computing, data breach response, virtual practice, and generative artificial intelligence.
Bates v. State Bar of Arizona, 433 U.S. 350 (1977) · In re Primus, 436 U.S. 412 (1978) — advertising and solicitation.
Upjohn Co. v. United States, 449 U.S. 383 (1981) — privilege in the organizational context.
Nix v. Whiteside, 475 U.S. 157 (1986) — client perjury and effective assistance.
Strickland v. Washington, 466 U.S. 668 (1984) — ineffective assistance.
Fed. R. Civ. P. 11 and 28 U.S.C. § 1927 — court sanctions.
Restatement (Third) of the Law Governing Lawyers.