Larry Ponemon, chairman and founder of independent data privacy and research organization Ponemon Institute, has helped law firms install data security measures and policies for years. They need it, he said, recalling a memory from years ago.

As an expert witness in a trial, Ponemon stepped into a major law firm's office—which he refused to name—and saw confidential information out in the open.

“I was in a room and there were boxes of files. I was curious, so I walked over and the boxes were open,” Ponemon said. “Inside it looked like depositions and privileged information. There was work product and it was labeled.”