---
title: "Best VPN for Law Firms: Controls and Ethics Rules"
description: "No ABA rule names a VPN product. See what Model Rule 1.6(c) and Opinion 498 ask of a firm, and which business VPN plans include a dedicated IP, SSO and MFA."
url: "https://www.vpn.com/vpn/best-vpn-for-law-firms/"
lang: "en"
updated: 2026-10-29
---

> **Bottom Line:** The ABA texts we read do not require a law firm to buy a VPN. Model Rule 1.6(c) asks for reasonable efforts to protect client information, and Opinion 498 says lawyers should consider a VPN when connecting over Wi-Fi. A VPN alone does not make a firm compliant. The plans below differ on dedicated IP, single sign-on and multi-factor sign-in.

## What this page is for

This page is for a partner or office manager at a small firm choosing a business VPN. It sits under our [best VPN for business](https://www.vpn.com/vpn/best-vpn-for-business/) guide, which explains how a business VPN differs from a personal one. For larger organisations see the [enterprise VPN guide](https://www.vpn.com/vpn/best-vpn-for-business/enterprise/). A medical practice faces a different rule; see [best VPN for healthcare](https://www.vpn.com/vpn/best-vpn-for-healthcare/).

We do not run our own security tests. Every vendor-specific line below is what the vendor says on its own pages, with the date we read it. The ABA texts are linked under Resources. This is general information, not legal advice.

## Does the ABA require lawyers to use a VPN?

No ABA text we read says so. Rule 1.6(c) sets a standard of reasonable efforts, and Opinion 477R says that standard is not a hard and fast rule. Opinion 498 says lawyers should consider using a VPN when connecting over Wi-Fi. A VPN alone does not make a firm compliant, and your state bar may add its own tests.

![Rule 1.6(c) asks for reasonable efforts to prevent unauthorized disclosure of or access to client information. What counts as reasonable is how sensitive the information is, how likely disclosure is, the cost and difficulty of safeguards and how much they get in the way. Opinion 477R says there is no hard and fast rule; Opinion 498 says to consider a VPN on Wi-Fi](https://www.vpn.com/images/uploads/2026/10/law-firm-vpn-reasonable-efforts.webp)

## Controls you can buy, and which plan has them

The controls a firm can switch on are dedicated IP or allow-listing (so a system accepts connections only from the firm's fixed address), single sign-on (SSO, so access follows your staff accounts) and multi-factor sign-in (MFA, a second proof beyond a password). Opinion 477R lists multi-factor authentication to access firm systems among available tools. Each vendor below says what its plans include, read on 8 October 2026.

| Provider | Dedicated IP or static IP | SSO | Price shown per user per month |
|---|---|---|---|
| [NordLayer](https://www.vpn.com/out?partner=nordlayer&placement=use-case-body) | Core and above | Listed | $11 (Core), yearly billing |
| [Proton VPN for Business](https://www.vpn.com/vpn/protonvpn/) | Professional | Professional | From $9.99, appears to assume a multi-year term |
| GoodAccess | Every plan | Premium and Enterprise | $11 (Premium), yearly billing |
| [Surfshark VPN for Teams](https://www.vpn.com/vpn/surfshark/) | Not a Teams feature | Not stated | From $5.90 |
| [ExpressVPN for Teams](https://www.vpn.com/vpn/expressvpn/) | Add-on on 1- or 2-year plans | Not stated | Not listed |

GoodAccess has no review page on VPN.com, so it is not linked internally. NordLayer has no review page either, so [NordLayer](https://www.vpn.com/out?partner=nordlayer&placement=use-case-body) links to its own site through our partner link. We earn a commission if you buy NordLayer through it; that does not change what its pages say.

![Opinion 498 on virtual practice: a VPN covers the connection, alongside a secure router, and the opinion does not require one. Strong passwords, updates, phishing training and a policy for personal devices cover the rest, and your state bar may add its own opinions](https://www.vpn.com/images/uploads/2026/10/law-firm-vpn-covers-the-connection.webp)

## What to ask a VPN company before client files go through it

Opinion 477R says a lawyer should do due diligence on vendors providing communication technology, including checking references and credentials. In practice, ask:

1. **Which security reports or certifications do you hold, and can I see them?** Ask for the report, not just the badge, and check its date.
2. **Is there a written data-processing or confidentiality agreement, and who signs it?** Get it before client files cross the service.
3. **Which controls come with my plan?** Dedicated IP, SSO and MFA enforcement are gated by plan at the vendors above.
4. **What does the vendor log, and for how long?** Your own duty to protect client information does not end with the vendor's promise.

## Final Verdict

| If this is your situation | Start with |
|---|---|
| You want a dedicated IP, SSO and MFA on a small-firm budget | NordLayer Core or Proton VPN Professional, as each vendor says. Compare the term you must commit to |
| You want a static IP on every plan and can do without SSO at the lowest tier | GoodAccess, as the vendor says |
| A plan has no dedicated IP | Surfshark VPN for Teams says it has none; rule it out if your firm needs one |
| A client or insurer names a requirement | Get it in writing and match the plan to it. The rule's comment says a client may require special security measures |

The VPN is one control. Your passwords, devices, supervision of staff and state bar rules decide the rest.

## Frequently Asked Questions

### Does the ABA require lawyers to use a VPN?
No ABA text we read does. Rule 1.6(c) asks for reasonable efforts, and Opinion 498 says lawyers should consider using a VPN when connecting over Wi-Fi. Neither says must, and neither names a product. A VPN alone does not make a firm compliant. Your state bar may add its own rules.

### What does ABA Model Rule 1.6(c) require of a law firm's technology?
It requires reasonable efforts to prevent inadvertent or unauthorized disclosure of, or access to, client information. The rule's comment lists factors: sensitivity, likelihood of disclosure, cost, difficulty and effect on representation. It names no technology. A VPN alone does not satisfy the rule; at most it supports those efforts.

### What did ABA Formal Opinion 498 say about VPNs for remote lawyers?
Opinion 498 (March 2021) says lawyers connecting over Wi-Fi should make sure routers are secure and should consider using a VPN. It also says a policy for personal devices should cover access through a VPN. It says "consider," not "must," and it names no product.

### Is a VPN enough to protect client confidentiality?
No. A VPN protects the connection, not the device, the password or the people. Opinion 477R also lists unique complex passwords, firewalls and multi-factor authentication to access firm systems. Rule 1.6(c) asks for reasonable efforts across all of that, judged by sensitivity, cost and difficulty. A VPN alone does not make a firm compliant.

### Is it safe for a lawyer to work on public Wi-Fi?
It depends on the matter and the network. Opinion 498 says lawyers should make sure routers are secure and consider using a VPN when connecting over Wi-Fi. How much care a matter needs depends on how sensitive the information is, and a VPN protects the connection only. Check your state bar's opinions too.

### What does a business VPN cost a small law firm per lawyer?
At the vendors we read on 8 October 2026, list prices ran from about $5.90 to $11 per user per month on the plans in the table. NordLayer lists $11 for Core on yearly billing, and a dedicated-IP server is an extra monthly fee. Minimum seat counts and billing terms differ, so check each vendor.

### Why would a law firm want a dedicated IP address on its VPN?
A dedicated IP gives the firm one fixed address, so a system can be set to accept connections only from it. NordLayer says Core and above can add a dedicated-IP server and IP allow-listing. Whether a given case-management or document system supports that is a question for its own vendor.

### Do lawyers need multi-factor sign-in on a firm VPN?
No ABA text we read requires it for a VPN, but Opinion 477R lists multi-factor authentication to access firm systems among available tools. It adds a second proof beyond a password. NordLayer lists MFA, and Proton says it enforces 2FA on its Essentials plan.

### What should a firm ask a VPN company before client files go through it?
Ask which security reports it holds and whether you can see them, whether a written confidentiality or data-processing agreement exists and who signs it, which controls your plan includes, and what it logs. Opinion 477R says to do due diligence on vendors providing communication technology.

### Can a lawyer use a consumer VPN for client work?
A consumer VPN may protect a connection, but it is sold per person, while the firm-wide controls in the table belong to team and business plans. Rule 1.6(c) asks for reasonable efforts, and cost is one factor. For client work, a plan with dedicated IP, SSO and MFA gives a firm more to point to.

## Resources

- [ABA Model Rule 1.6: Confidentiality of Information](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/)
- [ABA Model Rule 1.6, Comment](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/comment_on_rule_1_6/)
- [ABA Formal Opinion 477R: Securing Communication of Protected Client Information](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-477.pdf)
- [ABA Formal Opinion 498: Virtual Practice](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-498.pdf)
- [NordLayer pricing](https://nordlayer.com/pricing/)