Ife Jubee • May 12, 2026 • 10 min read
When a law firm uploads a contract to any software platform, it is trusting that platform with the most sensitive information in its practice. Client names. Deal terms. Negotiation positions. Regulatory exposure. The kind of information that, if leaked, does not just embarrass the firm. It ends client relationships. It triggers malpractice claims. It can destroy a practice.
I think about this every day. Not because it makes good marketing copy, but because I spent years working in partnerships and alliances at companies where a single mishandled data point could unravel months of work. That experience shaped how we built Hubtal from the ground up.
This is not a features page. It is an honest account of what we do, why we do it, and what the data says about why it matters.
IBM's Cost of a Data Breach Report for 2025 puts the average breach cost for professional services firms (law firms included) at $4.56 million. That is the average. Not the worst case.
A 2025 survey by US Legal Support found that 21% of law firms experienced a cyberattack in the past year. One in five.
And the Integris Law Firm Cybersecurity Report adds context that should worry any firm partner:
The data from Helm360's legal technology trends analysis is even more direct:
In Africa, the picture is still emerging, but the direction is clear.
Nigeria saw an estimated 82,000 data breaches in 2023, up 64% from the prior year, according to research published in the Global Journal of Social Sciences.
The Nigeria Data Protection Commission has already imposed fines totaling hundreds of millions of naira, with enforcement intensifying under the General Application and Implementation Directive that took effect in September 2025.
South Africa's POPIA has been active since 2021. Kenya's Data Protection Act is operational.
This is not a future compliance problem. It is a current one.
For any platform handling legal data across African and international markets, the compliance surface is wide.
Here is what applies to Hubtal and our customers right now:
Nigeria's first comprehensive data protection law, modeled in part on the GDPR.
It created the Nigeria Data Protection Commission (NDPC) as an independent regulator with real enforcement authority.
The GAID directive, effective September 2025, now provides binding guidance on everything from lawful processing bases to cross-border transfer requirements.
Fines for non-compliance can reach:
Law firms handling confidential client data are classified in a category that faces enhanced obligations.
Still the global benchmark.
Any platform that processes data of individuals in the EU or UK must comply, regardless of where the platform is headquartered.
Fines can reach:
Operational since July 2021, with the Information Regulator actively pursuing enforcement actions.
For firms with US-based clients or US-qualified attorneys, this rule requires lawyers to make:
“reasonable efforts” to prevent unauthorized disclosure of client information.
Today, reasonable efforts explicitly include technology safeguards.
By 2026:
For a platform like Hubtal, which operates across NGN, GBP, and USD markets, designing for compliance across all of these frameworks is not optional.
It is the baseline.
I could write a long list of security features with checkboxes.
I am going to skip that and explain our approach in plain language instead.
Your contracts, your clause patterns, your client names: none of it goes into a shared model.
Your data builds your firm's institutional knowledge within Hubtal. It stays there.
It does not leak into another firm's experience, and it does not improve a model that serves your competitors.
This is a non-negotiable design decision we made before we wrote a single line of code.
Every document uploaded to Hubtal is:
These are not exotic standards. They are the minimum that any serious platform should offer.
The 2026 data privacy forecast from US Legal Support found that:
We meet that bar.
Firms have:
Not everyone needs access to everything.
Hubtal's access controls are role-based and configurable at the firm level, because a platform that gives every user access to every document is not secure, no matter what encryption it uses.
Cross-border data transfer is a live compliance issue under the NDPA, GDPR, and POPIA alike.
We are transparent about:
Including:
The NDPA requires notification to the NDPC within 72 hours of a breach.
GDPR has the same timeline.
We have built incident response processes that can meet these deadlines, because a plan you write after a breach is not a plan.
Not a one-time audit before launch.
Ongoing assessment of:
Gartner projects worldwide spending on security and risk management will reach $240 billion in 2026.
We take that trend seriously not because of the dollar figure, but because of what it signals:
The threat environment is accelerating, and static defenses do not hold.
Most global legal tech platforms treat African markets as an afterthought, if they think about them at all.
Their compliance frameworks are designed for GDPR and maybe CCPA.
Their pricing assumes New York billing rates.
Their data residency options do not account for the fact that many African jurisdictions have specific requirements about where personal data can be transferred and stored.
The NDPA has extraterritorial scope.
It applies to any organization that processes the personal data of individuals in Nigeria, regardless of where that organization is headquartered.
So a legal tech platform based in London or San Francisco that serves Nigerian law firms needs to comply with the NDPA.
Many do not, because they have not read it.
We built Hubtal knowing we would operate under the NDPA from day one.
We designed our:
with the GAID directive in mind.
When the GAID took effect in September 2025, we were already aligned.
That is the advantage of building for a market rather than adapting to it later.
For in-house legal teams at multinational companies operating in Africa, the compliance picture is especially complex.
A single company might need to comply with:
all simultaneously.
A platform that understands these overlapping requirements and is designed to help, not hinder, compliance is not a nice-to-have.
It is an operational requirement.
Whether you are evaluating Hubtal or any other platform, here are five questions that will tell you quickly whether a vendor takes your confidentiality seriously.
If the answer is:
that is a red flag.
Anonymization of legal documents is difficult to do reliably, and the distinction between “anonymized” and “re-identifiable” is thinner than most vendors admit.
“The cloud” is not a location.
You need to know:
You should be able to:
If a vendor makes leaving difficult, they are using your data as a retention mechanism.
Not:
“Do they have a policy?”
But:
“Can they meet the 72-hour notification window required under NDPA and GDPR?”
Ask for specifics about incident response processes.
Not just GDPR.
If you are:
A blank look is your answer.
Hubtal is early.
We launched in 2026.
We do not have a decade of breach-free operation to point to, and I am not going to pretend otherwise.
What we do have is:
We are pursuing formal certifications and will share those milestones publicly as we reach them.
In the meantime, we are happy to walk any prospective customer through our security architecture in detail.
Not a slide deck.
The actual architecture.
If you are attending the NBA-SBL 20th Annual International Business Law Conference in Abuja this June, come find us.
We would rather answer hard questions about our security posture in person than have you wonder about them later.
Your contracts carry your clients' most sensitive business information.
We built Hubtal to protect that information like it is our own, because in a very real sense, our entire business depends on getting this right.
Hubtal is an AI-powered contract intelligence platform for:
with particular depth in African and emerging markets.
Learn more at: