South African Law Firm Website Compliance Rules

Most law firm websites in South Africa breach at least one of these, and almost none of the agencies building them have read the Code. It is not a long document and it is freely available, which makes the gap harder to excuse than it is to fix.

This article sets out what the Code actually says about a website, where the risk sits, and what changes about a build for a law firm. It is written for the person commissioning or building the website. It is not legal advice, which would be a poor way to open an article about attorneys. Confirm every point below against the current Code and your own professional adviser before acting on it.

The Code covers your website, and says so

The Code of Conduct for All Legal Practitioners, Candidate Legal Practitioners and Juristic Entities was published under section 36(1) of the Legal Practice Act 28 of 2014, in Government Gazette 42337 on 29/03/2019, with a correction notice in Gazette 42364. Part II applies to every legal practitioner. Part III applies specifically to attorneys in private practice.

Paragraph 7.1.1 defines publicity for the purposes of Part II as any direct or indirect reference to a legal practitioner or firm, published or disseminated by any written, pictorial or oral means, in any medium (including electronic and social media). The definition reaches publicity made in connection with sponsorship, patronage or a benevolent cause, publicity made or paid for at the instance or with the knowledge or consent of the practitioner, and anything appearing in an editorial, advertorial or advertisement.

That is drafted to be difficult to escape. A website is publicity. So is a LinkedIn company page, a sponsored article, a directory listing the firm paid for, and a podcast appearance. Paragraph 21.1 makes a breach of the Code misconduct on the part of an attorney, so this is not a soft standard.

Paragraph 7.2 then requires that all approaches to clients or potential clients, including letterheads, and all publicity, including the offering of services by publicity, meet a set of conditions. Four of them matter enormously to a website.

You may not compare your firm to any other. At all.

Paragraph 7.2.5 requires that publicity does not misrepresent, disparage, compare, criticise the quality of, or claim to be superior to, the service provided by any other legal practitioner, whether or not such other legal practitioner is identified.

The prohibition is not limited to naming a competitor. A generalised superiority claim is still a comparison with an unidentified practitioner, and it still falls inside the rule.

This is materially stricter than the equivalent rule for financial services providers, where the FAIS General Code permits comparison provided the differing characteristics of each option are made clear. Attorneys get no such allowance. The comparison itself is the problem.

What that removes from a law firm website is a long list of standard conversion copy. Why choose us over other firms. The leading commercial litigation practice in Gauteng. Unlike traditional attorneys. Faster than the industry average. A side by side table of your service against a typical firm. Anything phrased as better, best, superior, or unlike the rest.

What remains permitted is everything about your own practice stated on its own terms. Your experience, your capability, your process, your sector focus, the depth of your team, your turnaround, your fee structure. A positioning statement that describes what you do and who you do it for is not a comparison. A positioning statement that only works because it implies someone else is worse, is. That is a harder brief than it sounds, and it is close to the argument behind why generic websites attract generic clients.

Realistic expectation: this is the provision that will require the most rewriting on an existing law firm website, and it is the one clients push back on hardest, because comparative framing is what most marketing copy is built from.

You may not name a client without prior written consent

Paragraph 7.2.6 provides that publicity may not refer to a client by name unless the prior written consent of the client has been obtained, or the advertisement relates solely to the sale or letting of a client’s property.

That single sentence removes most of what a professional services website normally uses to establish credibility. A logo wall of client brands. Named testimonials. Case studies identifying the parties. A representative matters list naming the companies advised. A homepage carousel of client quotations with names and job titles attached.

None of these are prohibited outright. They are conditional on written consent obtained beforehand, and in practice most firms either have no consent on file or have consent that was given verbally, years ago, by someone who has since left the client. The prudent position is that if you cannot produce the written consent, the reference should not be published.

Anonymisation with enough specificity still establishes credibility. Sector, size, complexity and outcome carry most of what a name carries, and none of the consent problem.

The job titles on your team page are a closed list

This is the provision almost nobody knows about, and it is unusually specific.

Paragraph 15.1 requires an attorney to disclose his or her name on any letterhead used for the practice, together with the names of all partners in a partnership or all directors in a juristic entity. Where the attorney is also admitted as a notary or conveyancer, that may be disclosed too.

Paragraph 15.2 then goes further, and its wording reaches beyond letterheads. An attorney who discloses in a letterhead or in other publications the name of any person employed by the firm in any capacity must indicate clearly whether or not that person is an attorney, a partner or a fellow director. Critically, without the prior written consent of the Council, that indication must be made using one or more of the following words and no others.

A team page is a publication. Applied to one, this rules out a large share of the titles that appear on South African law firm websites for admitted attorneys who are not partners or directors. Head of Litigation. Legal Advisor. Senior Legal Counsel. Junior Attorney. Legal Executive. Practice Lead. None of those appear on the permitted list, and the Code says and no others.

Paragraph 15.4 offers relief for large firms. A partnership of more than twenty partners may disclose only the senior partner and managing partner, provided the letterhead carries a note indicating the address at which the names of all the partners are available for inspection. The same approach applies to directors of a juristic entity.

Paragraph 15.3 separately restricts the style or name under which a firm may practise, to the attorney’s own name, the names of present or former partners or directors, a derivative of those, the name of a national or international legal practice with which the firm is associated, or any other name the Council has first approved in writing. That has consequences for a rebrand, and it is worth confirming before a new trading name reaches a domain registration and website build.

Specialisation is allowed, which surprises people

A persistent belief in the South African market is that attorneys may not call themselves specialists. The Code says otherwise.

Paragraph 8.1 provides that legal practitioners may, on the basis of specialised qualifications or experience, advertise or hold themselves out as being specialists or as offering specialist services. The permission is real.

The catch is what follows. If a practitioner claims specialisation or expertise in any branch of the law, the Council may require the practitioner to show good cause by a specified date why he or she should not be ordered to cease holding themselves out as a specialist, may order them to cease if the Council is of the opinion that the claim is not justified, and may declare that such an order serves as notice under the disciplinary rules.

In other words the burden sits with the practitioner to justify the claim on demand. That is a reasonable trade. It means the sensible practice is to make specialist claims where they are genuinely supported by qualifications or experience, and to keep the supporting basis documented, rather than to avoid the word entirely out of an inherited caution that the Code does not require.

Pay-per-lead marketing is the live commercial risk

The provisions that carry the most financial consequence for a firm’s digital marketing sit in Part III, and they are read together.

Paragraph 18.22 provides that an attorney is guilty of touting for professional work if he or she, personally or through the agency of another, procures or seeks to procure, or solicits for, professional work in an improper or unprofessional manner or by unfair or unethical means. The paragraph then says that this includes, but is not limited to, the payment of money or the offering of any financial reward or other inducement of any kind whatsoever, directly or indirectly, to any person in return for the referral of professional work, and directly or indirectly participating in an arrangement or scheme of operation resulting in, or calculated to result in, the attorney securing professional work solicited by a third party.

Paragraph 18.9 prohibits an attorney from acting in association with any organisation or person whose business, or part of whose business, it is to solicit instructions for the attorney. Paragraph 18.10 prohibits buying instructions from a third party and prohibits paying or rewarding a third party, or giving any other consideration, for the referral of clients, other than an allowance on fees to another attorney.

Paragraph 12.1 prohibits an attorney from entering into any agreement, arrangement or scheme of operation the result or potential result of which is to secure the benefit of professional work solicited by a person who is not an attorney, for reward, whether in money or in kind.

And then, in the same paragraph, the sentence that makes the whole thing workable: this prohibition shall not in any way limit bona fide and proper marketing activities.

Marketing is expressly protected. What is not protected is paying a non-attorney for work that non-attorney solicited on your behalf. The distinction is not about the channel, it is about what the payment is for.

A monthly retainer to an agency for building and running a website, producing content, managing search visibility and running advertising, is payment for marketing services. A fee paid per qualified lead, per enquiry, or per signed matter, to a platform that solicited that matter and sold it on, has a different character entirely. So does an affiliate arrangement, a revenue share on matters generated, and membership of a directory that solicits enquiries and charges for each one passed through.

This has direct consequences for how a law firm contracts its digital marketing, and it is the provision to read before signing anything with performance-based pricing attached. It is also the reason a law firm should be sceptical of an agency that proposes to be paid on results without ever having raised the question.

You cannot delegate this, and corrections go in the same medium

Paragraph 7.3 contains two obligations that change the shape of the agency relationship.

The first is that the responsibilities set out in paragraph 7.2 cannot be delegated. A firm cannot contract its way out of them. An indemnity clause in an agency agreement may allocate commercial loss between the parties, but it does not move the professional obligation, and it is the attorney who answers to the Council.

The second is the correction duty. Where a legal practitioner or firm becomes aware of publicity referring to it which conflicts with or infringes the paragraph, the firm must immediately take appropriate steps reasonably necessary to have the publicity rectified or withdrawn, and must further publish the rectification in the same medium or media as that in which the infringing publicity appeared.

Two practical consequences follow. If the offending copy was on the firm’s website, the correction is published on the firm’s website. And because the definition of publicity in 7.1.1 reaches any direct or indirect reference to the firm, the duty is triggered by third-party publicity as well: a directory entry that describes the firm as the best in its field, a review aggregator that publishes a comparative ranking the firm was listed in, a press article that overstates a claim. Once the firm becomes aware, the obligation to take steps arises.

That makes monitoring what is published about the firm an actual professional obligation rather than a reputation management preference, and it makes the ability to publish a correction quickly a functional requirement of the website and of the maintenance arrangement behind it.

Trust accounts, email, and the case everyone still cites incorrectly

The largest financial risk attached to a South African law firm’s digital presence is not an advertising breach. It is business email compromise on a conveyancing transaction, and there is a widely repeated misconception about where the law now sits.

In Hawarden v Edward Nathan Sonnenbergs Inc [2023] ZAGPJHC 14, decided on 16/01/2023, the Johannesburg High Court found the conveyancing firm liable for R5.5 million lost when a purchaser’s email was compromised and the trust account details in an emailed PDF were altered. The court held that the firm, aware of the risks of business email compromise, owed a duty to warn and had transmitted its banking details negligently.

That judgment was widely reported and is still quoted across South African legal and cybersecurity marketing as settled authority. It is not. On 10/06/2024, in Edward Nathan Sonnenberg Inc v Hawarden [2024] ZASCA 90, reported as 2024 (5) SA 9 (SCA), the Supreme Court of Appeal upheld the firm’s appeal, set aside the High Court order and dismissed the claim with costs. Ms Hawarden applied to the Constitutional Court for leave to appeal on 01/07/2024, and reporting into 2025 indicated the apex court had not yet determined that application, so this is the current authority rather than a finally closed one.

So the leading South African authority now runs against conveyancer liability in delict for pure economic loss in these circumstances. Anyone selling secure portal software to attorneys on the strength of the 2023 judgment is selling against a decision that no longer stands.

Read the judgment carefully before taking comfort from it, because the distinction that decided it is the one that matters most to a law firm. Ms Hawarden was not ENS’s client. The SCA analysed wrongfulness in the context of pure economic loss suffered by a third party to whom the firm owed no contractual mandate, and noted she had been warned about cybercrime and had more than sufficient protection available. Where the person who loses the money is your own client, the analysis is contractual rather than delictual and can run the other way: in Gerber v PSG Wealth Planning, where a financial services provider acted on a fraudulent payment instruction purporting to come from its own client, the High Court held the provider contractually liable for the loss.

So the problem does not go away, for three reasons. The first is that client distinction. The second is that the POPIA obligation to secure personal information through appropriate, reasonable technical and organisational measures is a separate duty that the appeal judgment does not disturb. The third is more practical: the money still goes missing, the client is still furious, and the firm still spends a year in litigation defending a claim it may well win. Winning slowly is not the same as not being sued.

The website-side measures are cheap and mostly technical.

• Do not publish trust account details on the website. Nothing is gained and it hands a fraudster a template for a convincing forgery.
• Publish a standing, prominent banking-details verification instruction: that the firm’s account details never change, that any notification of changed details should be treated as fraudulent, and that the client must telephone a stated number using a number obtained from the website rather than from an email.
• Configure SPF, DKIM and DMARC on the firm’s domain, with DMARC moved beyond monitoring to an enforcing policy. Without this, anyone can send email that appears to come from your domain, and the firm’s own website domain becomes the instrument of the fraud.
• Keep the verification page at a short, memorable URL that can be quoted in every outgoing email and on every letterhead.
• Ensure the contact details on the website are current, because they are the out-of-band channel the whole verification model depends on.

What breaks in practice

The recurring failures on South African law firm websites are consistent enough to list.

• Comparative or superlative positioning copy, usually written before anyone read paragraph 7.2.5.
• Named client testimonials or a client logo wall with no written consent on file.
• Team page job titles for admitted attorneys that fall outside the closed list in paragraph 15.2.
• Partner or director names incomplete on the website, or out of date after a departure.
• Performance-based or per-lead marketing contracts signed without reference to paragraphs 12.1, 18.9, 18.10 and 18.22.
• Trust account details published on a contact or conveyancing page.
• No SPF, DKIM or DMARC enforcement on the firm’s domain.
• Directory and aggregator listings the firm has never reviewed, carrying comparative claims the firm would not make itself.
• A contact form collecting sensitive matter detail with no purpose disclosure and no retention policy, which is a POPIA problem sitting alongside the Code one, and the same issue as personal information leaving the country through embedded third-party tools.

Frequently Asked Questions