Clifford Chance
Data security and data misuse are no longer abstract risks. Headlines are emerging on a daily basis which put the spotlight firmly on data privacy. What is more, individuals now care more than ever about how companies use and harvest their data – this means ever-increasing levels of scrutiny and reputational risk.
With the introduction of new and more stringent data privacy laws, the reputational and regulatory costs of non-compliance have made it more important than ever for businesses to be fully informed and fully compliant.
The significant changes introduced by new data privacy regimes are increasing the appetite of privacy regulators and transforming the global data privacy environment. We will help you to meet the requirements of the law, and the ethical considerations that stretch beyond it.
Be clear on cyber security risk
5 questions to ask yourself
How will new laws impact us?
The legal landscape is evolving fast. Core policies (HR / data collection / confidentiality / business continuity / insurance) must be redesigned with cyber in mind. You will need to ensure that your board always pays attention to cyber security risk issues and is able to react quickly. A new approach to risk and compliance is required to protect you against reputational damage and significant fines.
Are we addressing the cyber risk profile of suppliers?
Your data should only be passed to third-party suppliers who have been cyber-vetted. To back this up, new cyber protection clauses need to be integrated into your agreements. Can you be sure that your suppliers will tell you about a cyber attack before your customers read about it in the news? Will suppliers help you manage fall-out and compensate you for any loss?
Is cyber a key part of our M&A due diligence?
When buying any business, cyber due diligence should be at the top of your list. Has the target fallen victim to a cyber attack? What risk mitigation measures are in place? Does the valuation reflect any cyber weaknesses?
What is our cyber disaster response plan?
An hour-by-hour cyber attack response plan is needed across the organisation with business leaders, legal, IT, HR, IR and PR teams working as one. Your plan needs regular testing and review.
If we have a data loss incident, what will we tell regulators and customers?
One or more regulators may need to be notified following a cyber attack, especially if there has been data loss (permanent or temporary). In these circumstances, you will want your legal adviser to have intimate knowledge of your risk mitigation strategy to put forward your best case. You may also need to tell customers – this legal communication process needs careful management.
