Data Breach Management and Legal Issues for IT Professionals

The talk looks at data breach response from the viewpoint of an attorney with in-house technology experience who now advises clients on data security and privacy. It argues that breaches involve more than consumer records, pointing to employee information, confidential business material, and data held for or by third parties. It also walks through the harms an organization can face, including contract claims, call center load, and lost operations, and explains that notification duties depend on where affected people live and which industry rules apply.

The middle section follows the response itself. Technical containment, legal analysis, and communications run in parallel and should be coordinated through a single hub, with a small initial team and consistent base messaging. Engaging forensic experts through counsel can help protect their discussions under privilege, while written communications should stay factual because they may later be read in court. The speaker cautions against over-scoping the investigation and notes that breach investigations often run from about a week to a couple of months, with faster generally better.

Preparation comes last. Organizations should keep logs, notify their insurer promptly, consider combined notification and call center vendors, and hold an after-action review. Contracts with vendors can shift breach costs, and tabletop exercises with a written response plan help staff stay calm. The talk ends by separating privacy, which governs collection and use of data, from security, which governs safeguards, since the two are often conflated.