Data Privacy & Cybersecurity

Data privacy has evolved from a compliance checkbox to a strategic business and reputational issue. The CLO is responsible for ensuring that the company's data practices comply with an increasingly complex patchwork of global, federal, and state laws — and that the company is prepared to respond rapidly and defensibly to a data breach. At a tech or healthcare company, this is a full-time domain requiring a dedicated privacy counsel or Chief Privacy Officer reporting to the CLO.

The regulatory landscape in the US has fragmented dramatically. In the absence of a federal comprehensive privacy law, 19+ states now have comprehensive consumer privacy laws effective through 2026, each with different definitions of "personal information," different consent mechanisms, different rights, and different enforcement approaches. California's CPRA (operationalized through the CPPA) remains the gold standard and de facto national floor.

For companies handling health data — including medtech, digital health, and wellness apps — HIPAA creates a separate compliance framework for covered entities and business associates, with specific breach notification requirements and significant civil/criminal penalties. Importantly, not all health data is HIPAA-covered: consumer health apps, employer wellness programs, and wearables typically are not, but they're increasingly subject to FTC enforcement.

The SEC's cybersecurity disclosure rules (effective December 2023) require public companies to report material cybersecurity incidents on Form 8-K within four business days, and to make annual disclosures about cybersecurity risk management and governance in Form 10-K. This creates a direct intersection between cybersecurity and securities compliance that the CLO must manage.