Skip to main content
Home

Main navigation

  • People
    • People Search
  • Services
    • Industries
    • Practices
    • Regions
  • Our Thinking
    • Insights
    • Publications & Events
    • Resources
      • Antitrust Merger StatPak (WAMS)
      • CFIUS FIRRMA Tool 2.0
      • Coronavirus
      • Crisis Management
      • Debt Explorer
      • FinReg Dashboard
      • M&A Explorer
      • EU SPACs Data Hub
      • US SPACs Data Hub
      • World in Transition
  • About Us
    • Our Firm
      • Our Firm
      • History
      • Client Service
      • Awards & Rankings
      • 2021 Annual Review
      • 2021 Global Citizenship Review
    • Diversity
    • Global Citizenship
    • Newsroom
      • Newsroom
      • Media Contacts
    • Locations
  • Join Us
    • Careers
      • Careers
      • Apply
      • Inside White & Case
    • Alumni
  • Home
  • Crisis management: Key steps
  • Articles
    • Legal 500's In-House Lawyer Magazine Autumn - Commercial Litigation Focus (Germany)
    • AAA plc & ors v Persons Unknown: Cyber Activism or Blackmail?
    • Time to Revisit Risk Factors in Periodic Reports
    • Cybersecurity Enforcement: New York Department of Financial Services issues first penalty under Cybersecurity Regulation
    • Compensating non-material damages based on Article 82 GDPR – is there a de minimis threshold?
    • Corporate Boards Must Ask Key Cybersecurity Questions
    • Cybersecurity Risk: Top 5 strategies to build resilience
    • Before the Dust Settles: The California Privacy Rights Act Ballot Initiative Modifies and Expands California Privacy Law
    • US Cybersecurity Standards to Get Tougher and More Specific
    • Data Sharing Without Borders
    • Responding to a cyber-incident
    • Protection for cryptoasset stakeholders
    • High Court confirms Bitcoin status as property
    • Incident Notification & Disclosure Requirements
    • Proposal on NIS Regulations post-Brexit
  • View all publications
  • Contacts
    • Cybersecurity Contacts

Cybersecurity: Legal implications and risk management

In an increasingly interconnected world, cyber risk is firmly at the top of the boardroom agenda, and having an effective data breach response programme is no longer optional.

scroll down

Cybersecurity crisis management

The internet knows no borders, neither do we. Our global team of cybersecurity response experts work across borders, combining data protection, privacy, regulatory, white collar and litigation expertise in order to deliver seamless crisis management and legal advice, whenever and wherever needed.

The digitalization and free flow of information has transformed global business. However, with increased opportunities have come new and increased risks, together with complex legislative regimes that can vary significantly by jurisdiction, and are constantly evolving. Even the most conscientious company can become the victim of a cybersecurity incident, such as the stealing of client or company information, or a ransomware attack. We work with a wide range of multinational companies to manage their cybersecurity risks, developing rapid response plans, providing time-critical crisis management advice, and working with clients to manage any resulting legal issues that may arise. 

Key issues

Why?

  • Reputation
  • Fines
  • Breach of contract
  • M&A due diligence
  • Insurance
  • Proprietary information
  • Litigation
  • Criminal offences
  • Negligence

Be prepared

Risk Assessment

  • Key Information
  • Assets
  • Key Systems
  • Threat Analysis
  • Security Measures

Toolkit

  • Scripts
  • Internal and 
    External
  • Communications
  • Employee contacts
  • Response Plan
  • Live Training
  • Business Continuity Plan

Key considerations

Customer/individual rights

  • Requests for data
  • Data Protection Authority Complaints
  • Group litigation orders
  • Resolution mechanisms

B2B relationships

  • Contractual obligations
  • Contractual liability
  • Tort

Reputation management

  • Media strategy
  • Customer interaction
  • Employee engagement

Commercial

  • Proprietary
  • Information/Trade Secrets
  • System Disruption

Regulatory issues

  • Data Protection Authority
  • Financial Regulators
  • Market authorities
  • Other regulators

Privacy & data protection

  • Jurisdictions involved
  • Reporting obligations
    • individuals
    • authorities

Evidence

  • Law Enforcement Involvement
  • Legal Privilege
  • Preservation of Evidence

Response

Crisis Team

  • Legal (internal and external)
  • IT/IT Forensics
  • PR
  • Regulatory
  • DPO
  • Executive committee
  • HR
  • Vendor manager

Key Actions

  • Work with forensic investigators to:
    • Identify and contain breach
    • Gather/preserve evidence
    • Maximise legal privilege coverage
  • Contact crisis team
  • Bring in external partners
  • Identify key risks and priorities based on nature of breach
  • Assess notification requirements
  • Communications
  • Regulatory notifications

 

Responding to a cyber-incident

Articles

magazine pile
magazine pile

Legal 500's In-House Lawyer Magazine Autumn - Commercial Litigation Focus (Germany)

In The Legal500's newly released In-House Lawyer Magazine a group of White & Case lawyers has contributed a legal briefing on trends in German commercial litigation.

Read More
orange background
orange background

AAA plc & ors v Persons Unknown: Cyber Activism or Blackmail?

In recent years, demands for payments in cryptocurrencies have become the ransom of choice for cyber extortionists and other online frauds. As a result, the English Court's powers are increasingly being called upon.

Read More
Alert 800x800
Alert 800x800

Time to Revisit Risk Factors in Periodic Reports

Ninth Circuit Decision Highlights Importance of Updating Risk Factors to Address Material Developments, including those relating to Cybersecurity Risks.

Read More

Cybersecurity Enforcement: New York Department of Financial Services issues first penalty under Cybersecurity Regulation

Consistent with its increasing activity in the cybersecurity enforcement space, in March 2021, the NYDFS issued its first penalty under the Cybersecurity Regulation. This client alert explores the settlement and offers takeaways on the areas of focus by the NYDFS in enforcement actions under the Cybersecurity Regulation.

Read More

Compensating non-material damages based on Article 82 GDPR

Is a data subject entitled to compensation from a controller or processor if the data subject's GDPR rights have been infringed, even if they have not suffered any kind of material damage? 

Read More

Corporate Boards Must Ask Key Cybersecurity Questions

Cybersecurity has been a mainstay of quarterly board agendas for years.

Read More

Cybersecurity Risk: Top 5 strategies to build resilience

The fourth webinar in our 2020 Autumn Webinar Series covered crucial steps you should be taking to protect against cybersecurity threats and what you should do when disaster strikes.

Read More
stack of paper
stack of paper

Before the Dust Settles: The California Privacy Rights Act Ballot Initiative Modifies and Expands California Privacy Law

Hot on the heels of the California Attorney General's rulemaking process for the California Consumer Privacy Act ("CCPA"), California voters have passed a ballot initiative to expand and create new privacy rights for consumers.

Read More

US Cybersecurity Standards to Get Tougher and More Specific

In the past few years, cybersecurity has taken on increasing importance in the eyes of lawmakers and regulators.

Read More
Alert 800x800
Alert 800x800

Data Sharing Without Borders

UK law enforcement can now obtain an order against a person in or operating in the US for the production of or access to electronic data under a new ‘landmark’ US-UK data sharing agreement.

Read More

Responding to a cyber-incident

The COVID-19 crisis has exposed many companies to more cyber threats. Tim Hickman and John Timmons discuss what businesses need to do should a major incident occur.

Read More
InTheMedia_800x800.jpg
InTheMedia_800x800.jpg

Trending: Legal protection for cryptoasset stakeholders

Recent decisions in Singapore and New Zealand confirm that the courts are prepared to act to provide greater certainty and support to stakeholders in cryptoassets.

Read More

Recovering the ransom: High Court confirms Bitcoin status as property

The High Court has determined that Bitcoin (and other similar cryptocurrencies) can be considered property under English law, and could be the subject of a proprietary injunction. The Court granted the injunction to assist an insurance company to recover Bitcoin that it had transferred in order to satisfy a malware ransom demand.

Read More

Navigating Privacy and Cyber Incident Notification and Disclosure Requirements

Organisations are facing increasing uncertainty in assessing global notification and disclosure obligations and making a determination of whether to notify or disclose a privacy violation or security incident in today's complex regulatory environment. This article offers six steps companies should consider when navigating this complex process.

Read More

Proposal on the Application of the NIS Regulations post-Brexit

This article examines the impact of the UK Network and Information Systems Regulations 2018 (SI 2018/506) (NIS Regulations) on organisations post Brexit and their obligations under applicable cybersecurity law.

Read More

View all publications

Click here to view all Cybersecurity publications

Contacts

Cybersecurity Contacts

 

Americas

Mexico
Enrique Espejel

United States
Rachel Feldman
Colin Diamond
Jon Hawk
Scott Hershman
Paul Pittman
Aalok Sharma 
Pratin Vallabhaneni

 

 

 

EMEA

Czech Republic
Ivo Janda
Tomas Scerba

Belgium
James Killick
Jacquelyn MacLennan

Finland
Janko Lindros

France
Clara Hainsdorf 
Bertrand Liard
Ludovic Malgrain
Jean Pierre Picca

Germany
Detlev Gabel
Tobias Heinrich
Thomas Helck
Alexander Kiefner
Markus Langen
Sylvia Lorenz
Martin Munz
Hendrik Roger
Dominik Stier 
Christian Wirth 
Karl Xylander

Italy
Veronica Pinotti

Poland
Aleksandra Oziemska
Marcin Studniarek

Russia
Nikolay Feoktistov

Sweden
Martin Jarvengren

Turkey
Emre Ozsar

United Kingdom
Lawson Caisley
Nicholas Greenacre
Tim Hickman
Anneka Randhawa
Jenna Rennie
John Timmons 
Philip Trillmich

Asia-Pacific

Australia
Amy Detheridge
Brad Strahorn

Mainland China
Bingna Guo

Hong Kong SAR
Melody Chan

Japan
Shino Asayama
Toshio Dokei

 

 

 

Footer

  • Contact
  • Subscribe
  • Legal
  • Privacy Policy
  • Modern Slavery Statement
  • Remote Access
  • © White & Case LLP 1996 - 2022
  • Attorney Advertising. Prior results do not guarantee a similar outcome.

Search Dialog

Share a link to this page