Data Privacy & Cybersecurity

Advising at the confluence of technology, data, business, law and regulation, Benesch’s Data Privacy & Cybersecurity lawyers provide comprehensive counsel on global technology and data-related issues and develop innovative policies, practices and protocols that minimize risk while supporting business growth.

Overview

Leveraging & Protecting Data

Our team helps clients protect and leverage data and use it creatively and safely while remaining fully compliant with the many applicable laws and regulations. Our lawyers also navigate clients through the complexities posed by emerging technologies and an ever-evolving landscape of data privacy and cybersecurity requirements.

We advise clients in designing and implementing cost-effective, business-minded solutions to their most complex data-driven legal issues and concerns. With a focus on long-term resilience, our lawyers take the time to understand each client’s technologies, business processes and goals. We then deliver practical, tailored future-proof strategies and data governance structures to limit their exposure, position them to achieve their full potential and ensure compliance on a global scale. We think strategically and pragmatically, advising clients across a wide range of industries from e-commerce, retail, technology, higher education and hospitality to the highly regulated financial services, insurance, healthcare and pharmaceutical sectors.  

Guidance at Every Stage

Our experience spans a wide range of privacy and data protection matters involving data use, collection, retention, sharing and disposal. Our services include:

  • Risk assessment and prevention
  • Data privacy impact assessments, protection, policies, procedures and incident preparedness training
  • Cybersecurity and trade secret, confidential information and personal data protection strategies
  • Global legal and regulatory compliance
  • Internal audits, and government inquiries and investigations
  • Data privacy litigation and enforcement actions
  • Information security program design and implementation
  • E-commerce and internet-related issues
  • Outsourcing arrangements and associated risks and responsibilities
  • Data breaches, response and crisis management
  • Intellectual property and technology transactions
  • Emerging technologies matters, such as AI, fintech, Internet of Things (IoT), metaverse law and connected medical devices
  • Sensitive data collections, including biometric and geolocation information

Regulatory and Compliance

Our attorneys are data privacy regulatory authorities well-versed and experienced in cybersecurity and privacy law matters on a global scale. We have long-established, effective working relationships with officials at key government agencies and ready access to agency decision-makers, which optimizes our ability to affect action. Should a compliance violation or data breach occur, we help clients manage the associated risk and respond swiftly and effectively while striving to end matters confidentially.

We help clients comply with the various U.S. federal, state and local laws, rules and regulations, as well as those of Canada, the EU/EEA and other global jurisdictions, and we offer guidance on proposed laws, rules and regulations. Our experience includes the following:

  • Blockchain and smart contracts
  • BYOD policies
  • California Privacy Acts, including the Consumer Privacy Act (CCPA), Privacy Rights Act (CPRA), Online Privacy Protection Act (CalOPPA), Invasion of Privacy Act (CIPA), and Do-Not-Track legislation (DNT) and similar laws emerging in other states
  • Illinois Biometric Information Privacy Act (BIPA)
  • EU General Data Protection Regulation (GDPR)
  • Computer Fraud and Abuse Act (CFAA)
  • Health Insurance Portability and Accountability Act (HIPAA)
  • Telephone Consumer Protection Act (TCPA)
  • Telemarketing Sales Rule (TSR)
  • Federal Trade Commission Act (FTCA)
  • Gramm-Leach-Bliley Act (GLBA)
  • Fair Credit Reporting Act (FCRA)
  • Defend Trade Secrets Act (DTSA)
  • Children’s Online Privacy Protection Act (COPPA)
  • Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM)
  • Family Educational Rights and Privacy Act (FERPA)
  • Stored Communications Act (SCA)
  • Video Privacy Protection Act (VPPA)
  • Payment Card Industry-Data Security Standards (PCI-DSS)
  • New York State Department of Financial Services (NYDFS)
  • Fair Information Practice Principles (FIPPs)
  • Data breach notice laws

High performance in practice

Recognized by Chambers® 2025

Ranked Tier 2 Nationally

2026 Best Lawyers® “Best Law Firms”

Our Work in Action

Representative Examples

Lead external counsel for a private managed cybersecurity service provider

with a focus on commercial contract strategy, contract document template creation and updating, procurement and sales, drafting, and negotiation, including all privacy and security terms and documentation required for cross-border data transfers, and related risk allocation terms. The engagement has successfully improved document turnaround times, contract completion timeframes, minimized push back from the other side, and favorably of contract terms. Work includes direct negotiations with mission critical vendors, large outsourcing transactions, C-suite reporting, training of legal and sales department personnel, and playbook creation. 

Lead external privacy compliance counsel for a top-of-its-industry, global company

with a focus on implementing a compliant, global cookie notice and consent program as well as a full suite of privacy-related written materials (including a wide range of jurisdiction-specific privacy notices and consents spanning jurisdictions in North America, Europe, and Asia).

Lead external privacy compliance counsel for large, global company

that provides both off the self and white label solutions to consumer-facing businesses with a focus on ensuring compliance with global data protection laws as well as the new wave of U.S. state data protections, strategy, governance, cross-border data transfers, full suite of privacy-related written materials, email and SMS marketing, use of advertising technologies including cookies and pixels, security incident investigation and reporting requirements, and privacy impact assessments.