251-217-9733
Information Security & Data Governance
What you collect, how you protect it, and what you are required to do when protection fails.
Data Is a Liability Before It Is an Asset
Information security and data governance is the legal framework around the data a business holds (what it collects, why, where it lives, who can reach it, how long it is kept, and what happens when it is exposed).
Most businesses substantially underestimate how much of this applies to them. You do not need to be a technology company to be holding sensitive data. Employee records, customer payment information, health information, and anything received under a confidentiality obligation all carry duties, and those duties frequently arrive through contracts and vendor agreements rather than through regulation.
The practical consequence is that data governance is not solely an IT problem. IT can secure a system. Only the business can decide what it should be collecting in the first place, and only a lawyer can tell it what it is now obliged to do because it collected it.
What We Handle
Privacy policies and notices
Public-facing policies that accurately describe what you actually do, which is a lower bar than it sounds and one many businesses miss.
Data mapping and minimization
Establishing what you hold and why, and reducing what you do not need. The cheapest security improvement available is holding less.
Data retention and destruction
Retention schedules, secure disposal, and the coordination with legal hold obligations.
Cybersecurity programs
The policies, access controls, and training that constitute reasonable security, and the documentation proving you had them.
Vendor and processor agreements
Data processing terms, security obligations, audit rights, and breach notification duties flowing both directions.
Breach response planning
The plan, written and tested before it is needed, including who decides, who notifies, and how fast.
Regulatory frameworks
Compliance programs aligned with GDPR, CCPA, and HIPAA where they apply, and applicable state law where they do not.
Employee training
The largest single vulnerability in most organizations is a person, not a system.
Sound familiar?
How We Approach It
Find out what you actually hold
Almost every engagement starts here, and almost every business is surprised. You cannot protect, retain, or delete data you have not established you have.
Match the program to the obligation
A ten-person contractor and a healthcare provider do not need the same program. Over-building is a real cost and under-building is a real exposure; the answer is proportionality, not maximalism.
Write the plan before the incident
A breach response plan is worth very little written at two in the morning. The value is in having decided in advance who decides, who calls whom, and what the first hour looks like.
Who Does This Work
Jordan W Gerheim
Privacy, cybersecurity, data retention, and compliance programs as outside chief legal counsel, including technology, payment processing, and vendor risk.
Benjamin H. Kilborn, Jr.
Data and technology obligations from the in-house side, including online platforms and the vendor arrangements that carry them.
The First 48 Hours After a Breach
What you do immediately affects your legal exposure more than almost anything that follows.
1. Contain, do not destroy
Stop the exposure, but preserve the evidence. Wiping a compromised machine before it is imaged destroys the record of what actually happened.
2. Call counsel early
Engaging counsel at the outset can help structure the investigation and may support privilege over parts of it. Doing it after the forensic report exists is considerably less useful.
3. Engage forensics through counsel
How the investigator is retained affects the status of what they produce.
4. Establish what was actually taken
Notification obligations turn on the type of data and the people affected. Guessing early and correcting later is its own problem.
5. Check the clock
Notification deadlines are set by statute, by contract, and sometimes by an insurance policy, and they run concurrently, not sequentially.
6. Notify your insurer
Cyber policies commonly have notice conditions and panel requirements. Choosing your own vendors first can affect coverage.
How This Work Is Billed
Want a number for your situation?
Related Services
Frequently Asked Questions
Does privacy law apply to us if we only operate in Alabama?
Frequently yes, through routes people do not expect. Obligations arrive through the states your customers live in rather than the state you operate from, through federal regimes like HIPAA where health information is involved, through payment card rules that come with accepting cards, and through contracts with larger counterparties who pass their own obligations down to you. Very few businesses are genuinely subject to nothing.
We use a cloud provider. Isn't security their problem?
Only partly. Cloud providers secure their infrastructure; you remain responsible for what you put in it, who you give access to, and how it is configured. A significant share of breaches involve correctly functioning systems configured badly or accessed by someone who should not have had the credentials.
How long should we keep data?
Long enough to meet legal, tax, and contractual requirements, and no longer. The instinct to keep everything forever is understandable and expensive (every additional record is something to secure and something that can be exposed or discovered). A retention schedule that is actually enforced is one of the most underrated risk reductions available.
Do we need a written breach response plan?
If you hold sensitive data, yes. The value is not the document, it is having made the decisions in advance, who has authority, who is called, how the clock is tracked, and what gets said. Businesses making those decisions for the first time during an incident consistently make worse ones.
Do you handle the lawsuit if we are sued after a breach?
Yes. Data Breach & Cyber Litigation Defense sits under our Courtroom side and is handled by the same firm, so nobody needs bringing up to speed on what your program was or what happened during the response.
Related Insights
Know What You Hold Before Someone Else Does
Book a Risk-Free Strategy Session. If you are dealing with an incident right now, call 251-217-9733 instead.