ACC NCR Cybersecurity and Privacy Issue-Spotting in Vendor Agreements and Standard Contractual Clauses Post-Schrems and CCPA

Cybersecurity and privacy issues continue to vex many stakeholders, in part because of the constantly changing regulatory environment.  This has led to significant interest in third-party risk management.  In this context, a number of questions arise:

·        How can companies protect themselves against third-party cyber and privacy risks?

·        In a post-Shrems II world, how can GDPR exposure be addressed?

·        What are the main obstacles to effective third party risk management?

·        What can be done contractually about supply chain cyberattacks (like SolarWinds, Cocecov, and Kaseya)?

In addition to the above questions, this session will take a look at the future state of privacy and data security law, including the contours of data transfer in the EU, the continued uncertainty around the Schrems II decision, and the potential enforcement posture of DPAs.  We will also discuss the effects of the continually changing privacy landscape on such operational issues as long term planning, revisions to business models, and exit considerations (e.g., mergers and acquisitions or IPOs). 

Finally, we will look at what is on the horizon, including possible widening of the gap between the GDPR and the UK GDPR, additional activity in the states, and the topic of cyber incident reporting (CIR).