2020 was a year of extremes in many aspects. After the exceptional impact of COVID-19, and perhaps, in part, because of the way the pandemic forced businesses to change their operations, the steep rise in cybersecurity attacks—particularly ransomware attacks—have crippled or impeded many companies. Recovering from these attacks requires the expertise of forensic investigators to identify the compromised systems, and specialized attorneys to identify and advise on the types of data requiring notification as well as the regulatory requirements impacting cyber breach cases. Under the current regulatory regime, the United States has 52 different data breach notification laws, a challenge in and of itself.

Today, however, many companies have either global operations or global customer bases and that means that most cyber incidents cross national borders. This creates additional complexities as the impacted organization not only has to identify and comply with breach notification laws in additional countries, but the response to the data breach may need to be adjusted to comply with a matrix of cross-border privacy and cyber laws. This is especially true of the process to review and identify the potentially impacted data subjects and the compromised personal data.

Cyber Review Is Not E-Discovery

In order to provide the necessary information to regulators and provide the proper individual notification, the potentially compromised data must be reviewed to identify the implicated data and data subjects. While there are tools, tricks, and processes that can be lifted from classic e-discovery processes, a cyber review is distinct with its own unique workflow. And, just as cross-border discovery in litigation requires greater effort and more planning, cross-border cyber incidents (and their reviews) require even greater coordination and planning.