Data Breach Readiness

• Incident response frameworks
• Accountability documents, runbooks
• Incident response simulation exercises
• Advice on managing privilege
• General GDPR compliance

Incident Response Management

• Investigations

• General crisis management

• Evidence gathering

• Strategic planning

• Notifications to regulators, law enforcement and data subjects

• Post breach incident reports and lessons learned exercises

DPC Investigations and Inquiries

• Responding to RFIs from the DPC

• Defending organisations in investigations and inquiries
• Appeals and judicial reviews of DPC decisions

Litigation and Dispute Resolution

• Providing strategic advice to mitigate risk of claims
• Defending claims - insured and non-insured

• Advised a technology company on an urgent and complex global data breach arising from a bug permitting circumvention of account takeover prevention measures, which was open to be exploited over a number of years.
• Advised a loyalty marketing company on a security breach affecting 1.5m users across Europe resulting in the disclosure of customer credit card details, where the company was ordered by the DPC to delete all personal data held for the purpose of providing services to its clients.
• Advised a public body on a security breach. Carried out an on-site risk assessment of the incident, advised on whether the incident was notifiable and subsequently drafted notifications to the DPC and data subjects.
• Advised a US headquartered gaming company on a global data breach which involved notifications being made to the DPC and data subjects. The breach resulted in a threatened multi-plaintiff lawsuit in Ireland and a class action issued in the US.
• Advised a major Irish financial institution in the defence of multiple Circuit Court proceedings relating to alleged GDPR infringements.