Cybersecurity & Data Protection

We help you meet the complex legal requirements regarding data processing, protection and use, while staying tuned into your bigger-picture business goals. Our PwC team provides practical recommendations and expert legal services relating to:

• Privacy compliance – We help you design and implement lawful solutions, internal processes, business models, marketing and processing operations. We answer tough questions related to processing requirements, data retention, contracts and assessments, so you can make informed decisions.
  

• Cyber compliance – We help you understand complex, multijurisdictional regulations on data and infrastructure protection, data availability and business continuity. We make local cyber obligations clear so you can operate in compliance, and with confidence, anywhere in the world.

• Intellectual property and trade secret protection – We help you protect intellectual property and trade secrets wherever you operate, and highlight potential risks related to data processing, data protection, local enforcement and litigation.

We approach data protection with a wider lens, incorporating key stakeholders from IT and compliance, to help you create the right legal structure, documents and policies for your organization.   Our experts can support you with:

• Policies, Standards and Procedures – We create practical, understandable and legally precise policies, standards and procedures for your business.  We can advise you on lawful data processing, retention and deletion procedures, and can make the process easier and more efficient to manage by using software-based workflows.

• Roles and Responsibilities – We help you link standards and procedures to roles and responsibilities across your entire, global organization. With the widest geographic reach, PwC can deliver localized expertise on global data protection requirements, in your jurisdiction, in your local language.
  

• Third-party Management & Contracts – We help you assess and manage data flows to third parties. We write data transfer contracts, and can offer software to enable you to execute group data transfer contracts digitally. 

• Security, Data Breach & Crisis Management – We help you manage potential data breaches and security events by creating legally compliant processes for incident identification, assessment and execution. We can also advise you on regulator or individual notifications, should they be required.

• Training and Awareness – Through onsite training, videos and e-Learning, we can train your employees on both your internal data protection framework and the broader legal obligations that relate to your operations.

• Approvals – We can support you in getting your data protection management programme approved by relevant authorities, for example for the purposes of allowing group internal data transfers.

We help you design and implement robust risk and impact assessments of your data processing operations and framework. Our risk assessment approach will help you:

• Identify risks, including risks arising from changing legislation, country-specific dynamics, or trends within a sector.
  

• Define KPIs associated with the risk assessment and embed associated monitoring practices.
  

• Create processes for mitigation based on risk level, ranging from department management through to board or executive team engagement.

• Understand how technology can minimize data protection risks and facilitate risk-management procedures.

When engaging third parties, either intra-group or with business partners, it is important for everyone to have a clear understanding of how data will be processed and controlled. We can help you define the standards and procedures for third-party data processing agreements, so your business interests are protected throughout the lifecycle of the relationship. 

• Selection – We help you clarify the data protection touchpoints that will be critical to the selection of your vendors and business partners.  We develop clear instructions and methodologies to help you determine which party will act as data controller or processor, and to otherwise support the data protection related aspects of your procurement processes.
  

• Contract Negotiation & Management – We develop standard agreements for you to use with vendors and business partners. We can also help you assess and negotiate individual contracts with major suppliers, in accordance with local applicable laws.  In addition, to give you greater efficiency and speed, PwC can help you leverage digital platforms and digital signature tools, to best facilitate data transfers and contractual arrangements.

• Reviews and Audits – We help you review vendors and business partners to ensure they comply with contractual obligations regarding data management.
  

A data breach or security incident can put you at extreme risk, with very little time to respond. You often need to take corrective action, mitigate risk and alert authorities and data subjects within very tight timeframes. 

We help you plan for the worst – and help you mitigate against it. Our team can help you create a crisis response procedure that covers how a breach will be reported, assessed and managed. If an incident does occur, PwC’s legal data experts can be at your side immediately and will stick with you until the matter is closed or under control. We can legally assess the incident and advise you on mitigation activities that need to occur, from notification through to filing a criminal complaint.

Our PwC Crisis App also enables you to activate our multidisciplinary team in just one click, drawing on real time insights from experts across the legal, information security and forensic spectrum.

In today’s world, everyone is watching how your business handles data. We help you strategize and execute good cyber and data privacy practices, and we help you communicate and defend your position to regulators, the public, interest groups and individuals.

Good communication with regulators can help you stay ahead of regulatory changes and avoid sanctions and litigation. If litigation is required, we can support you through pre-litigation, administrative proceedings and litigation for: 

• Fines and Regulator Litigation – If you’re faced with proceedings involving sanctions or fines, we can assess the alleged misconduct, define a legal strategy and build a team to manage mitigation measures and communication. Our data protection and litigation experts can also assist with court proceedings.
  

• Individual (Mass) Litigation – Mass litigation claims are increasing in many countries. We can provide the internal IT structure and legal support that you need to respond to these proceedings efficiently.   

• Competitor Litigation – Our deep bench of legal talent can represent you in matters that involve data and unfair competition law, such as allegations of data protection breach.