Cybersecurity & Data Privacy

Related Professionals


Kirkland’s Cybersecurity & Data Privacy Practice Group focuses on advising companies on the complex business, technical and legal issues relating to data security and privacy protection. We not only advise clients on the rapidly evolving legal landscape applicable to data security and privacy; we also defend clients against regulatory or litigation challenges, including leading the defense of high-stakes regulatory actions and class actions raising claims based on cybersecurity or privacy. Our wide-ranging experience includes compliance questions that may require board-level attention, such as rapidly responding to cyberattacks, the implementation of AI, the intersection of privacy and healthcare, the unique concerns regarding children’s data, the appropriate collection and transfer of consumer and employee data, and managing vendor relationships, including advertising and analytics providers.

Drawing upon our cross-disciplinary experience, we represent and advise clients in the full spectrum of cybersecurity and data privacy matters.

  • Incident Response: Following a security incident or data breach, our team, in close coordination with in-house personnel and industry-leading forensic consultants, leads internal investigations into the incident, advises on crisis communications and handles legal notification obligations arising from the host of U.S. and international data breach laws, including the U.S. Security and Exchange Commission (SEC) Cybersecurity Rules, the Health Breach Notification Rule, China’s Cybersecurity Law and the Department of Defense (DOD) cybersecurity incident reporting requirements.
  • Litigation: Kirkland litigates aggressively on behalf of our clients facing lawsuits flowing from a security incident or alleged privacy violation, including consumer class actions under a wide variety of state consumer protection and wiretapping statutes; commercial litigation brought by business partners pursuant to various contractual obligations; and litigation brought by government privacy regulators.
  • Government Investigations: Our team regularly represents our clients in government investigations led by the U.S. Federal Trade Commission (FTC), state attorneys general (AGs), the SEC and various Congressional committees related to allegations of data privacy regulation violations and cybersecurity incidents.
  • Counseling: We routinely counsel clients regarding the global framework of legal and compliance developments, including industry and jurisdiction-specific regulations and requirements such as the FTC Act, the Children’s Online Privacy Protection Act (COPPA), the EU and UK General Data Protection Regulation (GDPR) and Artificial Intelligence Act and a host of U.S. state-specific privacy laws, including the California Invasion of Privacy Act and the Illinois Biometric Information Privacy Act (BIPA).
  • Transactions: Our team advises private equity sponsors and other investors on transactions in which cybersecurity incidents have the potential to impact a company’s sale, as well as on the legal considerations when a significant amount of data assets are involved.
  • Healthcare & Life Sciences: Our team has particularly deep experience in the unique cybersecurity and privacy issues applicable to companies operating in the healthcare sector, including advising on compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and other health-related privacy and cybersecurity laws and requirements.
  • Artificial Intelligence: Kirkland has built a market-leading, cross-functional team assisting clients with issues associated with AI. Our cyber- and privacy-focused attorneys work with our intellectual property attorneys and others to provide clients with advice and representation in a broad range of regulatory, transaction and disputes matters relating to AI, including matters focused on FTC Act compliance, products liability and copyright and trademark enforcement.