How risk managers can mitigate reputational damage arising from a data breach

Data security is not only a legal issue. “It is a significant reputational issue that attracts media attention,” says Arthur Artinian, partner in the London office of law firm K&L Gates and a member of its intellectual property group.

“A multi-stakeholder, enterprise-wide strategy is therefore essential. Every business should have in place some form of cross-functional cyber and data risk team that includes representatives from the IT, legal, operational, PR/corporate communications, risk management and senior management/board.

“That team should, if it hasn’t already, develop a crisis plan for managing and responding to security incidents in the specific business context.”

At an operational level, businesses should conduct a holistic audit and review of how they collect and use data, and test those findings against their legal and regulatory obligations.

“If third parties are involved in the use or collection of third-party data, contracts that are entered into with those parties should impose strict obligations to ensure that legal and regulatory obligations are complied with down the supply chain,” says Artinian.

Of course, insurance also has an important role to play in the cyber risk management toolkit, because it facilitates the assessment and transfer of cyber risk.

Assessing coverage

Sarah Turpin, a partner in the litigation and dispute resolution and insurance coverage practice groups at K&L Gates’ London office, says: “Some cover for

cyber risk is likely to be provided by existing insurance policies, but such policies have not historically been designed to cover the risks arising from intangible assets and network-related risks.

“A careful assessment of the coverage provided by existing policies is essential, as there are likely to be potential gaps in cover, which can be filled either by enhancements to existing policies – where available – or through the new cyber insurance products being offered by insurers.”

Although the cyber insurance market has developed rapidly in recent years, the scope of cover provided still varies significantly. Some policies still impose very onerous terms and conditions that may enable the insurer to deny or limit the cover provided.

“A careful assessment of the policy terms, conditions and exclusions is essential to ensure that the policy is fit for purpose and there are no exclusions or limitations that could prevent payout in the event of a significant claim,” says Turpin. “Some insurers are now providing access to their own panel law firms and cyber security specialists to assist insureds in the event of a cyber crime incident or data breach.

“This may prove beneficial in certain jurisdictions, but some insureds may prefer to use advisers they are already familiar with in what can be a crisis situation. Either way, it is worth considering these issues up front and attempting to reach agreement with insurers over who should be appointed.

“The purchase of insurance should be used as part of the risk management process and most insurers are likely to expect insureds to have appropriate incident response plans in place.”