On May 21, 2026, the New York State Department of Financial Services (“NYDFS”) issued two related industry letters: an advisory to CISOs of NYDFS-regulated entities addressing heightened cybersecurity risks associated…
Key Takeaways Two years after the May 21, 2024 statement by the Securities and Exchange Commission’s (“SEC”) Division of Corporation Finance clarifying the intended use of Item 1.05 of Form…
Debevoise & Plimpton’s Data Strategy & Security (DSS) team is pleased to contribute to the Legal 500 Country Comparative Guides: Data Protection & Cybersecurity with a new “Hot Topic” chapter…
On March 6, 2026, the White House released President Trump’s Cyber Strategy for America (the “Strategy”), a directional statement of the Administration’s cybersecurity priorities. The Strategy signals an aggressive posture…
As we approach the end of the year, here are the top 5 privacy posts on the Debevoise Data Blog in 2025. Takeaways for Large Firms from the SEC’s Reg…
As we approach the end of the year, here are the Top 5 Cybersecurity posts on the Debevoise Data Blog in 2025. 1. Protecting Privilege in Incident Response: Litigation Lessons…
Overview Companies responding to data breaches are faced with the question of whether their incident response investigation is protected by attorney-client privilege or attorney work-product doctrine. The issue primarily relates…
The California Privacy Protection Agency (the “CPPA”) Board met on July 24, 2025, to decide whether to adopt its comprehensive rulemaking package covering cybersecurity audits, automated decision-making technology, and other…
Most companies have implemented protocols for when an employee emails confidential information to the wrong person. A new version of that problem occurs when an employee uploads sensitive information to…
In Part 1 of this series, we discussed the annual cybersecurity audit requirements in the proposed rulemaking package (the “Draft Regulations”) of the California Privacy Protection Agency (the “CPPA”). In…