Security as a legal duty
Privacy law asks not only what a company collects and shares but also whether the information was protected. New York's SHIELD Act requires businesses holding private information about New York residents to maintain reasonable safeguards, and the Federal Trade Commission has long treated poor data security as an unfair practice. Sector rules for health and financial information add their own security requirements. The word reasonable carries much of the weight in these laws, and what it means depends heavily on the size of the business and the sensitivity of the data it holds. That judgment is made in hindsight, which is why a record of security decisions matters. Encryption, access logging, and timely patching are the kinds of measures regulators tend to ask about first after an incident.
Where the two programs meet
Data minimization is a privacy principle and a security control at the same time, since information that was never kept cannot be stolen. Access controls, retention schedules, and vendor reviews similarly belong to both teams. The handoff that fails most often comes when a security event touches personal information and the security team's incident process has to run alongside the legal team's notification analysis. Companies that keep the functions in separate silos often discover mid-incident that they have two inventories of the same data, and neither is complete.
A combined review
We usually look at cybersecurity and data privacy together because the questions overlap: what data the company holds, which laws apply because of whose data it is, what safeguards exist, and what the company has promised publicly. Statements about security in privacy policies, sales materials, or customer questionnaires are an often-overlooked source of exposure, since they can be measured against reality after an incident. Our first step is generally to compare those promises with the actual controls and data map. From there we recommend where the programs should share ownership and where they can reasonably stay separate.
