The consequences of noncompliance extend to the boardroom, and privacy lawsuits against directors and officers are on the rise. Plaintiffs have accused boards of neglecting their duty to oversee privacy and security risks that contribute to costly data breaches. Boards also have been sued for inadequately considering the impact of privacy compliance on business operations, as well as for inaccurate disclosure of the cost of compliance in public filings. 

From the EU General Data Protection Regulation (GDPR) to the California Consumer Privacy Act (CCPA), new laws protect broad categories of previously unregulated information that businesses routinely collect and store. A single misstep in managing these complex requirements can damage corporate reputations overnight, as well as inflict significant financial and operational harm. Companies that don't meet privacy regulations also can face hefty fines, injunctions, and statutory damages, even in the absence of a data breach. What's more, some mandates expressly permit consumer lawsuits for privacy violations. 

As with every material risk, corporate boards have a duty to oversee compliance and monitor privacy exposures. Doing so will require appropriate reporting systems and oversight procedures. Undertaking good faith efforts to implement appropriate processes can minimize the risk of noncompliance in the first instance and can provide some level of protection for the company and the board in the event that a privacy incident does occur. For strategic, long-term defense, however, businesses should adopt a comprehensive data privacy strategy.