SKIP TO CONTENT
As the data privacy and security legal landscape rapidly evolves, so does the regulatory enforcement landscape around the globe. Organizations today are subject to more data privacy and security laws and regulatory scrutiny than ever before. This scrutiny – often taking the form of a formal investigation – may arise as a result of an organization self-disclosing a data privacy and security incident, a complaint filed by a third-party with a regulatory agency, or a regulatory agency becoming aware of an incident impacting an organization over which they exercise oversight. These investigations sometimes take years, involve voluminous requests, require the production of large amounts of information, and result in lengthy (and sometimes contentious) negotiations with regulators. Common areas of scrutiny and enforcement include alleged failure to implement reasonable data security standards; delayed or inadequate breach notification; violations of data privacy and security statutes; misleading or non-compliant privacy practices (such as a non-compliant privacy policy or notice); inadequate safeguards and vendor practices; and improper use of biometrics or other sensitive or protected information, among others.
Our international, cross-disciplinary Regulatory Investigation practice, comprised of Incident Response, Advisory Compliance, and Litigation attorneys, has counseled and defended thousands of organizations across all industry sectors in responding to investigative inquiries from regulators at the state, federal, international, and industry levels – negotiating enforcement actions and outcomes and mitigating regulatory exposure. Our practical and risk-based approach, coupled with our ability to align legal strategies with business objectives, allows us to effectively coordinate a response that protects organizations' operations, reputation, and financial bottom line in today’s highly visible regulatory environment.
We defend organizations at all stages of regulatory and government investigations including informal inquiries, civil investigative demands (CIDs), subpoenas, and formal enforcement proceedings. We regularly engage with, and practice before, key state and federal regulators across the U.S., as well as before other authorities around the globe.
Practice Leaders
Recent News & Events
July 7, 2026
Carolyn Purwin Ryan Joins Faculty for 2026 ClaimsXchange Cyber Claims Academy
Read MoreRepresentative Experience
- Successfully defended an organization in an investigation by the U.S. Federal Trade Commission (FTC) for violations of the FTC Act and the Gramm-Leach-Bliley Act (GLBA).
- Successfully defended a global tax preparation franchise in an investigation by the FTC in connection with the theft of taxpayer data.
- Advised a national restaurant chain during its appeal of financial penalties assessed by credit card brands and assisted with Payment Card Industry (PCI) compliance in connection with a compromise of systems used to process customer credit card data.
- Successfully defended thousands of healthcare organizations in U.S. Department of Health and Human Services (HHS) investigations in connection with the Health Insurance Portability and Accountability Act’s (HIPAA) Breach Notification Rule, Privacy Rule, and Security Rule.
- Successfully defended educational institutions in investigations by U.S. state and federal education agencies in connection with data privacy and security incidents impacting the security of school and student data.
- Successfully defended a health and fitness organization in an investigation conducted by the FTC.
- Successfully defended a national education technology company in an FTC investigation alleging unfair or deceptive practices under Section 5 of the FTC Act.
- Assisted private clients in the administrative healthcare space respond to numerous state Attorneys General (AG) inquiries regarding state law breach notification compliance.
- Successfully defended a financial institution under investigation by the UK’s Information Commissioner’s Office (ICO) for alleged breaches of data protection law.
- Successfully defended a global communications company in regulatory enforcement proceedings brought by the ICO for alleged contraventions of direct marketing rules.
- Successfully defended a telecommunications company from the imposition of a proposed Financial Penalty Notice in the UK, resulting in the proposed enforcement being ceased.
- Successfully prevented the imposition of an Enforcement Notice on behalf of a large data broker against proposed enforcement action by the ICO.