How should legal departments prepare for, respond to and remediate data breaches? – Canadian Lawyer

According to the panelists at a recent webinar hosted by the Canadian Legal Innovation Forum, cybersecurity risks and ransomware attacks are on the rise in Canada. Reporting on the cybersecurity webinar for Canadian Lawyer, journalist Lucy Saddleton relays the best practices shared by speakers at the conference for mitigating the risks associated with potential cyber attacks – both before and after data breaches. John Salloum, partner in Osler’s Privacy and Data Management group and one of the expert panelists, explains that it’s critical to have a strong breach response plan prepared in advance that specifies the role different departments in the organization will play.

“You don’t want to have to figure out who is going to be doing what in the middle of a ransomware breach,” he says. It’s especially important to have someone on board who can ascertain the full extent of the breach.

John continues by recommending a four-step process that organizations should follow when they’re faced with a breach, beginning with containing the breach and evaluating the risks involved. Then, he says, all stakeholders should be notified – whether it’s legally required or not – and the situation should be assessed and preventative measures put in place to ensure there isn’t another breach in the future.

In the event of a breach, John also suggests that organizations notify their insurance company quickly, even if the policy doesn’t specifically cover ransomware attacks.

“Insurers are getting more sophisticated with learnings around the types of things that they will insure and the types of things that they will exclude, and requirements they have in place to get that insurance,” he explains. That said, part of the loss may be covered by another section of the policy.   

Finally, the panelists agree that legal teams should meet with all stakeholders to determine the procedures that can be implemented to prevent further incidents, and in particular emphasize the importance of establishing solid retention policies. 

For further information, read Lucy Saddleton’s full article from April 7, 2022, “How should legal departments prepare for, respond to and remediate data breaches?” in Canadian Lawyer.