1. Home
  2. |Experience
  3. |Privacy and Cybersecurity

Privacy and Cybersecurity

Overview

Today’s businesses operate in an environment marked by evolving and complex data protection laws and relentless cyber attacks by both private and state-sponsored actors. Remaining competitive while ensuring regulatory compliance across multiple jurisdictions and implementing a strong cyber defense can be daunting. Crowell offers companies an integrated approach to managing privacy and cybersecurity risks combining legal, technical, and regulatory experience in a single seamless team across global markets.

Crowell’s Privacy and Cybersecurity Group includes lawyers with extensive government, in-house, consulting, and technical experience across multiple industries. Where necessary, we integrate Crowell’s intellectual property, corporate, insurance, white collar, trade secrets, health care, energy, transportation, and government contracts capabilities to address the privacy and cybersecurity risks faced by our clients. We also work closely with our affiliate, Crowell Global Advisors, which is deeply involved with the privacy laws of Pacific Rim nations. Our lawyers regularly work with forensic professionals and coordinate with law enforcement.

Our Services

Risk Assessment and Compliance

Our team facilitates enterprise-wide cybersecurity and privacy risk assessments to mitigate threats and enhance legal compliance, including:

  • Holistic compliance strategies and assessments focused on industry-specific best practices and applicable laws, such as GDPR, CPRA, COPPA, HIPAA, and GLBA, as well as other government standards, such as the DFARS and CMMC.
  • Custom-designed incident response plans and training—through tabletop exercises and other tools—to ensure organizations respond efficiently and effectively to an incident.

Crisis Management and Investigations

We represent a wide range of clients who have experienced cyber and data incidents. Our work includes:

  • Responding to and managing privacy and data security incidents.
  • Crisis management when a privacy or security vulnerability is made public.
  • Collaborating with technical consultants as appropriate to determine the cause of the incident or system compromise.
  • Implementing long-term remediation solutions.
  • Engaging with federal and state enforcement agencies, as well as private stakeholders.

Regulatory and Litigation Defense

Our lawyers defend clients against class actions, regulatory enforcement actions, and other high-profile privacy/cyber–related matters that pose an existential threat in the digital economy. The team is recognized for developing proactive cyber strategies to disrupt and dismantle criminal organizations engaged in cybercrimes.

Resources

CMMC Registered Provider Organization

Certified Information Privacy Professionals (CIPP)

Contacts

See All Professionals

Insights

Client Alert | 4 min read | 11.18.25

DOJ Announces Major Enforcement Actions Targeting North Korean Remote IT Worker Schemes

On November 14, 2025, the U.S. Department of Justice (DOJ) announced a sweeping series of enforcement actions, including four guilty pleas and more than $15 million in civil forfeitures against the  Democratic People’s Republic of Korea (DPRK or North Korea) for remote information technology (IT) worker schemes. These actions underscore the federal government’s escalating focus on the exposure of U.S. companies to North Korean IT worker infiltration, following a series of U.S. Government action against the DPRK....

View All Insights

Insights

Client Alert | 4 min read | 11.18.25

DOJ Announces Major Enforcement Actions Targeting North Korean Remote IT Worker Schemes

Client Alert | 6 min read | 11.18.25

The UK’s Cyber Security & Resilience Bill at a glance

Speaking Engagement | 11.14.25

"Building Trusted Environments: Architecture, Privacy, and Design," Privacy + Security Forum

Publication | 11.14.25

Three Steps Tech Companies Can Take Today To Prepare To Ride A Blue Wave In 2026

View All Insights

Professionals

View All Professionals

Insights

Client Alert | 4 min read | 11.18.25

DOJ Announces Major Enforcement Actions Targeting North Korean Remote IT Worker Schemes

On November 14, 2025, the U.S. Department of Justice (DOJ) announced a sweeping series of enforcement actions, including four guilty pleas and more than $15 million in civil forfeitures against the  Democratic People’s Republic of Korea (DPRK or North Korea) for remote information technology (IT) worker schemes. These actions underscore the federal government’s escalating focus on the exposure of U.S. companies to North Korean IT worker infiltration, following a series of U.S. Government action against the DPRK....

View All Insights

Practices

Industries

Contacts

See All Professionals

Insights

Client Alert | 4 min read | 11.18.25

DOJ Announces Major Enforcement Actions Targeting North Korean Remote IT Worker Schemes

On November 14, 2025, the U.S. Department of Justice (DOJ) announced a sweeping series of enforcement actions, including four guilty pleas and more than $15 million in civil forfeitures against the  Democratic People’s Republic of Korea (DPRK or North Korea) for remote information technology (IT) worker schemes. These actions underscore the federal government’s escalating focus on the exposure of U.S. companies to North Korean IT worker infiltration, following a series of U.S. Government action against the DPRK....

View All Insights