To any good lawyer, the answer is 'both' are
important. However, most in-house counsel know the answer is
which receives the limited available budget. Compliance
budgets usually follow the greatest risks for the company.
Therefore, in Europe, where the EU's General Data Protection
Regulation is the scariest new compliance issue, it stands to
reason that data privacy will take a larger portion of the budget
than cybersecurity. However, in the US, where the penalties
for poor cybersecurity can be huge (from governmental penalties, to
class action and shareholder derivative lawsuits), I believe it is
generally the opposite.
What about much of the rest of the world, where the penalties
for loss of personal data or for a cyber breach are insubstantial
to non-existent? In many such places, I have seen a much
lower budget allotment to either issue. Indeed, across Asia,
some of the very largest companies do not even have an Information
Security Officer, or someone
