Recent headlines have publicized the expanding duties that
courts and governments everywhere are imposing on businesses to
take measures to protect against the unauthorized access to and
theft of people’s sensitive personal
information—whether it be the GDPR ( the EU’s onerous
General Data Protection Regulation), the California Consumer
Privacy Act (set to take effect in 2020), New Jersey’s nine
pending pieces of legislation related to cybersecurity and data, or
the Pennsylvania Supreme Court’s recent ruling that an
employer has a common law duty to use reasonable care to safeguard
employees’ personal information stored on an Internet
accessible computer.
Many small to medium-sized business owners assume that such laws
do not apply to them, or that data breaches are a “big
corporation” problem, but U.S. businesses of all sizes are
vulnerable to cyberattacks and privacy violations. While there is
no way to totally prevent data breaches, there are manageable,
discrete
