Overview
Lisa chairs the firm’s top-ranked global privacy and cybersecurity practice and is the managing partner of the firm’s New York office. Lisa has received widespread recognition for her work in the areas of privacy and cybersecurity. Chambers USA quotes clients who call her a “market leader,” noting that she is “widely considered the best.” Another client reported that “she is a strong leader with fantastic advice. She does great work on advisory boards and her leadership in the industry has really moved it forward.” Chambers and Partners honored Lisa with the 2021 Outstanding Contribution to the Legal Profession award, which is given to only one lawyer each year for exceptional achievements, and noted that a peer enthused, “Lisa Sotto is a legend.” Clients have called Lisa “the high priestess of privacy” and “the queen of breach.” She was named among The National Law Journal’s “100 Most Influential Lawyers,” an honor bestowed on practicing attorneys who are making the biggest impact in the legal world.
A preeminent lawyer and dynamic problem solver, Lisa assists clients in identifying, evaluating and managing risks associated with privacy and data security practices. She advises clients on the California Consumer Privacy Act of 2018 and other comprehensive state privacy laws, GLB, HIPAA and state health privacy laws, COPPA, CAN-SPAM, FCRA, VPPA, data breach notification laws, and other U.S. state and federal privacy and cybersecurity requirements (including HR rules), and global data protection laws (including those in the EU, Asia and Latin America). She provides extensive advice on cybersecurity risks, incidents and policy issues, including proactive cyber incident readiness. Through the firm’s privacy and security in M&A transactions team, Lisa also guides clients on risks and potential liabilities associated with inadequate privacy and data security practices in high-stakes corporate transactions. She conducts all phases of data privacy assessments and information security policy audits. She also develops corporate records management programs, including policies, records retention schedules and training modules.
Lisa has been rated the “No. 1 privacy professional” in all surveys by Computerworld magazine. She is recognized by Chambers and Partners as a “Star” performer (the highest honor) for privacy and data security—the only privacy lawyer in the United States to receive this distinguished ranking. She also is ranked among the leading lawyers in Band 1 for incident response. Lisa is recognized as a leading lawyer for cyber crime, data protection and privacy by The Legal 500 United States. In addition, Hunton Andrews Kurth’s privacy and cybersecurity practice has received the topmost national rankings in privacy and data security both from Chambers and Partners and The Legal 500.
Lisa speaks frequently at conferences, has testified regularly before the US Congress and other legislative and regulatory agencies, is the author of numerous treatises and articles, has been tapped to lead several industry committees and organizations, is sought after by media outlets and industry publications for her professional insights, and appears regularly on national television and radio news programs. She is the editor and lead author of the Privacy and Cybersecurity Law Deskbook, published by Aspen Publishers, Wolters Kluwer Law & Business.
Experience
- Appointed by Secretaries Mayorkas, Nielson, Johnson and Napolitano as Chair of the US Department of Homeland Security’s Data Privacy and Integrity Advisory Committee (2012-present); previously served as Vice Chair (2005-2009).
- Testified in FTC Hearing on Competition and Consumer Protection in the 21st Century, focusing on the US framework related to consumer data security.
- Testified before the European Commission and five EU Supervisory Authorities during the Annual Review of the EU-US Privacy Shield.
- Selected by the European Commission and US Department of Commerce as one of a small group of 16 arbitrators in connection with the EU-US Privacy Shield Framework Binding Arbitration Program.
- Selected to represent the US Chamber of Commerce in Brussels to present “Global Best Practices Around Data Breach Notification,” a report prepared by Hunton Andrews Kurth LLP and the Chamber.
- Selected to represent the US Chamber of Commerce in Indonesia to present “Business Without Borders: The Importance of Cross-Border Data Transfers to Global Prosperity,” a report prepared by Hunton Andrews Kurth LLP and the Chamber.
- Selected as member of US government delegation to Brazil to brief Brazilian government officials on US privacy and cybersecurity policy.
- Selected to advise Commissioner Shimpo of the Personal Information Protection Commission of Japan on US privacy and data security law.
- Selected to advise the Serbian government on global data protection law and to draft the country’s data security and breach notification laws. Lisa was sponsored by the USAID-funded Judicial Reform and Government Accountability Project.
- Testified before US House of Representatives, “Data Protection and the Consumer: Who Loses When Your Data Takes a Hike?”
- Testified before US Department of Health & Human Services’ Subcommittee on Privacy and Confidentiality of the National Committee on Vital and Health Statistics regarding RFID use in health care.
- Testified before CSIS Commission on Cyber Security for the 44th Presidency.
- Briefed the Secretary of the Army’s cyber strategic group on current issues in cybersecurity
- Briefed congressional staffers in preparation for data breach hearings held by the House of Representatives Committee on Homeland Security, Subcommittee on Emerging Threats, Cybersecurity and Science and Technology, and in connection with drafting of a comprehensive privacy bill.
- Selected to advise DHS’s Homeland Security Science and Technology Committee (HSSTAC) regarding Third Party Pre-Screening Program.
- Selected by US Government Accountability Office to provide advice for a GAO study on data security breaches.
- Selected by US Office of Management and Budget to participate in OMB analysis of DHS Privacy Office.
- Routinely assists clients in developing policy positions regarding privacy and cybersecurity legislative and regulatory proposals both in the US and abroad.
- Advising over 80 clients on compliance with the California Consumer Privacy Act of 2018 (CCPA), California Privacy Rights Act of 2020 (CPRA) and other state privacy laws, including conducting due diligence, preparing gap analyses, developing remediation plans, and undertaking compliance projects.
- Advises clients on FTC, OCR, SEC and state Attorney General (including Multistate Taskforce) investigations and enforcement actions for alleged data security and privacy violations.
- Advises clients on managing FTC Consent Orders and CIDs in connection with data security incidents.
- Advises major health care providers and health plans on all aspects of HITECH security breaches, including OCR and state enforcement.
- Advises numerous major retailers, financial institutions and other companies on proactive cybersecurity readiness, including developing and conducting full-scale tabletop exercises for C-suite executives and boards of directors.
- Since 2005, advised on over 3,000 cybersecurity and data breach incidents in the United States and abroad, including many of the world’s seminal events (such as the Colonial Pipeline ransomware incident and Yahoo! breaches affecting 3.5 billion user accounts).
- Advised well-known telecom manufacturer on extensive APT attack involving significant loss of intellectual property.
- Advised numerous major retailers on security breaches resulting from criminal tampering of POS terminals, including FBI involvement, forensic investigations, breach notification and PR efforts.
- Advised Texas State Comptroller in connection with well-known data security incident involving 3.5 million state workers.
- Advised many multinational clients on EU-US Data Privacy Framework and Privacy Shield certifications and annual recertifications.
- Counseled numerous technology companies (both as publishers and advertisers) on data collection and sharing issues (including online behavioral advertising and Big Data initiatives), and the collection and use of geolocation data.
- Counseled major consumer goods companies on privacy issues associated with the use of radio frequency identification (RFID) and data collection from mobile devices.
- Advised multiple clients on employee monitoring and surveillance issues under federal, state and international laws, and prepared related policies (including BYOD).
- Conducted comprehensive privacy and information security policy assessments of major US electric utility and retail and consumer goods companies, including extensive data flow mapping, remediation, and development and implementation of multiple privacy, information security and records management policies and procedures.
- Served as HIPAA privacy counsel to large health care system, including over 40 hospitals and long-term care and assisted living facilities, and major academic medical center.
- Developed and implemented comprehensive global records management program in over 100 countries for one of world's largest software companies (under court supervision), including preparation and implementation of policies and procedures, numerous records retention schedules, in-person and web-based training and audit program.
Books
- Editor and lead author, Privacy and Cybersecurity Law Deskbook (1,400-page treatise and annual updates), Aspen Publishers, Wolters Kluwer Law & Business, 2010-2024
- Contributing editor and co-author, Data Protection & Privacy, United States, Getting the Deal Through, 2014-2021
- Co-author, Navigating The Digital Age, The Definitive Cybersecurity Guide For Directors and Officers Vol. 3, Lessons From Today’s World, How to Manage a Data Breach, January 2021
- Co-author, Cybersecurity and Data Breach, Bloomberg BNA Privacy & Data Security Portfolio Series, 2019
- Co-author, Chapter 11 European Union Data Protection, Data Security and Privacy Law: Combating Cyberthreats, West, Thomson Reuters, 2010
- Co-author, Data Security Handbook, ABA Section of Antitrust Law, 2008
- Co-author, Privacy Primer: An Overview of Global Data Protection Laws, 2006
Media Appearances
- Priestess of Privacy, Penn Law Journal (Sotto Featured), August 19, 2019
- Thought Leaders in Privacy, DataGuidance (Sotto interviewed), May 1, 2017
- Bisnow Morning Brief NY, “16 Things You Need to Know This Morning” (Sotto interviewed), February 6, 2017
- Electronic Discovery Institute’s Distance Learning Initiative, Information Security 101 (Sotto interviewed), February 2017
- Interview, Cybersecurity Risks and Legal Landscape, KUCI 88.9 FM (National Public Radio), “Privacy Piracy: Protect Your Privacy in the Information Age” (Sotto featured in 30-minute interview), July 25, 2016
- Mimesis Law’s Cy-Pher Executive Roundtable, What Do You Do With A Hacked Law Firm? (Sotto interviewed), June 10, 2016
- Mimesis Law’s Cy-Pher Executive Roundtable, Are Law Firms Soft Targets For Hackers? (Sotto interviewed), May 23, 2016
- CASE in POINT, “Understanding New Threats to Privacy and Cybersecurity” (Sotto interviewed), March 3, 2015
- HuffPost Live, Regulator Warns of 'Cyber 9/11' Attacks on Banks (Sotto interviewed), March 2, 2015
- AskForbes Twitter Chat, What Companies Should Do When They’re Breached, August 26, 2014
- Interview, Female Powerbrokers Q&A: Hunton & Williams’ Lisa Sotto, Law360, December 4, 2013
- Interview, Cybersecurity Risks and Legal Landscape, KUCI 88.9 FM (National Public Radio), Privacy Piracy: Protect Your Privacy in the Information Age (Sotto featured in 30-minute interview), June 3, 2013
- Interview, Should There Be a “Right to be Forgotten” Online? (Sotto interviewed), CBSnews.com, May 10, 2013
- Legal Trends Roundtable: Parts 1-5, 2013 The Year Ahead in Privacy and Data Security (Sotto interviewed), com, January-February 6, 2013
- Privacy Law Expert: Many Companies Waiting for a Hack (Sotto interviewed), Bloomberg Law, November 1, 2012
- Radio Television of Serbia, Data Protection Act Good (English translation) (Sotto interviewed), July 18, 2012
- B92 (Serbian radio and television broadcaster), Careful Sharing Data (English translation) (Sotto interviewed), July 18, 2012
- Privacy Bill of Rights: A Step Forward, “Can’t be a Back-Burner Issue,” Privacy Lawyer Argues (Sotto interviewed), March 20, 2012
- Interview (podcast), Privacy Bill of Rights: Not Be-All, End-All, Security Media Group, February 24, 2012
- Breach Response: The Legal View, Fast Action Can Save Reputation and Ensure Compliance (Sotto interviewed), com, December 15, 2011
- Breach Response: Reputational Risk, Your Organization’s Name Hinges on Data Value and Security (Sotto interviewed), com, November 30, 2011
- Law360, Q&A with Hunton & Williams’ Lisa Sotto (Sotto interviewed), November 4, 2011
- KUCI 88.9 FM, Protect Your Privacy in the Information Age (Sotto featured in 30-minute interview), September 19, 2011
- FoxLive.com, Is There Need for a Data Privacy Law? (Sotto interviewed), September 6, 2011
- End to End Trust, Microsoft Corporation, regarding cross industry collaboration and a safer Internet (Sotto interviewed), September 2009
- CNN’s American Morning, Privacy in the Obama Administration (Sotto interviewed), December 8, 2008
- ClearChannel Radio, “Tech Talk with Craig Peterson,” regarding the use of RFID in health care (Sotto interviewed), March 4, 2006
Accolades
Honors & Recognitions
- Recognized as Hall of Fame for Cyber Law (including Data Privacy and Data Protection) (2020-2024) and as a Leading Lawyer (2013-2019) and for Cyber Crimes (2009-2016), and Recommended for FinTech (2019-2024), Legal 500 United States
- Recognized as a Star Individual in Privacy & Data Security, USA-Nationwide (2013-2024); Band 1 (2007-2012); as a Star Individual in Privacy & Data Security: Cybersecurity, USA-Nationwide (2024); and as a Leader in Privacy & Data Security: Incident Response, USA-Nationwide (2021-2023), Chambers USA
- Recognized as a Star Individual in Privacy & Data Security, USA (2015-2024); Band 1 (2007-2013); and as a Leader in Privacy & Data Security: Incident Response, USA (2022-2024), Chambers Global
- Recognized as one of the world’s leading practitioners in Who’s Who Legal Thought Leaders: Data 2019-2024; and Who’s Who of Information Technology Lawyers 2011-2023
- Honored as a Client Choice Award winner by Lexology, 2022
- Recognized as a Distinguished Leader by New York Law Journal, 2022
- Named a “Client Service All‐Star” by BTI, 2022
- Recognized as a Leader in Legal: Data Protection & Cyber Security, USA; Band 1, Chambers FinTech, 2019-2025
- Recognized as a Women in Data by Global Data Review, 2022
- Selected for Outstanding Contribution to the Legal Profession, Chambers and Partners, 2021
- Recognized among Women in IT Security as a 2020 Veteran, SC Media, 2020
- Recognized among Women in Security PowerPlayers, SC Media, 2019
- Named among the 100 Most Influential Lawyers, National Law Journal, 2013
- Named among Incident Response 30, Cybersecurity Docket, 2016 and 2018
- Named among the 500 Leading Lawyers in America, Lawdragon, 2014-2016
- Named among Cybersecurity & Data Privacy Trailblazers, National Law Journal, 2015
- Named among 45 Regulatory & Compliance Trailblazers, National Law Journal, 2015
- Named among the 75 Outstanding Women Lawyers, National Law Journal, 2015
- Named among Attorneys Who Matter, Ethisphere Magazine, 2009, 2012, 2013, 2015
- Voted Number 1 in all Computerworld polls of global privacy advisors
- Named among Women in Law, Lawyer Monthly Magazine, 2017
- Selected among New York County Lawyers Association’s Outstanding Women in the Legal Profession, December 11, 2017
- Selected as Lawline’s Top 20 Women Faculty of 2016, April 18, 2017
- Selected for Expert Guides’ “Best of the Best Expert Guide” as a Top 30 Privacy and Data Protection Practitioner Worldwide, 2017-2019
- Recognized as one of the world’s leading practitioners in The International Who’s Who of Information Technology Lawyers 2011-2021, Who’s Who Legal, ABA Section of International Law and the International Bar Association
- Selected as a Super Lawyer for Technology Transactions Law, The New York Times Magazine, 2006-2023
- Selected as one of The Top Women Attorneys for Information Technology/Outsourcing in the New York Metro Area, Super Lawyers
- Honoree, Empire State Counsel Program, New York State Bar Association, Pro Bono Affairs, 2011, 2014
- 2000 Champion of Justice Award, New York City Bar Association, 2000
- Designated a Privacy Law Specialist, International Association of Privacy Professionals, American Bar Association Accredited Lawyer Certification Program
- Certified Information Privacy Professional/United States (CIPP/US and CIPM), International Association of Privacy Professionals
- Westin Emeritus Fellow, International Association of Privacy Professionals
- Fellow of Information Privacy, International Association of Privacy Professionals
Affiliations
Professional
- Chair, US Department of Homeland Security’s Data Privacy and Integrity Advisory Committee, 2012-present; appointed to Committee by Secretaries Mayorkas, Nielson, Johnson, Napolitano, Chertoff and Ridge; Chair, Policy Subcommittee, 2010-2012; Committee Vice Chair, 2005-2009; Member, Cybersecurity Subcommittee, 2013-present (requiring Top Secret security clearance)
- Member, New York State Department of Financial Services’ (NYDFS) Financial Innovation Advisory Board, 2022-Present
- Chair, New York Privacy Officers Forum, 2007-present
- Lead Advisor, DataGuidance US Panel of Experts, 2008-present
- Member, American Law Institute
- Fellow, American Bar Foundation
- Member, Board of Directors, International Association of Privacy Professionals, 2010-2015
- Member, Board of Directors, Identity Theft Resource Center, 2010–2012
Insights
Legal Updates
Events & Speaking Engagements
Publications
News
Education
JD, University of Pennsylvania Law School, Law Review
BA, History, Cornell University, distinction in all subjects
Admissions
New York
Areas of Focus
- Privacy and Cybersecurity
- Cybersecurity Incidents
- National Security
- European Data Protection and Privacy
- Children’s Privacy
- Records Management
- Blockchain and Digital Assets
- AI and Emerging Technologies
- Crisis Management
- Global Economic Development, Commerce, and Government Relations Group
- FinTech
- Corporate
- California Consumer Privacy Act of 2018 (CCPA)
- Financial Services
- Hospitality
- Retail and Consumer Products
Privacy and information security, once overlooked in many corporate transactions, are now taking center stage.
Our cyber and physical security task force works with companies to minimize the risks and consequences of a serious security incident. Learn More