Privacy Counsel High Demand, Low Supply Raises Costs

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By Daniel R. Stoller

May 6 — The demand for privacy and security guidance is high as companies increasingly realize the cybersecurity risks they face. But a limited supply of qualified privacy professionals is driving up the cost of that guidance, according to recent research.

There has been “a gigantic uptick in the number of companies that are seeking” privacy counsel, Lisa Sotto, chairwoman of Hunton & Williams LLP privacy and cybersecurity practice, said at a Bloomberg Law/International Association of Privacy Professionals May 5 Web conference on The Market for Data Privacy Legal Services: Survey and Analysis.

As more and more companies use “complex processing systems and are more multinational” the more important it is “to have outside counsel chime in” and confirm that they are following proper privacy and data protection laws, Renard Francois, global chief privacy officer at General Electric Co., said.

Sotto said that companies who experience a data breach or cyberattack are looking for law firms that offer “the best legal services” because there is “no room for error.” These companies are looking for “board ready” attorneys who can come in from day one and know how to handle the situation, she said.

Changing Views

Francois said senior leadership at companies have tended to focus on other risks that they have deemed “far more important” than privacy. But, the increased sanctions that come with the EU General Data Protection Regulation and a comprehensive “regulatory landscape has changed this view,” he said.

Alex Butler, vice president and general manager of IP, Privacy & Data Security at Bloomberg Law said that due to the high demand for outside counsel it “is a good time to be a privacy attorney if you have experience.”.

Privacy counsel may come with a higher price tag because cybersecurity is a “nascent field” and very few attorneys have experience in this space,” Sotto said.

However, more and more corporations are seeing the need to pay a high price for privacy counsel, Francois said.

Butler said the shortage of qualified privacy attorneys may be due to a dearth of law school training in the subject. The “majority of law schools don't have privacy courses,” he said. “There isn't a large supply of attorneys entering the early stages of their career with a privacy background.”

To contact the reporter on this story: Daniel R. Stoller in Washington at

To contact the editor responsible for this story: Donald G. Aplin at

For More Information

A free copy of The Market For Data Privacy Legal Services is available at