Your business just got off the ground, or maybe it’s still on the tarmac. You have to worry about recruiting new talent, marketing your products and services, securing your IP, and, most important, attracting investors. With all that to think about, why consider privacy and information security issues?

You should consider these issues for several reasons, but the prime reason is that you don’t need any distractions. Two features of this area of law are poised to become major distractions: increasingly frequent government enforcement actions and information security breaches.

The FTC has taken more than 20 actions alleging that inadequate information security constituted an unfair trade practice. These actions are typically settled with the offending entity, in which settlements require implementation of a comprehensive, written information security program and a third party audit of compliance with that program every other year for 10 or 20 years. Multiple state attorneys general have taken similar actions. In addition, Mississippi has just become the 46th state to enact a law requiring businesses experiencing a security breach to notify affected individuals if their personal information is impacted. These laws mean that whether an employee lost a laptop containing Social Security numbers or your system including financial account numbers was hacked, you have a legal obligation to send letters to each person affected explaining what happened. That letter may be read with interest by regulators, plaintiffs’ attorneys, the media, and, unfortunately, potential investors or customers. Whether you’re responding to government enforcement or containing a security breach, productivity and cash flow will both be adversely affected.