Zachary Heck

Zach’s practice focuses on privacy and data security. Specifically, Zach assists clients in the areas of privacy compliance, data governance, and guidance in the aftermath of an information security incident, including data breach. Zach has experience advising clients with respect to FTC investigations, federal privacy regulations (such as HIPAA, FCRA, TCPA and GLBA), state laws governing personally identifiable information (e.g., CCPA/CPRA), foreign privacy regulations (e.g., PIPEDA and GDPR), artificial intelligence, and government contracting security requirements (e.g., NIST 800-171 and CMMC 2.0). For his clients, he also provides regulatory analysis, risk management, policy development, training, and audits. Zach speaks and writes regularly on cutting-edge data privacy and cybersecurity issues and is a Certified Information Privacy Professional in the fields of United States and European Union laws and regulations. Zach also holds the Certified Information Privacy Manager (CIPM) accreditation from the International Association of Privacy Professionals (IAPP). In 2025, Zach was globally certified as an Artificial Intelligence Governance Professional by the IAPP.

• Publication, Top 10 Technology Legal Issues to Watch for in 2025, Dayton Bar Briefs, January/February 2025
• Presentation, Privacy and AI, University of Dayton Program in Law & Technology, November 1, 2024
• Presentation, Data Dilemmas: How Consumer Health Data Laws Transform Data Governance and Security, Northern Kentucky University Cybersecurity Symposium, October 18, 2024
• Publication, Artificial Intelligence, Real Liability: Who’s on the Hook When Things Go Wrong?, Dayton Bar Briefs, September/October 2024
• Presentation, OpenAI, Open Book: Emerging Privacy and Security Issues in the Age of Generative AI, Philadelphia IAPP KnowledgeNet, June 26, 2024
• Presentation, Avoiding Hacks and Ransomware Attacks: What Lawyers Need to Know, ALI-CLE, March 27, 2024
• Panel, Developing a Privacy Program, Masters Conference, September 12, 2023
• Presentation, OpenAI, Open Book: Emerging Privacy and Security Issues in the Age of Generative AI, Columbus IAPP KnowledgeNet, August 31, 2023
• Phishing Season: A Lawyer’s Guide to Navigating Ransomware, CinPA Security SIG June 15, 2023
• Panel, Federal Alignment to Cybersecurity, Cyber Dialogue with Industry, February 27, 2023
• Presentation, Ran-some, Lose-some: Preparing for and Surviving Legal Requirements of Ransomware Attacks, Northern Kentucky University Cybersecurity Symposium, September 28, 2022
• Presentation, Security Vulnerabilities and Ransomware Shutdowns: Learning from Apache Log4j Vulnerability and the Associated Legal Duties, MyLawCLE and Federal Bar Association, August 25, 2022
• Presentation, Ran-some, Lose-some: Preparing for and Surviving Against Ransomware Attacks, Ohio Valley ABC, January 25, 2022
• Presentation, “Cybersecurity Maturity Model Certification: Policy and Technical Requirements,” Public Contracting Institute, November 3, 2021
• Presentation, “How Do I Actually Do This? Addressing Data Subject Rights Laws, Northern Kentucky University Cybersecurity Symposium, October 8, 2021
• Presentation, “Your Privacy Program,” University of Dayton School of Law Program in Law & Technology Annual Seminar, June 11, 2021
• Presentation, “Doing Your HOMEwork: Setting Up an Effective Work from Home Framework,” Technology First, July 9, 2020
• Publication:  “Working from Home?  Online Scammers are Not Social Distancing,”  Dayton Bar Briefs, April 2020
• Presentation, “NIST Compliance and Industry Updates,” Wright Dialogue with Industry, July 18, 2019
• Presentation, “GDPR’s Paper Anniversary:  How We Have Documented Progress and Lessons Learned,” University of Dayton School of Law Program in Law & Technology Annual Seminar, June 7, 2019
• Presentation, “Can You Hack Back?”  Ohio Cyber Dialogue with Industry, May 8, 2019
• Publication, “A Litigator’s Primer on European Union and American Privacy Laws and Regulations,” American Bar Association Litigation Journal, Winter 2018
• Publication, “SEC Warns Celebrities About Cryptocurrency Endorsements,” TYL (American Bar Association), February 2, 2018
• Interviewed in “Net Neutrality Vote Pending,” WDTN 2 News, November 27, 2017
• Presentation, “Data Governance for Law Firms,” Dayton Chancery Club, November 17, 2017
• Publication, “HBO Refuses to Bend the Knee During Data Breach,” American Bar Association, November 2017
• Presentation, “Biometrics & The Importance of Privacy Impact Assessments: What We Can Do Better,” Indiana University Center for Applied Cybersecurity Research, October 19, 2017
• Presentation, “Virtual Reality: Altering the Way We Look at Data Governance & Privacy Impact Assessments,” Northern Kentucky University Cybersecurity Symposium, October 13, 2017
• Interviewed in “How to Spot and Prevent Cyberbullying: Twitter Q&A”, PBS NewsHour, July 12, 2017
• Quoted in “Can You Record Fireworks with a Drone?” Consumer Reports, July 1, 2017
• Interviewed in “Privacy Law with Zach Heck – Is CIPP/US Certification Worth it?” Law School Strategy, June 21, 2017