Zachary Heck

Zach’s practice focuses on privacy and data security. Specifically, Zach assists clients in the areas of privacy compliance, data governance, and guidance in the aftermath of an information security incident, including data breach. Zach has experience advising clients with respect to FTC investigations, federal privacy regulations (such as HIPAA, FCRA, TCPA and GLBA), state laws governing personally identifiable information (e.g., CCPA/CPRA), foreign privacy regulations (e.g., PIPEDA and GDPR), artificial intelligence, and government contracting security requirements (e.g., NIST 800-171 and CMMC 2.0). For his clients, he also provides regulatory analysis, risk management, policy development, training, and audits. Zach speaks and writes regularly on cutting-edge data privacy and cybersecurity issues and is a Certified Information Privacy Professional in the fields of United States and European Union laws and regulations. Zach also holds the Certified Information Privacy Manager (CIPM) accreditation from the International Association of Privacy Professionals.

• Panel, Developing a Privacy Program, Masters Conference, September 12, 2023
• Presentation, OpenAI, Open Book: Emerging Privacy and Security Issues in the Age of Generative AI, Columbus IAPP KnowledgeNet, August 31, 2023
• Phishing Season: A Lawyer’s Guide to Navigating Ransomware, CinPA Security SIG June 15, 2023
• Presentation, A Litigator’s Guide to Navigating Data Breaches and Ransomware, Dayton Bar Association Inn of Court, April 25, 2023
• Panel, Federal Alignment to Cybersecurity, Cyber Dialogue with Industry, February 27, 2023
• Presentation, Ran-some, Lose-some: Preparing for and Surviving Legal Requirements of Ransomware Attacks, Northern Kentucky University Cybersecurity Symposium, September 28, 2022
• Presentation, Empowering and Teaching Students to Advocate, Ohio Center for Law-Related Education, September 28, 2022
• Presentation, Security Vulnerabilities and Ransomware Shutdowns: Learning from Apache Log4j Vulnerability and the Associated Legal Duties, MyLawCLE and Federal Bar Association, August 25, 2022
• Presentation, “Operationalizing a Privacy Program,” University of Akron Law Review Cybersecurity Symposium, March 4, 2022
• Presentation, Ran-some, Lose-some: Preparing for and Surviving Against Ransomware Attacks, Ohio Valley ABC, January 25, 2022
• Presentation, “Cybersecurity Maturity Model Certification: Policy and Technical Requirements,” Public Contracting Institute, November 3, 2021
• Presentation, “How Do I Actually Do This? Addressing Data Subject Rights Laws, Northern Kentucky University Cybersecurity Symposium, October 8, 2021
• Presentation, “Your Privacy Program,” University of Dayton School of Law Program in Law & Technology Annual Seminar, June 11, 2021
• Presentation, “Doing Your HOMEwork: Setting Up an Effective Work from Home Framework,” Technology First, July 9, 2020
• Publication:  “Working from Home?  Online Scammers are Not Social Distancing,”  Dayton Bar Briefs, April 2020
• Presentation, “What’s New? Exploring Advancements in Technology During the Big Data Era,” Dayton Bar Association Corporate Counsel Committee, November 21, 2019
• Presentation, “What’s Law Got to Do With It? Cybersecurity Essentials for Lawyers,” Dayton Intellectual Property Lawyers Association, November 1, 2019
• Ohio Women’s Bar Association article, ” Ohio Incentivizes Businesses to Get Serious About Data Security,” Fall 2019
• Presentation, “NIST Compliance and Industry Updates,” Wright Dialogue with Industry, July 18, 2019
• Presentation, “GDPR’s Paper Anniversary:  How We Have Documented Progress and Lessons Learned,” University of Dayton School of Law Program in Law & Technology Annual Seminar, June 7, 2019
• Presentation, “Can You Hack Back?”  Ohio Cyber Dialogue with Industry, May 8, 2019
• Publication, “A Litigator’s Primer on European Union and American Privacy Laws and Regulations,” American Bar Association Litigation Journal, Winter 2018
• Publication, “SEC Warns Celebrities About Cryptocurrency Endorsements,” TYL (American Bar Association), February 2, 2018
• Presentation, “Data Governance Basics for IP Lawyers,” Dayton Bar Association Intellectual Property Seminar, December 21, 2017
• Presentation (Moderator), “Data Breach and Cybersecurity Summit,” Ohio State Bar Association, December 11, 2017
• Interviewed in “Net Neutrality Vote Pending,” WDTN 2 News, November 27, 2017
• Presentation, “Data Governance for Law Firms,” Dayton Chancery Club, November 17, 2017
• Publication, “HBO Refuses to Bend the Knee During Data Breach,” American Bar Association, November 2017
• Presentation, “Anatomy of a Data Breach: Lessons Learned from Equifax,” Dayton Bar Association Corporate Counsel Committee, October 26, 2017
• Presentation, “Biometrics & The Importance of Privacy Impact Assessments: What We Can Do Better,” Indiana University Center for Applied Cybersecurity Research, October 19, 2017
• Presentation, “Virtual Reality: Altering the Way We Look at Data Governance & Privacy Impact Assessments,” Northern Kentucky University Cybersecurity Symposium, October 13, 2017
• Interviewed in “How to Spot and Prevent Cyberbullying: Twitter Q&A”, PBS NewsHour, July 12, 2017
• Quoted in “Can You Record Fireworks with a Drone?” Consumer Reports, July 1, 2017
• Interviewed in “Privacy Law with Zach Heck – Is CIPP/US Certification Worth it?” Law School Strategy, June 21, 2017