Governance

What a board should ask about privacy and data risk.

Ten years ago, data security was a line item in the IT budget. Today it is a standing topic for many boards, from venture-backed startups to family companies preparing for a sale. Directors are expected to understand the risk well enough to ask good questions, even if they never touch a firewall.

This article sets out why the topic has moved up, the questions directors commonly put to management, and a practical point that is easy to miss: the board's own papers are among the most sensitive documents a company holds.

Why privacy reached the boardroom

Several pressures arrived at once. Customers and enterprise buyers send security questionnaires before they sign. Investors ask about incidents during diligence. Every US state now has a data breach notification law, and a growing number of states have broader consumer privacy laws, so a single incident can bring duties in many places at once.

For public companies, the Securities and Exchange Commission adopted rules in 2023 that require disclosure of material cybersecurity incidents and annual disclosure about how the company manages cyber risk and how the board oversees it. Private companies are not covered by those rules, but the expectation they express, that directors know how risk is governed, has spread well beyond listed companies.

Directors of Delaware corporations will also hear their counsel discuss the duty of oversight that Delaware courts have developed over the years. What that duty requires in any particular company is a question for the board's own attorney, and this article does not try to answer it.

Questions directors commonly ask management

Good board questions are short and specific, and they invite evidence rather than reassurance. A useful set:

What do we hold, and where?

Ask for a plain inventory of the sensitive information the company holds: customer records, employee files, payment details, health or financial information, and confidential deal documents. Ask which systems and which outside vendors hold each category.

Who can reach it?

Access tends to grow and rarely shrinks. Ask when access was last reviewed, how departing employees are removed, and how outside parties such as advisors, buyers and auditors are given and then denied access.

How would we know?

A company that cannot see who opened a file cannot tell whether a leak happened. Ask what records exist of access to sensitive documents and how long they are kept.

What happens on day one of an incident?

Ask whether there is a written response plan, who leads it, which outside counsel and forensic firm would be called, and what the cyber insurance policy requires the company to do and when.

What are our vendors doing?

Much risk now sits with service providers. Ask which vendors hold the most sensitive data and how the company reviews them.

The board's own papers

Board packs collect, in one place, the information a company most wants to protect: forecasts, acquisition targets, financing terms, litigation updates, executive compensation and incident reports. They are often emailed as attachments to directors' personal addresses, downloaded to personal devices and kept indefinitely.

A few habits reduce that exposure without making directors' lives harder:

Share board materials through a controlled room rather than as attachments, so a pack can be withdrawn and nobody needs to keep copies in an inbox.
Use view-only access for the most sensitive items. In ShareAndGo, view-only documents are rendered on our side and watermarked, so the original file is never sent to the viewer's browser.
Watermark each page with the viewer's name, email address and date. It makes a forwarded screenshot traceable and discourages casual sharing.
Give observers and committee members only the folders they need, using groups.
Set an end date on access for outgoing directors and advisors, and revoke it promptly when someone leaves.

An audit log of who opened which paper, and when, also helps the company secretary answer a simple question that often comes up later: did every director receive and open the materials before the meeting?

Turning questions into a cadence

The most useful change is often procedural. Put privacy and security on the calendar at a fixed interval, ask management for the same short report each time, and track whether the open items close. A report that shows the same gaps three meetings running tells the board something important.

A short standing report might cover four things: any incidents since the last meeting and how they were handled, changes to who holds the company's most sensitive data, progress on the open items from the previous report, and anything new from customers, insurers or investors that changes the picture. One page is usually enough, and the consistency matters more than the format.

Directors are not expected to be engineers. They are expected to ask, listen and follow up. For what the law expects of your board specifically, speak with the company's attorney.

Common questions

Do private companies have to follow the SEC cybersecurity disclosure rules?

Those rules apply to companies that report to the SEC. Private companies may still face state breach laws, contracts and investor expectations. Ask your attorney which apply to you.

Is email acceptable for board papers?

Many boards still use it. The weakness is that attachments cannot be withdrawn and copies spread to personal devices. A controlled room lets you revoke access and see who opened what.

Who should own privacy at management level?

That depends on the company's size. What matters to the board is that one named person is accountable and reports regularly.