Lisa J. Sotto

  • New York

Lisa’s practice focuses on privacy and cybersecurity.

Named among The National Law Journal’s “100 Most Influential Lawyers,” Lisa is the managing partner of the firm’s New York office and chairs the firm’s top-ranked global privacy and cybersecurity practice. She assists clients in identifying, evaluating and managing risks associated with privacy and information security practices. Lisa advises clients on GLB, HIPAA, COPPA, CAN-SPAM, FCRA, VPPA, security breach notification laws, and other U.S. state and federal privacy and data security requirements (including HR rules), and global data protection laws (including those in the EU and Latin America). She provides extensive advice on cybersecurity risks, incidents and policy issues, including proactive cyber incident readiness. Through our firm’s privacy and security in M&A transactions team, Lisa also guides clients on risks and potential liabilities associated with inadequate privacy and data security practices in high-stakes corporate transactions. She conducts all phases of online and offline privacy assessments and information security policy audits. She also develops corporate records management programs, including policies, records retention schedules and training modules.

Lisa has been rated the “No. 1 privacy expert” in all surveys by Computerworld magazine. She is recognized by Chambers and Partners as a “Star” performer (the highest honor) for privacy and data security; she is one of only two privacy lawyers in the United States to receive this distinguished ranking. Lisa also is recognized as a leading lawyer by The Legal 500 United States for cyber crime, data protection and privacy. In addition, Hunton & Williams’ Privacy and Cybersecurity practice received a top national ranking from Chambers and Partners and The Legal 500 in privacy and data security. Lisa speaks frequently at conferences, testifies regularly before the U.S. Congress and other legislative and regulatory agencies, is the author of numerous treatises and articles, has been tapped to lead several industry committees and organizations, is sought after by media outlets and industry publications for her professional insights, and appears regularly on national television and radio news programs. She is the editor and lead author of the Privacy and Data Security Law Deskbook, published by Aspen Publishers, Wolters Kluwer Law & Business.

Relevant Experience

  • Appointed by Secretaries Johnson and Napolitano as Chair of the U.S. Department of Homeland Security’s Data Privacy and Integrity Advisory Committee (2012-present); previously served as Vice Chair (2005-2009).
  • Selected to represent the U.S. Chamber of Commerce in Indonesia to present “Business Without Borders: The Importance of Cross-Border Data Transfers to Global Prosperity,” a report prepared by Hunton & Williams and the Chamber.
  • Selected to advise the Serbian government on global data protection law and to draft the country's data security and breach notification laws. Sotto was sponsored by the USAID-funded Judicial Reform and Government Accountability Project.
  • Testified before U.S. House of Representatives, “Data Protection and the Consumer: Who Loses When Your Data Takes a Hike?”
  • Testified before U.S. Department of Health & Human Services’ Subcommittee on Privacy and Confidentiality of the National Committee on Vital and Health Statistics regarding RFID use in health care.
  • Testified before CSIS Commission on Cyber Security for the 44th Presidency.
  • Briefed Congressional staffers in preparation for data breach hearings held by the House of Representatives Committee on Homeland Security, Subcommittee on Emerging Threats, Cybersecurity and Science and Technology, and in connection with drafting of a comprehensive privacy bill.
  • Selected to advise DHS’s Homeland Security Science and Technology Committee (HSSTAC) regarding Third Party Pre-Screening Program.
  • Selected by U.S. Government Accountability Office to provide advice for a GAO study on data security breaches.
  • Selected by U.S. Office of Management and Budget to participate in OMB analysis of DHS Privacy Office.
  • Routinely assists clients in developing policy positions regarding privacy and cybersecurity legislative and regulatory proposals both in the U.S. and abroad.
  • Advises clients on FTC, OCR, SEC and state Attorney General (including Multistate Taskforce) investigations and enforcement actions for alleged data security and privacy violations.
  • Advises clients on managing FTC Consent Orders and CIDs in connection with data security incidents.
  • Advises major health care providers and health plans on all aspects of HITECH security breaches, including OCR and state enforcement.
  • Advises numerous major retailers, financial institutions and other companies on proactive cybersecurity readiness, including developing and conducting full-scale tabletop exercises for C-suite executives and Boards of Directors.
  • Since 2005, advised on over 1,000 cybersecurity and data breach incidents in the U.S. and abroad (extending to 78 countries), including many of the seminal events of 2014.
  • Advised on extensive FTC investigation into mobile security issues.
  • Advised major global bank on massive cyber intrusion.
  • Advised well-known telecom manufacturer on extensive APT attack involving significant loss of intellectual property.
  • Advised several major retailers on security breaches resulting from criminal tampering of POS terminals, including U.S. Secret Service/FBI involvement, forensic investigations, breach notification and PR efforts.
  • Advised Texas State Comptroller in connection with well-known data security incident involving 3.5 million state workers.
  • Advised many multinational clients on Safe Harbor certification and annual recertification.  
  • Counseled numerous high-tech companies (both as publishers and advertisers) on data collection and sharing issues (including online behavioral advertising and Big Data initiatives), collection and use of geolocation data, and Safe Harbor certification.
  • Advised global consumer goods company on addressable TV issues.
  • Counseled major consumer goods companies on privacy issues associated with the use of radio frequency identification (RFID) and data collection from mobile devices.
  • Advised multiple clients on employee monitoring and surveillance issues under federal and state laws, and prepared related policies (including BYOD).
  • Conducted comprehensive privacy and information security policy assessments of major U.S. electric utility and retail and consumer goods companies, including extensive data flow mapping, remediation, and development and implementation of multiple privacy, information security and records management policies and procedures. 
  • Advised client on compliance with the Privacy Act, including preparation of a System of Records Notice and Privacy Impact Assessment, in connection with significant new government mortgage program.
  • Served as HIPAA privacy counsel to large health care system, including over 40 hospitals and long-term care and assisted living facilities, and major academic medical center.
  • Developed and implemented comprehensive global records management program in over 100 countries for one of world's largest software companies (under court supervision), including preparation and implementation of policies and procedures, numerous records retention schedules, in-person and web-based training and audit program.  


  • Co-Author, Cybersecurity and Data Breach, Bloomberg BNA Privacy & Data Security Portfolio Series, 2015
  • Editor and Lead Author, Privacy and Data Security Law Deskbook (1,400-page treatise and annual updates), Aspen Publishers, Wolters Kluwer Law & Business, 2010-2014
  • Co-author, Data Protection & Privacy, United States, Getting the Deal Through, 2014-2016
  • Co-author, Chapter 11 European Union Data Protection, Data Security and Privacy Law: Combating Cyberthreats, West, Thomson Reuters, 2010
  • Co-author, Data Security Handbook, ABA Section of Antitrust Law, 2008
  • Co-author, Privacy Primer: An Overview of Global Data Protection Laws, 2006

Media Appearances

  • Bisnow Morning Brief NY, “16 Things You Need to Know This Morning” (Sotto interviewed), February 6, 2017
  • Interview, Cybersecurity Risks and Legal Landscape, KUCI 88.9 FM (National Public Radio), “Privacy Piracy: Protect Your Privacy in the Information Age” (Sotto featured in 30-minute interview), July 25, 2016
  • Mimesis Law’s Cy-Pher Executive Roundtable, What Do You Do With A Hacked Law Firm? (Sotto interviewed), June 10, 2016
  • Mimesis Law’s Cy-Pher Executive Roundtable, Are Law Firms Soft Targets For Hackers? (Sotto interviewed), May 23, 2016
  • HuffPost Live, Regulator Warns of 'Cyber 9/11' Attacks on Banks (Sotto interviewed), March 2, 2015
  • Penn Law Podcast, New Threats to Privacy and Cybersecurity (Sotto interviewed), February 11, 2015
  • AskForbes Twitter Chat, What Companies Should Do When They’re Breached, August 26, 2014
  • Interview, Female Powerbrokers Q&A: Hunton & Williams’ Lisa Sotto, Law360, December 4, 2013
  • Interview, Cybersecurity Risks and Legal Landscape, KUCI 88.9 FM (National Public Radio), Privacy Piracy: Protect Your Privacy in the Information Age (Sotto featured in 30-minute interview), June 3, 2013
  • Interview, Should There Be a “Right to be Forgotten” Online? (Sotto interviewed),, May 10, 2013
  • Legal Trends Roundtable: Parts 1-5, 2013 The Year Ahead in Privacy and Data Security (Sotto interviewed),, January-February 6, 2013
  • Privacy Law Expert: Many Companies Waiting for a Hack (Sotto interviewed), Bloomberg Law, November 1, 2012
  • Radio Television of Serbia, Data Protection Act Good (English translation) (Sotto interviewed), July 18, 2012
  • B92 (Serbian radio and television broadcaster), Careful Sharing Data (English translation) (Sotto interviewed), July 18, 2012
  • Privacy Bill of Rights: A Step Forward, “Can’t be a Back-Burner Issue,” Privacy Lawyer Argues (Sotto interviewed), March 20, 2012
  • Interview (podcast), Privacy Bill of Rights: Not Be-All, End-All, Security Media Group, February 24, 2012
  • Breach Response: The Legal View, Fast Action Can Save Reputation and Ensure Compliance (Sotto interviewed),, December 15, 2011
  • Breach Response: Reputational Risk, Your Organization’s Name Hinges on Data Value and Security (Sotto interviewed),, November 30, 2011
  • Law360, Q&A with Hunton & Williams’ Lisa Sotto (Sotto interviewed), November 4, 2011
  • KUCI 88.9 FM, Protect Your Privacy in the Information Age (Sotto featured in 30-minute interview), September 19, 2011
  •, Is There Need for a Data Privacy Law? (Sotto interviewed), September 6, 2011
  • End to End Trust, Microsoft Corporation, regarding cross industry collaboration and a safer Internet (Sotto interviewed), September 2009
  • CNN’s American Morning, Privacy in the Obama Administration (Sotto interviewed), December 8, 2008
  • ClearChannel Radio, “Tech Talk with Craig Peterson,” regarding the use of RFID in health care (Sotto interviewed), March 4, 2006