Secured or Exposed – IP & Data Privacy

Parent Page Home
Parent Page News
Parent Page Spotlight on Tech Transformation & Cyber Risk 2025
Secured or Exposed – IP & Data Privacy

With new technology trends and cyber threats emerging, along with more related legislation coming into force, safeguarding data and securing IP assets is no longer optional - it is a critical priority for businesses.

Lurking IP risks

For systems and services created with the assistance of publicly accessible large language models there is an inherent intellectual property (IP) risk, as these models are not capable of distinguishing between sensitive and non-sensitive information. If critical data is not ring-fenced there is a risk that confidential IP can be exposed, used or reproduced inappropriately, creating potential legal and competitive vulnerabilities for firms.

Despite the growing threat of IP theft, concern among global executives remains unchanged. Just under a quarter (23%) continue to cite IP risk as the greatest threat to their business – the same proportion as in 2024.
At the same time perception of preparedness for IP theft risk is increasing, up significantly from 2024. Suggesting a potential underestimation of the IP risk posed by emerging technologies and digital ecosystems. However, confidence in levels of resilience could be being driven by the rising number of businesses planning to increase investment in their cyber security measures this year.

Regulatory labyrinth

As governments around the world look to encourage innovation and investment in AI within their respective countries, a raft of new national regulations are being introduced to counter cyber resilience and IP risks. These new regulations will create additional risk for global businesses who must ensure that any tools they implement meet the required cyber resilience standards or IP requirements of each individual country they operate in. Failure to do so could have severe legal and reputational implications.

“Navigating complex global digital legal requirements is a huge challenge, particularly for regulated industries. It requires a skilled global team that can turn complex requirements into action – whether on collecting data, managing incidents or engaging with vendors.”

Lawrence Brown
Partner and Head of Cross-Border Data Protection Group, Simmons & Simmons LLP

UK

The Cyber Security and Resilience Bill[16] places more stringent requirements on firms providing IT systems to public services, including hospitals, and supply chains. The bill is part of the UK government’s drive to safeguard the economy and critical infrastructure from cyber threats.
EU

The Digital Operational Resilience Act (DORA)[17] took effect on January 17, 2025. DORA presents a comprehensive framework for digital operational resilience for financial entities, impacting global companies operating or transacting within the EU.
USA

Data privacy regulations differ between states. In 2020, California introduced the California Consumer Privacy Act (CCPA)[18]. Starting next year, California state residents will be able to make a single request to require that all data brokers delete their private information. 19 other US states have introduced comprehensive data privacy laws.
Canada

The Personal Information Protection and Electronic Documents Act (PIPEDA), introduced in 2000[19], sets the ground rules for how private-sector organisations collect, use, and disclose personal information in the course of for-profit, commercial activities across the country.
APAC

Organisations operating in the region must ensure they are compliant with an evolving regulatory landscape. Australia has introduced the 2025 Cyber Security Act[20], accompanied by the Privacy and Other Legislation Amendment Bill of 2024[21], giving Australians the right to sue another party deemed to have misused information relating to them.

Global tension rising

As geopolitical tensions linked to tariffs and retaliatory actions particularly between the US and China, global organisations are at heightened risk of IP theft and data breaches from hostile nation state and other threat actors.

In addition, there will likely be increased scrutiny on firms linked to nation states, amid concerns that they may be accessing customer data that could be used to cause social unrest or to inform future cyber attacks.

This is highlighted by President Trump’s ongoing crackdown and proposed ban on Chinese-backed video platform TikTok, which the US Government claims poses a threat to national security.[22]

“Businesses with supply chains that reach into China and Taiwan, should consider what a military escalation between these territories would mean for their supply chains and data privacy requirements, and seek to implement appropriate processes to minimise their risk.”

Alex Creswell OBE
Strategic Adviser
Key steps that firms can take to build resilience to digital regulatory risks include:

Take stock: digital laws are moving quickly, so it is important to take stock of which laws apply to your organisation today. This will require asking some fundamental questions before carrying out a meaningful assessment of which laws apply, such as:

What business activities do we carry out?

Where are our clients based?

How do we use data, including personal data?

How do we use AI?

Horizon scan: to identify which laws are coming up and plan for the practical impact they may have on your business.

Get contracts right: many digital laws require organisations to include clauses in their contracts (both vendors and customers). It is important to get this right to avoid regulatory and commercial risk.

Prepare for the worst: prepare for a cyber incident that impacts your data, so you know what data you hold and where, who has access to it, and identify how it needs to be protected.

Lurking IP risks

Concern around IP risk remains

Regulatory labyrinth

As governments around the world look to encourage innovation and investment in AI within their respective countries, a raft of new national regulations are being introduced to counter cyber resilience and IP risks. These new regulations will create additional risk for global businesses who must ensure that any tools they implement meet the required cyber resilience standards or IP requirements of each individual country they operate in. Failure to do so could have severe legal and reputational implications.

“Navigating complex global digital legal requirements is a huge challenge, particularly for regulated industries. It requires a skilled global team that can turn complex requirements into action – whether on collecting data, managing incidents or engaging with vendors.”

Lawrence Brown
Partner and Head of Cross-Border Data Protection Group, Simmons & Simmons LLP

UK

The Cyber Security and Resilience Bill[16] places more stringent requirements on firms providing IT systems to public services, including hospitals, and supply chains. The bill is part of the UK government’s drive to safeguard the economy and critical infrastructure from cyber threats.
EU

The Digital Operational Resilience Act (DORA)[17] took effect on January 17, 2025. DORA presents a comprehensive framework for digital operational resilience for financial entities, impacting global companies operating or transacting within the EU.
USA

Data privacy regulations differ between states. In 2020, California introduced the California Consumer Privacy Act (CCPA)[18]. Starting next year, California state residents will be able to make a single request to require that all data brokers delete their private information. 19 other US states have introduced comprehensive data privacy laws.
Canada

The Personal Information Protection and Electronic Documents Act (PIPEDA), introduced in 2000[19], sets the ground rules for how private-sector organisations collect, use, and disclose personal information in the course of for-profit, commercial activities across the country.
APAC

Organisations operating in the region must ensure they are compliant with an evolving regulatory landscape. Australia has introduced the 2025 Cyber Security Act[20], accompanied by the Privacy and Other Legislation Amendment Bill of 2024[21], giving Australians the right to sue another party deemed to have misused information relating to them.

Global tensions rising

Global tension rising

As geopolitical tensions linked to tariffs and retaliatory actions particularly between the US and China, global organisations are at heightened risk of IP theft and data breaches from hostile nation state and other threat actors.

In addition, there will likely be increased scrutiny on firms linked to nation states, amid concerns that they may be accessing customer data that could be used to cause social unrest or to inform future cyber attacks.

This is highlighted by President Trump’s ongoing crackdown and proposed ban on Chinese-backed video platform TikTok, which the US Government claims poses a threat to national security.[22]

“Businesses with supply chains that reach into China and Taiwan, should consider what a military escalation between these territories would mean for their supply chains and data privacy requirements, and seek to implement appropriate processes to minimise their risk.”

Alex Creswell OBE
Strategic Adviser
Key steps that firms can take to build resilience to digital regulatory risks include:

Take stock: digital laws are moving quickly, so it is important to take stock of which laws apply to your organisation today. This will require asking some fundamental questions before carrying out a meaningful assessment of which laws apply, such as:

What business activities do we carry out?

Where are our clients based?

How do we use data, including personal data?

How do we use AI?

Horizon scan: to identify which laws are coming up and plan for the practical impact they may have on your business.

Get contracts right: many digital laws require organisations to include clauses in their contracts (both vendors and customers). It is important to get this right to avoid regulatory and commercial risk.

Prepare for the worst: prepare for a cyber incident that impacts your data, so you know what data you hold and where, who has access to it, and identify how it needs to be protected.

Spotlight snapshots

AI is creating new and higher levels of data privacy and IP risk, and IP risk management and data security should be high on risk agendas this year.
The evolving and complex global digital legal landscape presents risk to international businesses, and failure to comply with international regulations creates significant legal, reputational, and executive liability issues.
Nation state cyber attacks are increasingly being used to create disruption, boost financial resources, and destabilise economies, making the cyber battlefield more complex and unpredictable, and defence in depth risk management more critical than ever.