Cynthia J. Larose
Member / Co-Chair, Privacy & Cybersecurity Practice
+1.617.348.1732
Cynthia is a highly regarded authority in the privacy and security field and a Certified Information Privacy Professional (CIPP). She handles the full range of data security issues for companies of all sizes, from startups to major corporations. Cynthia is masterful at conducting privacy audits; crafting procedures to protect data; advising clients on state, federal, and international laws and regulations on information use and data security; helping organizations respond to breaches; and planning data transfers associated with corporate transactions. She is an in-demand media commentator and speaker on privacy and cybersecurity issues.
Cynthia is Co-chair of the firm's Privacy & Cybersecurity Practice, a Certified Information Privacy Professional-US (CIPP-US), and a Certified Information Privacy Professional-Europe (CIPP-E).
She represents companies in information, communications, and technology, including e-commerce and other electronic transactions. She counsels clients through all stages of the corporate life cycle, from startups through mid- and later-stage financings to IPO, and has broad experience in technology and business law, including online contracting issues, licensing, domain name issues, software development, and complex outsourcing transactions. She is also a key contributor to MintzEdge, an online resource for entrepreneurs that includes useful tools and information for starting and growing a company.
Cynthia has extensive experience in privacy, data security, and information management matters, including state, federal, and international laws and regulations on the use and transfer of information, behavioral advertising, data security breach compliance and incident response, and data breach incident response planning, as well as data transfers in the context of mergers and acquisitions and technology transactions. She conducts privacy audits and risk assessments to determine data and transaction flow and to assess privacy practices, and assists with drafting and implementation of privacy policies and information security policies and procedures and monitoring of privacy best practices across all levels of the enterprise.
Cynthia is a frequent speaker on privacy issues at conferences and media appearances and presents privacy awareness and compliance training seminars to client companies.
During law school, she was editor-in-chief of the Probate Law Journal.
viewpoints
2026 Verizon Data Breach Investigations Report: What Executive Leaders Need to KnowExploits of Vulnerabilities Overtake Credential Theft as the Leading Breach Vector
July 29, 2026 | Blog | By Cynthia Larose
The 2026 Verizon Data Breach Investigations Report reveals a major shift in cyber risk. Learn what executive leaders need to know about vulnerability management and breach prevention.
UK Data Use and Access Act: New Complaints Process Effective June 19, 2026
June 17, 2026 | Blog | By Cynthia Larose, Christopher Buontempo
UK Data Use and Access Act reforms the ICO complaints process, requiring controller engagement and 45-day responses. Prepare with updated policies and training.
Connecticut Overhauls Its Privacy Law: What Businesses Need to Know
June 5, 2026 | Blog | By Cynthia Larose
Connecticut expands its privacy law with new data broker rules, geolocation bans, pricing disclosures, and genetic data protections effective 2026–2028.
Latest Installment of our Mintz Matrix!
January 23, 2026 | Blog | By Morgan Ungrady-Johnson, Cynthia Larose
Stay up to date with the Mintz Matrix, our comprehensive 50‑state resource tracking U.S. data breach notification laws. Explore the latest updates, including new 2026 amendments in California and Oklahoma, to help organizations and practitioners navigate evolving breach reporting requirements.
CPPA Regulations Are Moving Forward: Here is What You Need To Know
August 11, 2025 | Blog | By M. Bertie Magit, Cynthia Larose
California expands consumer privacy protections with new CCPA regulations on AI, risk assessments, and cybersecurity audits. Learn what businesses must do to comply by 2026.
No More Warnings: Ignoring AG Costs $85,000
July 21, 2025 | Blog | By Cynthia Larose
Connecticut Attorney General announced the state’s first-ever enforcement settlement under the Connecticut Data Privacy Act (CTDPA) with TicketNetwork, Inc.
Mid-Year Report for State Consumer Privacy Laws
July 15, 2025 | Blog | By Cynthia Larose, Michael Katz, Paty Garza Gonzalez, Ellie Taft
We are taking a look back at significant developments that have already occurred this year in the consumer data privacy landscape. Five more states’ comprehensive privacy laws went into effect, and several states enacted noteworthy amendments to their existing statutes.
New York is Protecting its Consumers, One Budget at a Time
June 3, 2025 | Blog | By Cynthia Larose, M. Bertie Magit
Governor Kathy Hochul signed into law new consumer protection measures (the TED Bill) aimed to protect New York consumers by requiring businesses operating in the financial sector and retail marketplace to be more transparent.
California’s Top Privacy Cop Issues First Enforcement Decision
March 17, 2025 | Blog | By Cynthia Larose
The California Privacy Protection Agency (CPPA) has issued its first Order of Decision to American Honda Motor Co. in an enforcement action under the California Consumer Privacy Act (CPPA). Although the investigation arose from the CPPA’s ongoing review of data privacy practices by connected car manufacturers and other related technologies, there are some important takeaways for every business covered by the CCPA.
Latest Installment of our Mintz Matrix!
February 28, 2025 | Blog | By Cynthia Larose, Michael Katz, Cyrus Breese
Visit our Mintz Matrix page with the latest edition of the Mintz Matrix, which is a 50-state resource we have maintained since 2009 to break down and summarize requirements of U.S. state data breach notification laws.
News & Press
Mintz Advises Silversmith Capital Partners on Acquisition of Vantora
October 16, 2026|
New Virginia Law Adds to Evolving U.S. Privacy Landscape
April 14, 2026|
Mintz Advises PHLUR on Acquisition by TSG Consumer
July 29, 2025|
Mintz has earned top rankings in the 2025 edition of Legal 500 United States and Canada guides. The firm is recognized in 20 practice categories, and 78 of its attorneys are individually ranked in the guide, with several receiving recognition in more than one category. Additionally, two attorneys are featured in the "Hall of Fame," seven attorneys are named "Leading Lawyers," and five attorneys are recognized as a "Next Generation Lawyers."
What's Notable In Fla. Data Privacy Law Targeting Big Tech
June 23, 2023|
First California Privacy Penalty Flags Consumer Data Sales Peril
August 26, 2022|
Five Mintz Attorneys Recognized as Client Service All-Stars by BTI
February 8, 2022|
Québec’s Updated Privacy Law Complicates Cross-Border Data Flows
November 12, 2021|
Complying With NYC’s New Biometrics Law
August 17, 2021|
Small Companies Scramble on Microsoft Hack as Legal Threat Looms
March 12, 2021|
NY Cybersecurity Rules Pack Wallop In Enforcement Debut
August 19, 2020|
Microsoft-TikTok Deal Would See Deadline Pressure, Privacy Risks
August 4, 2020|
Consent is Key to Avoiding Child Privacy Class Actions
June 15, 2020|
Assessing Existing Privacy Policies and Practices
May 21, 2020|
Protect Your Newly Remote Team From Cyberthreats
April 2, 2020|
Mintz Recognized by Chambers USA 2019
April 26, 2019|
Cynthia Larose Named a National Law Review "Go-To Thought Leader"
December 27, 2018|
Sweeping Data Privacy Bill Approved In California
June 28, 2018|
Chambers USA 2018 Ranks Mintz Attorneys & Practices
May 3, 2018|
Mintz Honored by JD Supra's 2018 Reader's Choice Awards
March 19, 2018|
New Yorkers Want to Know: What’s your cybersecurity plan?
August 29, 2017|
Effective and Compliant Employee Monitoring (Part Two of Two)
April 19, 2017|
Want to improve risk management? Do the basics
March 9, 2017|
The Most Significant Data Breaches Of 2016
December 22, 2016|
Getting Your Firm Beyond the Breach
March 1, 2016|
Mintz Represents Time Inc. in Acquisition of Cozi Inc.
June 19, 2014|
Events & Speaking
Mintz's Annual Employment Law Summit 2025 - New York
Convene, 601 Lexington Ave, New York, NY 10022
Hot Topics in White Collar Crime and Government Investigations: Considerations for Corporate Counsel
Association of Corporate Counsel, San Diego and Mintz
Virtual Event
Privacy Shield Shattered & the SCCs in Peril: Understanding the Schrems II Decision (and What to Do Next)
View the Webinar Recording
Compliance Solutions Strategies Spring 2020 Conference
The Ritz-Carlton, Sarasota, Florida
The Concept of “Reasonable Security” – What is it and how do you get there?
View the Webinar Recording
Coronavirus (COVID-19): Managing the Privacy & Cybersecurity Risks
View the Webinar Recording
The Office of the General Treasurer and Rhode Island Health and Educational Building Corporation's Joint Municipal Training and Education Conference
Cybersecurity
Greenwich, RI
Health Care & Cybersecurity: A Powerful Combination
ML Strategies, 701 Pennsylvania Ave, NW, Suite 900, Washington, DC 20004
The Third Annual Boston Conference on Cyber Security (BCCS 2019)
Boston College, Gasson Hall, Room 100, 140 Commonwealth Avenue Chestnut Hill, MA
Cybersecurity Best Practices for Legal Services Providers 2019
Practising Law Institute
PLI New York Center, 1177 Avenue of the Americas, (2nd floor), entrance on 45th Street, New York, New York
Legal Issues in Museum Administration 2018
American Law Institute Continuing Legal Education (ALI CLE)
Revere Hotel Boston Common 200 Stuart Street Boston, MA
2018 Cyber Liability Conference
Mohegan Sun Resort & Convention Center 1 Mohegan Sun Blvd Uncasville, CT
Higher Education Legal Conference
Boston Bar Association
Sheraton Boston Hotel 39 Dalton Street Boston, MA
The Second Annual Boston Conference on Cyber Security (BCCS 2018)
Boston College
Gasson Hall, Room 100 140 Commonwealth Avenue Chestnut Hill, MA
Increased Scrutiny by Regulators of Cybersecurity
The New England Broker/Dealer and Investment Adviser Association
Boston, MA
Hot Topics in Global Healthcare Information Privacy, Data Protection and Security
IAPP KnowledgeNet
Boston, MA
Not If, But When: Cyber Security for Companies in an Age of Inevitable Hacks, Attacks & Breaches
National Association of Corporate Directors, New England Chapter
Newton Marriott Hotel, Newton, MA
Cynthia is a highly regarded authority in the privacy and security field and a Certified Information Privacy Professional (CIPP). She handles the full range of data security issues for companies of all sizes, from startups to major corporations. Cynthia is masterful at conducting privacy audits; crafting procedures to protect data; advising clients on state, federal, and international laws and regulations on information use and data security; helping organizations respond to breaches; and planning data transfers associated with corporate transactions. She is an in-demand media commentator and speaker on privacy and cybersecurity issues.
Recognition & Awards
BTI Consulting Group Client Service All-Star (2022)
Best Lawyers in America: Privacy and Data Security Law (2018 – 2027)
Massachusetts Lawyers Weekly: Go-To Cybersecurity / Data Privacy Lawyer (2022, 2024)
Top Author for Cybersecurity, JD Supra’s Readers' Choice Awards (2018 – 2021)
Chambers USA: Noted Practitioner, Nationwide – Privacy & Data Security (2018 – 2019)
National Law Review: Go-To Thought Leadership Award, Cybersecurity (2018)
Chambers USA: Nationwide – Privacy & Data Security (2010 – 2016)
Chambers Global: Privacy & Data Security (2011 – 2012, 2016 – 2017)
Legal 500 Recommended Lawyer – Cyber Law (2026)
National Diversity Council: Top 50 Most Powerful Women in Technology (2016)
Woman of Technology 2001 by Women in Technology, Inc.
Two Thousand Notable American Women (2001)
Women's Business Boston: Top 10 Women Lawyers in Boston (2005); Top 10 Corporate Lawyers in Boston (2009 – 2010)
Boston Magazine: Rising Star (2011)
Leila Josephine Robinson Award, Boston University Woman's Law Association (2010)
Boston Digital Industry News: Best General Lawyer for a High-Tech Firm
Massachusetts Super Lawyers: Rising Star – Information Technology / Outsourcing (2005)
Cynthia is a highly regarded authority in the privacy and security field and a Certified Information Privacy Professional (CIPP). She handles the full range of data security issues for companies of all sizes, from startups to major corporations. Cynthia is masterful at conducting privacy audits; crafting procedures to protect data; advising clients on state, federal, and international laws and regulations on information use and data security; helping organizations respond to breaches; and planning data transfers associated with corporate transactions. She is an in-demand media commentator and speaker on privacy and cybersecurity issues.
Involvement
- Member, International Association of Privacy Professionals
- Member, Computer Law Association
- Member, Federal Communications Bar Association
Recent Insights
Mintz Advises Silversmith Capital Partners on Acquisition of Vantora
October 16, 2026|
