Skip to main content

Cynthia J. Larose

Member / Co-Chair, Privacy & Cybersecurity Practice

[email protected]

+1.617.348.1732

Follow:
Share:

Cynthia is a highly regarded authority in the privacy and security field and a Certified Information Privacy Professional (CIPP). She handles the full range of data security issues for companies of all sizes, from startups to major corporations. Cynthia is masterful at conducting privacy audits; crafting procedures to protect data; advising clients on state, federal, and international laws and regulations on information use and data security; helping organizations respond to breaches; and planning data transfers associated with corporate transactions. She is an in-demand media commentator and speaker on privacy and cybersecurity issues.

Cynthia is Co-chair of the firm's Privacy & Cybersecurity Practice, a Certified Information Privacy Professional-US (CIPP-US), and a Certified Information Privacy Professional-Europe (CIPP-E).

She represents companies in information, communications, and technology, including e-commerce and other electronic transactions. She counsels clients through all stages of the corporate life cycle, from startups through mid- and later-stage financings to IPO, and has broad experience in technology and business law, including online contracting issues, licensing, domain name issues, software development, and complex outsourcing transactions. She is also a key contributor to MintzEdge, an online resource for entrepreneurs that includes useful tools and information for starting and growing a company.

Cynthia has extensive experience in privacy, data security, and information management matters, including state, federal, and international laws and regulations on the use and transfer of information, behavioral advertising, data security breach compliance and incident response, and data breach incident response planning, as well as data transfers in the context of mergers and acquisitions and technology transactions. She conducts privacy audits and risk assessments to determine data and transaction flow and to assess privacy practices, and assists with drafting and implementation of privacy policies and information security policies and procedures and monitoring of privacy best practices across all levels of the enterprise.

Cynthia is a frequent speaker on privacy issues at conferences and media appearances and presents privacy awareness and compliance training seminars to client companies.

During law school, she was editor-in-chief of the Probate Law Journal.

Cynthia is a highly regarded authority in the privacy and security field and a Certified Information Privacy Professional (CIPP). She handles the full range of data security issues for companies of all sizes, from startups to major corporations. Cynthia is masterful at conducting privacy audits; crafting procedures to protect data; advising clients on state, federal, and international laws and regulations on information use and data security; helping organizations respond to breaches; and planning data transfers associated with corporate transactions. She is an in-demand media commentator and speaker on privacy and cybersecurity issues.

Experience

viewpoints

American Privacy Rights Act – Another Shot at a Comprehensive Federal Privacy Law

April 17, 2024 | Blog | By Cynthia Larose, Christopher Buontempo

Will the U.S. finally join most developed nations and pass a comprehensive federal privacy law?  Some believe this may be the year that the U.S. does just that.

Read more

New Jersey Adopts a Comprehensive Data Privacy Law

April 15, 2024 | Blog | By Cynthia Larose, Jon Taylor

This post provides the details and information you and your business need to know about the New Jersey Privacy Act (NJPA), signed into law by Governor Phil Murphy. 

Read more

After years of internal discussion, the Board of the California Privacy Protection Agency (CPPA), at their March 8th meeting, voted to progress toward formalizing the proposed regulations on risk assessments and automated decisionmaking technology (ADMT). 

Read more

If you have been relying on last year’s court order staying the ability of the California Privacy Protection Agency (CPPA) to enforce regulations promulgated under the California Privacy Rights Act (CPRA) to also stay your own CPRA compliance program --- time to ramp back up.

Read more

Preparation for 2023 Fiscal Year-End SEC Filings and 2024 Annual Shareholder Meetings

December 15, 2023 | Advisory | By John Condon, Anne Bruno, Melanie Ruthrauff Levy, Jacob Hupart, Cynthia Larose, Breton Leone-Quick, Page R. Hubben, Ellen Shapiro

Public companies need to consider regulatory, legal, market, and ESG-related developments in preparing for their fiscal year-end filings with the SEC and their annual shareholder meetings. In an in-depth memorandum, Mintz attorneys discuss the SEC’s new cybersecurity disclosure rule, recent trends in reverse stock splits, and the SEC’s disclosure requirements for Rule 10b5-1 trading plans and insider trading policies, and other emerging issues affecting public companies.

Read more

California Continues to Expand Privacy Protections

October 13, 2023 | Blog | By Michael Katz, Cynthia Larose, M. Bertie Magit

The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (the “CCPA”), has been further expanded under Governor Gavin Newsom. The signing of Assembly Bills 947 and 1194 expands the protection of sensitive personal information. Read more to find out the impacts of these bills and the Delete Act.

Read more

Release of new Mintz Matrix! States keep tinkering

September 7, 2023 | Article | By Cynthia Larose, Michael Katz

Read more about how several states have clarified or tightened their data breach notification statutes since we last updated the Mintz Matrix at the beginning of the year.

Read more

SEC Adopts Final Cybersecurity Rules for Public Companies

August 1, 2023 | Blog | By Cynthia Larose, John Condon, Michael Katz, Stefan Jović

The SEC adopted its final rules and amendments concerning cybersecurity risk management, strategy, governance, and incident disclosure (the “Final Rule”) on July 26, 2023.  In this article we highlight some of the principal changes to the cybersecurity rules first proposed by the SEC more than 16 months prior.

Read more

SEC Adopts Final Cybersecurity Rules for Public Companies

August 1, 2023 | Blog | By Cynthia Larose, John Condon, Michael Katz, Stefan Jović

The SEC adopted its final rules and amendments concerning cybersecurity risk management, strategy, governance, and incident disclosure (the “Final Rule”) on July 26, 2023.  In this article we highlight some of the principal changes to the cybersecurity rules first proposed by the SEC more than 16 months prior.

Read more
Read less

News & Press

Read less

Events & Speaking

May
1
2025

Mintz's Annual Employment Law Summit 2025 - New York

Convene, 601 Lexington Ave, New York, NY 10022

Speaker
Mar
16
2022

Hot Topics in White Collar Crime and Government Investigations: Considerations for Corporate Counsel

Association of Corporate Counsel, San Diego and Mintz

Virtual Event

Webinar Reference Image
Speaker
Feb
9
2022
Seminar Reference Image
Moderator
Speaker
Apr
27
2020
Speaker
Apr
15
2020
Webinar Reference Image
Speaker
Speaker
Mar
4
2020
Speaker
Panelist
Sep
25
2019
Moderator
Jun
19
2019

Health Care & Cybersecurity: A Powerful Combination

ML Strategies, 701 Pennsylvania Ave, NW, Suite 900, Washington, DC 20004

Speaker
Panelist
Apr
29
2019

AHAM Annual Member Meeting 2019

Know the Score

The Ritz-Carlton Washington DC

Moderator
Mar
6
2019

The Third Annual Boston Conference on Cyber Security (BCCS 2019)

Boston College, Gasson Hall, Room 100, 140 Commonwealth Avenue Chestnut Hill, MA

Speaker
Feb
4
2019

Cybersecurity Best Practices for Legal Services Providers 2019

Practising Law Institute

PLI New York Center, 1177 Avenue of the Americas, (2nd floor), entrance on 45th Street, New York, New York

Speaker
Nov
13
2018

CTAM End of Year Meeting

HBO Theater, New York, NY

Oct
3
2018

Ascendant Compliance Conference

State of the Data Breach

San Diego, California

Speaker
May
7
2018

2018 Onsolve User Conference

Arizona Biltmore Hotel 2400 E Missouri Avenue Phoenix, AZ

Speaker
Apr
18
2018

Legal Issues in Museum Administration 2018

American Law Institute Continuing Legal Education (ALI CLE)

Revere Hotel Boston Common 200 Stuart Street Boston, MA

Speaker
Mar
19
2018

2018 Cyber Liability Conference

Mohegan Sun Resort & Convention Center 1 Mohegan Sun Blvd Uncasville, CT

Speaker
Mar
15
2018

Higher Education Legal Conference

Boston Bar Association

Sheraton Boston Hotel 39 Dalton Street Boston, MA

Moderator
Mar
7
2018

The Second Annual Boston Conference on Cyber Security (BCCS 2018)

Boston College

Gasson Hall, Room 100 140 Commonwealth Avenue Chestnut Hill, MA

Speaker
Jan
19
2018
Speaker
Jan
17
2018
Speaker
Nov
30
2017
Speaker
Nov
29
2017
Speaker
Nov
28
2017
Speaker
Speaker
Nov
2
2017

Cyber Security & Liability

New Hampshire Bar Association

Concord, NH

Speaker
Oct
25
2017

Staffing World 2017

American Staffing Association

Chicago, IL

Speaker
Oct
10
2017

Ascendant Compliance Conference

Ascendant Compliance Management

Napa, California

Panelist
May
24
2017

Privacy & Cybersecurity Conference

Boston Bar Association

Boston, MA

Speaker
May
11
2017

2017 ASA Staffing Law Conference

American Staffing Association

Washington, DC

Moderator
Mar
8
2017
Speaker
Jun
3
2016

Director Bootcamp

NACD New England

Boston, MA

Speaker
May
11
2016

2016 NEDRIX Spring Conference

NorthEast Disaster Recovery Information X-Change

Boston, MA

Speaker
Dec
1
2015

Increased Scrutiny by Regulators of Cybersecurity

The New England Broker/Dealer and Investment Adviser Association

Boston, MA

Speaker
May
13
2015
Moderator
Mar
10
2015

Not If, But When: Cyber Security for Companies in an Age of Inevitable Hacks, Attacks & Breaches

National Association of Corporate Directors, New England Chapter

Newton Marriott Hotel, Newton, MA

Read less

Cynthia is a highly regarded authority in the privacy and security field and a Certified Information Privacy Professional (CIPP). She handles the full range of data security issues for companies of all sizes, from startups to major corporations. Cynthia is masterful at conducting privacy audits; crafting procedures to protect data; advising clients on state, federal, and international laws and regulations on information use and data security; helping organizations respond to breaches; and planning data transfers associated with corporate transactions. She is an in-demand media commentator and speaker on privacy and cybersecurity issues.

Recognition & Awards

  • BTI Consulting Group Client Service All-Star (2022)

  • Best Lawyers in America: Privacy and Data Security Law (2018 – 2027)

  • Massachusetts Lawyers Weekly: Go-To Cybersecurity / Data Privacy Lawyer (2022, 2024)

  • Top Author for Cybersecurity, JD Supra’s Readers' Choice Awards (2018 – 2021)

  • Chambers USA: Noted Practitioner, Nationwide – Privacy & Data Security (2018 – 2019)

  • National Law Review: Go-To Thought Leadership Award, Cybersecurity (2018)

  • Chambers USA: Nationwide – Privacy & Data Security (2010 – 2016)

  • Chambers Global: Privacy & Data Security (2011 – 2012, 2016 – 2017)

  • Legal 500 Recommended Lawyer – Cyber Law (2026)

  • National Diversity Council: Top 50 Most Powerful Women in Technology (2016)

  • Woman of Technology 2001 by Women in Technology, Inc.

  • Two Thousand Notable American Women (2001)

  • Women's Business Boston: Top 10 Women Lawyers in Boston (2005); Top 10 Corporate Lawyers in Boston (2009 – 2010)

  • Boston Magazine: Rising Star (2011)

  • Leila Josephine Robinson Award, Boston University Woman's Law Association (2010)

  • Boston Digital Industry News: Best General Lawyer for a High-Tech Firm

  • Massachusetts Super Lawyers: Rising Star – Information Technology / Outsourcing (2005)

Read less

Cynthia is a highly regarded authority in the privacy and security field and a Certified Information Privacy Professional (CIPP). She handles the full range of data security issues for companies of all sizes, from startups to major corporations. Cynthia is masterful at conducting privacy audits; crafting procedures to protect data; advising clients on state, federal, and international laws and regulations on information use and data security; helping organizations respond to breaches; and planning data transfers associated with corporate transactions. She is an in-demand media commentator and speaker on privacy and cybersecurity issues.

Involvement

  • Member, International Association of Privacy Professionals
  • Member, Computer Law Association
  • Member, Federal Communications Bar Association
Read less

Cynthia J. Larose

Member / Co-Chair, Privacy & Cybersecurity Practice

Boston