Katherine (Kate) Hanniford

Kate focuses her practice on cybersecurity, privacy, and regulatory compliance, advising clients in highly regulated industries on governance, risk management, and incident response. Her work includes cybersecurity compliance, enterprise-wide risk management, cybersecurity governance, and responding to complex security incidents, as well as advising on emerging federal and state legislative and regulatory developments. She also advises securities industry clients on SEC and FINRA compliance, including SEC (OCIE) examination preparation and enforcement matters, Regulation SCI, and cybersecurity preparedness.

Prior to joining Baker McKenzie, Kate advised on the following matters:

• Led incident responses for several critical infrastructure companies, including in the energy, healthcare, retail, manufacturing sectors, as well as a major county government entity, including extensive coordination with federal and state law enforcement.
• Advised multiple Fortune 500 and 1000 companies during complex, privileged computer crime investigations requiring a crisis response and legal analysis under state, federal, and international laws. Specific engagements included multinational data breaches, cyber-enabled fraud, nation-state actors, business email compromise, and ransomware.
• Advised multiple SEC-registered investment advisers, broker-dealers, and public companies on their cybersecurity policies and procedures, including their incident response plans. Conducted tabletop exercises of clients’ incident response plans.
• Represented multiple healthcare clients involved in ransomware attacks, requiring complex forensic investigation and extensive data review and restoration processes, as well as in follow-on regulatory inquiries.
• Provided ongoing analysis and advice to a global logistics and supply chain management company on privacy and security incident response.
• Assisted healthcare plans and insurance companies in their incident response efforts and follow-on federal and state regulatory investigations.
• Advised an insurance broker and risk management firm with multiple affiliates and covered entities in the development and implementation of its cybersecurity program in compliance with the New York Department of Financial Services cybersecurity requirements.
• Advised a major retailer in developing a comprehensive information security program for all levels of the enterprise.
• Advised a systemically important financial market utility on a range of corporate governance, regulatory compliance, and examination matters.
• Advised a broker-dealer and electronic trading platform’s crisis management and response team as lead outside counsel.
• Advised a Fortune 500 public company in the design and implementation of updated data governance policies and procedures, with particular focus on data retention and secure disposal. 
• Advised multiple banking and financial institutions regarding privacy policy compliance under the Gramm-Leach-Bliley Act, other federal standards, and state law.
• Served as primary outside privacy counsel to a Fortune 500, publicly listed insurance company, including for federal and state law privacy compliance, the application of AI and machine learning capabilities, and related consumer protection issues.

• Recognized, “Ones to Watch” for Technology Law and Privacy and Data Security Law, The Best Lawyers in America®
• Recognized, “Incident Response Elite,” Cybersecurity Docket

• Certified Information Privacy Professional (CIPP-US)
• Artificial Intelligence Governance Professional (AIGP)
• Board Member, Everybody Wins DC (2024-present)