I was curious how important it is for a software startup to seek legal council during the fundraising/growth stages. Basically, I don't want to be up a creek if we have some data breach or hack. How helpful could a lawyer be in mitigating such an event? I.e., does it make more sense to seek the best CS guys to protect our data and prevent a breach in the first place, or can we defer the investment in prevention and rely instead on lawyers to recover damages in the event of a breach?

  • 1
    Not looking to start a controversy on this, but the OP's question on whether or not to seek a lawyer for when a hypothetical "event of a breach" occurs isn't really a question for specific legal advice. Moreover, the OP had already accepted the answer given here. Aug 23, 2018 at 11:55
  • @IñakiViggers I agree that this wasn't off-topic as a request for legal advice. But to the extent it's about the law it's primarily opinion based. To the extent it's about business risk management, your answer is great. But that's not the subject of Law.SE. (In fact, it's hard to imagine this question not being closed as primarily opinion based on any Stack Exchange. The question could be rephrased as, "Which is more valuable: prevention or treatment?" That sounds like a resolution for a debate competition.)
    – feetwet
    Jan 25, 2019 at 1:58
  • @feetwet Thank you! The last paragraph is incontrovertible, though. That not all perpetrators are in plaintiff's jurisdiction or extraditable thereto is more a foreseeable fact than an opinion. Relief for reversal of a data breach will be futile: Courts cannot ensure deletion from all storage media (worldwide) to which the data was downloaded. The OP should not risk that his lawyer will not even inform him that "courts should not be in the business of issuing futile relief", Burton v. City of Belle Glad, 966 F.Supp. 1178, 1188. Jan 25, 2019 at 23:39
  • 1
    @IñakiViggers – those are all compelling observations about law and the legal system. Somewhere on Meta I noted that a good answer can often bring an apparently "off-topic" question "on-topic." Your answer and comment are an excellent example of this, although in this case the question also needs some editing to keep it from getting voted closed again, which I'm about to do.
    – feetwet
    Jan 25, 2019 at 23:47

1 Answer 1


How helpful could a lawyer be here?

Not much, as I will explain here.

Is it more important to seek the best CS guys to protect our data or seek a lawyer who can seek damages in the event of a breach.

Focus on having competent staff and robust systems rather than expecting the judicial system will be effective (or even willing) to grant and enforce remedies.

Your inquiry suggests that you are at the fundraising stage. Investors, especially those aware of the reality and cost of legal proceedings, are likelier to feel more confident if they know the implementation of your business is relatively safe than if the "reliability" conveyed to them is the picture of some lawyer going to court. Investors know that legal proceedings take much longer and involve much more uncertainty than the execution of a thoughtful plan of IT maintenance & monitoring.

Even if both the court and lawyer were fair and expeditious, nothing guarantees that losses will be recoverable. Perpetrators of malicious attack(s) might be located far beyond the jurisdiction of your court/country --if not outright unidentified--, whence a court's finding that your systems were hacked will be pretty much inconsequential in remedying (let alone reversing) a data breach.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .