Burke Data & Privacy (BDP) advises organizations on cybersecurity compliance obligations and prepares clients to navigate the full lifecycle of a cyber incident, from governance through breach response. Patrick Burke, a former New York State cybersecurity regulator, brings a regulator's perspective to cybersecurity compliance and incident response, informed by his prior service overseeing examinations and incident response at major financial institutions, under the nation's first-in-the-nation cybersecurity regulation.

Cybersecurity Compliance

Corporate boards and executives face expanding cybersecurity obligations, including personal accountability under state and federal regulation, as well as obligations imposed by clients and insurers. BDP draws on regulatory experience to help organizations prepare for scrutiny, strengthen governance, and demonstrate a defensible culture of compliance.

BDP advises on compliance with the New York State Department of Financial Services' Cybersecurity Regulation (23 NYCRR Part 500), the SEC's Cybersecurity Disclosure Rule, the Gramm-Leach-Bliley Act, HIPAA and its Security Rule, and applicable technical standards, including the NIST Cybersecurity Framework, ISO/IEC 27001, NIST 800-53, and sector-specific requirements such as PCI-DSS. Our services include review of data protection, cybersecurity and privacy addendums to agreements, drafting and updating security policies, conducting tabletop exercises, advising on vendor risk management, and preparing board-level reporting designed to withstand regulatory review.

Incident Response

When a cyberattack or data breach occurs, timely and well-informed action is essential. BDP assists organizations in building and testing incident response plans aligned with the NIST Cybersecurity Framework and ISO/IEC 27035, including tabletop simulations to assess organizational readiness.

During an active incident, BDP serves as outside counsel, protecting privilege and coordinating with forensic investigators, law enforcement, insurers, and regulators, while guiding clients through notification obligations under GDPR, CCPA, HIPAA, and state breach notification statutes. Following an incident, BDP conducts post-incident reviews and advises on remediation strategies to strengthen organizational resilience going forward.

Burke's Cybersecurity Credentials

In 2018, Burke was appointed Deputy Superintendent at the New York State Department of Financial Services, where he launched its first IT examination team focused on the agency's landmark cybersecurity regulation, 23 NYCRR 500. He led breach investigations and oversaw cybersecurity examinations of cryptocurrency exchanges and virtual currency businesses, and continues to advise DFS-licensed and chartered entities on regulatory compliance.

He has counseled major financial services, advertising, insurance, airline, manufacturing, and pharmaceutical clients.  He served as Chief Data & Privacy Officer for Havas North America, a leading advertising agency, where he built and implemented the organization's incident response and business continuity programs.

Burke has advised on cybersecurity compliance and incident response since 2009, when he served as European counsel for a U.S. software company developing enterprise-wide security solutions—working with EU regulators and works councils to design monitoring frameworks that balanced threat detection with employee privacy. He later advised clients at Reed Smith, Seyfarth Shaw and Norton Rose Fulbright while writing and teaching on emerging cybersecurity law.

Burke’s current favorite cybersecurity books:

“Dawn of the Code War: America’s Battle Against Russia, China, and the Rising Global Cyber Threat” by John P. Carlin and Garrett M. Graff.

“This is How They Tell Me the World Ends: A Cyberweapons Arms Race” by Nicole Perlroth

“The Fifth Domain: Defending Our Country, Our Companies, and Ourselves in the Age of Cyber Threats” by Richard A. Clarke and Robert K. Knake

“Sandworm: The New Era of Cyberwar and the Hunt for the Kremlin’s Most Dangerous Hackers” by Andy Greenberg

“Cryptonomicon” by Neal Stephenson.