Gregory T. Parks
For more than 25 years, Gregory T. Parks has helped companies navigate cyber incidents, ransomware attacks, data breaches, privacy crises, compliance needs, and related litigation and regulatory proceedings. Greg brings practical judgment and calm, clear communication to these matters. He advises boards of directors, chief executive officers, chief legal officers, senior in-house legal teams, chief information security officers, and business leaders. During an incident, Greg works with forensic experts, recovery specialists, negotiators, insurers, and communications professionals to manage the matter from the first minutes through regulatory investigations, class action litigation, recovery efforts, and resolution.
Greg has advised on more than 3,000 data security incidents for organizations across the retail, healthcare, financial services, technology, education, insurance, and other industries. His experience includes leading the response to a major healthcare data security incident and a major retail payment card incident. In those and other significant matters, he has directed crisis response and forensic investigations, advised boards and senior management, developed notification and communications strategies, managed regulatory inquiries, defended multiple class actions, pursued and defended substantial cost-recovery claims, and negotiated complex litigation and regulatory resolutions.
Greg is also an active first-chair litigator who regularly defends data breach and privacy class actions, consumer and financial institution claims, and other litigation arising from cybersecurity incidents, privacy practices, and consumer-facing business operations. He handles all phases of these and other types of litigation, including early case assessment, motions to dismiss, class certification, discovery, expert proceedings, summary judgment, trial, settlement, and appeal. His broader litigation practice includes consumer protection, retail, payment card, advertising, loyalty and gift card, and other complex commercial and class action matters.
That litigation experience informs Greg’s advice from the outset of an incident. He helps clients assess how decisions concerning investigation scope, containment, remediation, notification, public communications, and affected individuals are likely to be scrutinized months or years later in litigation and regulatory proceedings. His practice sits at the intersection of cybersecurity, privacy law, crisis management, and litigation, with a focus on helping clients make practical and defensible decisions while remaining calm under intense time pressure.
Clients rely on Greg for clear-eyed risk assessment, calm leadership, and practical advice that accounts for legal obligations, operational realities, enterprise value, and reputation. He regularly handles regulatory investigations and enforcement matters, disputes with vendors and other responsible parties, insurance and contractual recovery issues, and governance questions arising from data security and privacy events.
Greg also advises companies on the design and implementation of privacy and cybersecurity compliance programs. He has assisted more than 1,000 companies with compliance under US state consumer privacy laws, including the California Consumer Privacy Act (CCPA), Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), and Connecticut Data Privacy Act (CTDPA); the European Union’s General Data Protection Regulation (GDPR); state data breach notification laws; Fair Credit Reporting Act (FCRA); Telephone Consumer Protection Act (TCPA); CAN-SPAM Act; Children’s Online Privacy Protection Act (COPPA); Payment Card Industry Data Security Standard (PCI DSS); and other global, federal, state, and local requirements.
A longtime leader of the Morgan Lewis retail and ecommerce industry team, Greg also counsels retailers and other consumer-facing companies on advertising and marketing, loyalty and gift card programs, payment systems, pricing, loss prevention, consumer protection, and related litigation.
Results may vary depending on your particular facts and legal circumstances.
