Global Cyber with Data Privacy: A Simulation Write-Up
With four semesters of a Georgia Tech Online Master in Science in Cybersecurity Policy under my belt and an early career background in cybersecurity consulting, I’m always looking for ways to practice my cybersecurity and governance, risk, and compliance (GRC) skills. This last semester, I completed Privacy for Professionals, a course that deep dives into privacy from a multi-disciplinary approach including law and cybersecurity. To complement my studies, I recently undertook the Global Cyber with Data Privacy simulation from DLA Piper on Forage to build hands-on experience in data privacy, risk management, and compliance analysis.
Task One: Data Breach Assessment
Placed in a role of the junior member of global law firm DLA Piper’s Global Data Protection and Cybersecurity team, you are first expected to brief your client Raccine, a fashion company, on whether their recent data breach consists of a “personal data breach” under the GDPR. Next, you are to determine their notification obligations and relevant timelines. All of this is to be communicated via video to Raccine’s General Counsel and other leadership.
Prior and throughout the task, you are provided with resources such as the incident report, a company statement draft to the public about the breach, a breakdown of the GDPR’s relevant definitions and the notification obligations, and more. This aspect of the task caters to users perhaps a bit much in my opinion, reducing the amount of independent research that can be conducted, but the thoroughness was appreciated.
Right off the bat, after reviewing the resources, I worked through the briefing’s suggested outline and drafted a detailed transcript. First, I defined “personal data,” “personal data breach,” and the notification obligations and timelines under the GDPR, which I was already familiar with from my course. Next, I discussed Raccine’s incident in question: how it constituted a personal data breach, steps taken that complied with the GDPR, and steps in-progress to remain compliant. I highlighted the reputational and regulatory risks Raccine faced before summarizing. Because I had been so thorough in my transcript, I was able to record my briefing in one take, though it might have come across a little wooden.
This task strengthened my ability to:
● Synthesize documentation (an incident report, data privacy and security laws, etc) into clear observations
● Translate these observations into actionable findings communicated to diverse stakeholders
● Assess a data breach and notification obligations under the GDPR
While I had learned about the GDPR academically, it was useful to practically apply that knowledge while assessing Raccine’s incident. I also took the opportunity to refamiliarize myself with incident reports and the response process, which I had previously taken a course on. Learning from my last simulation, I ensured that my notes were detailed, structured, and thorough, but a minor gap remained that my language could have been simpler and the content could have drawn further away from the resources and outline provided.
Task Two: Advising On Strategic Responses and Risk Mitigation
To your immense surprise, Raccine’s General Counsel wants to discuss your video briefing in a public setting, and it’s your new task to advise against this in an email. This draft should also contain identification of risks to individuals impacted by Raccine’s data breach, identification of what their notifications should include, and identification of potential consequences under non-compliance with the GDPR.
Again, you’re provided with several of the same resources (the incident report namely) as well as DLA Piper’s collection of global data protection laws to reference.
In this task, my approach was largely the same as the previous task; I was already feeling rather primed in terms of my knowledge and expectations. I pulled from the task’s own instructions and resources to compose an explanation for why meeting in a public setting such as a restaurant to discuss the incident response is a poor move and angled it under further potential GDPR non-compliance. I spent more time drafting the email than actually brainstorming the content.
Here is where I also faced a little confusion on behalf of the instructions, which kept referencing a table on risk and GDPR compliance that was meant to be included in the email alongside a provided template. But I didn’t find any template, so I created a rough “table” in the text box and populated it with information that I had pulled together during the last task. However, once I checked the example answer provided, the table included was vague and non-compliant with the instructions. Perhaps, this was an understanding failure on my part or an error in the simulation itself.
No matter. This task strengthened my ability to:
● Strategically consider communicating a data breach to impacted customers, including notification obligations
● Convey information clearly, accurately, and professionally to upper leadership and diverse stakeholders
● Trust in my own instincts in regards to instructions
Task Three: Evaluating Legal Risks of Ransom Payment
Get Tarunika Kapoor’s stories in your inbox
Join Medium for free to get updates from this writer.
Surprise, surprise! By your third task, you discover that since the cyber incident is specifically a ransomware attack, Raccine is being extorted by the threat actor and are seriously considering paying the ransom. As the junior team member, you are tasked with drafting a comprehensive memo advising Raccine’s Board of Directors on the legal implications of paying the ransom.
You’re provided with links to numerous resources pertaining to the EU and UK GDPR and other government advice about personal data breaches, but ultimately, I found it more useful to do my own research. And you need to do it, too: copious research. It was at this point that I realized that this simulation is well-targeted for legal professionals or anyone from a legal background, but I still found it interesting to dig through statues and case law about ransomware payments, sanctions restrictions, money laundering, terrorism financing, and more. I emerged better educated on the risks of paying a ransomware payment in the EU and the UK (while it’s not illegal, it’s not condoned).
The task instructions expect the memo to be around 1,500 to 2,000 words long; writing the memo took me numerous hours across two days with the amount of research and corresponding writing involved. By the second day, I wizened up and became strategic with conducting my research and refining my draft through AI. The final product, when compared to the example provided, was as thorough in content but could have been streamlined in format, though working on it left me feeling as if I had completed a term paper.
Ultimately, I came away feeling that this task had strengthened my ability to:
● Research laws and regulatory guidance related to ransomware attacks
● Research civil, criminal, and personal risks and liabilities stemming from paying the ransom demand
● Deliver legal guidance that protects clients and supports sound decision-making under pressure
Task Four: Revising A Media Statement Post-Cyber Incident
For the final task, the cyber incident has worsened for Raccine, and I was charged with revising a draft media statement, assessing it for accuracy, adherence to regulatory standards, and alignment with best practices — and explaining my rationale for each change. Resource-wise, I was provided with the draft statement and a template for the revised version.
This was my weakest task, though also the shortest by nature. I came in feeling confident given that I had already critiqued the draft statement in the first task, and my instincts were largely in the right place: I trimmed unnecessary details, kept a professional tone, and removed speculative language.
Where I fell short was striking the right balance between transparency and professionalism — my version ended up briefer and blunter than it needed to be, and I undersold Raccine’s proactive steps.
In hindsight, a useful exercise would have been benchmarking my statement against a real published incident response, like this one, and using it as a reference point. Even so, I found the task a worthwhile exercise in thinking through reputational risk and what it means to put on a PR hat during a cyber incident.
In this task, I strengthened my ability to:
● Balance transparency, accuracy, and regulatory compliance in public-facing communications
● Weigh legal considerations against reputational risk when communicating about a data breach
● Prioritize messaging at different stages of cyber incident response
In Conclusion: Takeaways
The DLA Piper simulation wasn’t quite what I expected going in, but it delivered something valuable: focused, practical exposure to the non-technical side of cyber incident response. Across the four tasks, I worked through:
● Compliance analysis under the GDPR, applied to a real-world ransomware and data breach scenario
● Risk assessment and prioritization across regulatory, reputational, and legal dimensions
● Legal reasoning in service of stakeholder communication and strategic decision-making
The format helped too. The dialogue between “team members” and the framing around each task made it feel less like busywork and more like actual preparation. And while I have no intentions of going into law, digging through EU and UK statutes, regulatory guidance, and case law around ransomware was genuinely interesting — and a good reminder that the legal perspective is one a GRC professional can’t afford to overlook.
