Data Breach Litigation Readiness Checklist: A Practical Checklist

How to use this checklist

Phases 1 and 2 are peacetime work. Do them this quarter. The contract you signed with your incident response vendor two years ago is already evidence in the case you haven't been sued in yet. Phases 3 through 9 run in order once an incident happens and belong to the defense. Phase 10 is for plaintiffs' counsel evaluating a case, and Phase 11 applies to both sides at settlement.

Assign an owner's initials and a date to each box. For the reasoning, read Data Breach Class Actions: Article III Standing, Negligence Claims, and Forensic Report Privilege. For narrative sequencing, use Defending or Bringing a Data Breach Class Action: A Practical Guide. For fill-in forms, use the Data Breach Litigation Toolkit. Operational notification tasks live in the Ransomware Readiness and Response Checklist and Responding to a Data Breach: The First Seventy-Two Hours, and this list does not repeat them.

Courts disagree on much of this, and your circuit matters. Where a task depends on forum, the note says so.

Phase 1: Contracts and terms (before any incident)

• Pull every incident response and forensic vendor contract, and read the scope language. In re Capital One Consumer Data Security Breach Litigation, 2020 WL 3470261 (E.D. Va. June 25, 2020). Note: The Capital One statement of work promised exactly what the later counsel letter did, which is why the report was ordered produced. Standing retainers are fine for operations. Do not assume the same paper will carry privilege.
• Add a contractual path for a separate, counsel-retained engagement with different scope, team, deliverables, and billing. In re Dominion Dental Services USA, Inc. Data Breach Litigation, 429 F. Supp. 3d 190 (E.D. Va. 2019). Note: The Capital One court specifically mentioned different vendors, scopes of work, or investigation teams.
• Pre-select two firms: one for operations, one for counsel. In re Premera Blue Cross Customer Data Security Breach Litigation, 296 F. Supp. 3d 1230 (D. Or. 2017). Note: Premera's firm was already at work when the breach turned up, and swapping supervisors did not change the outcome. Get insurer approval for both before an incident, since many cyber policies have vendor panels.
• Identify outside litigation counsel and pre-negotiate a template engagement letter with the counsel-track firm. Fed. R. Civ. P. 26(b)(3).
• Review customer-facing terms for class waivers, arbitration clauses, and forum and choice-of-law terms, and consider adding them where lawful. Maldini v. Marriott International, Inc., 140 F.4th 123 (4th Cir. 2025); American Express Co. v. Italian Colors Restaurant, 570 U.S. 228 (2013). Note: The Fourth Circuit enforced the waiver against loyalty program members who agreed to it. It reaches only signatories, and state consumer law may restrict such terms. Include a severability clause, which mattered in Marriott. If you want to bar consolidated treatment too, the clause must say so.
• Review privacy notices, handbooks, and employment agreements for security promises. Clemens v. ExecuPharm Inc., 48 F.4th 146 (3d Cir. 2022); Attias v. CareFirst, Inc., No. 15-cv-882 (D.D.C. Sept. 13, 2023). Note: A promise to "take appropriate measures" came straight from the employment agreement in Clemens, and such language gets quoted back in complaints. Promise only what you do. See Privacy Policies, Notices, and Consent.
• Review vendor contracts for security duties, breach notice, cooperation, audit, indemnity, and insurance. In re Young Consulting Data Breach Litigation, No. 1:24-cv-3938 (N.D. Ga. Sept. 15, 2026). Note: Plaintiffs now sue data owners and vendors together. Require the vendor to preserve evidence and share its forensic findings on terms that do not destroy your own protections. Use the Vendor Cybersecurity Diligence Checklist.
• Classify the company's CCPA status and that of its vendors. Cal. Civ. Code § 1798.140; In re Salesforce Customers Security Incident Litigation, No. 25-cv-07232 (N.D. Cal. Sept. 14, 2026). Note: Whether a vendor is a "business" or a "service provider" is contested. Contract roles help but don't settle it.
• Confirm cyber policy notice terms, panel requirements, consent-to-settle terms, and regulatory coverage. See D&O and Cyber Insurance Review Checklist.

Red flag: Your only forensic vendor contract is a retainer whose scope is "incident response, forensics, remediation, and a final report." That is the Capital One fact pattern, and adding a law firm's signature after the breach will not change the analysis.

Phase 2: Data, logging, and records (before any incident)

• Inventory where Social Security numbers, financial data, health data, and license numbers live, and delete what you do not need. Ramirez v. Paradies Shops, LLC, 69 F.4th 1213 (11th Cir. 2023). Note: Paradies inherited a former employee's data through an acquisition. Plaintiffs in these cases routinely plead failure to delete old data. Old data has only a downside. See Data Minimization.
• Encrypt the fields that § 1798.150 covers, and keep the key elsewhere. Cal. Civ. Code § 1798.150(a)(1); § 1798.81.5. Note: The private right applies to nonencrypted and nonredacted information, so properly encrypted data falls outside it, and encryption is a good fact everywhere.
• Set log retention long enough to bridge a realistic dwell time. Fed. R. Civ. P. 37(e); In re Wawa, Inc. Data Security Litigation, 141 F.4th 456 (3d Cir. 2025). Note: Wawa's malware ran about nine months before detection. If logs last 60 days, you won't be able to tell who was affected, which inflates the notice population and thus the class.
• Document the security program against a recognized framework, with dated risk assessments and decisions. Dittman v. UPMC, 196 A.3d 1036 (Pa. 2018); 16 C.F.R. Part 314; 45 C.F.R. Part 164. Note: Duty is usually easy for plaintiffs; breach is where the defense lives at summary judgment. Build the record now. See the Cybersecurity Compliance Toolkit.
• Run a tabletop that includes counsel, including the question "who gets which report?" Wengui v. Clark Hill, PLC, 338 F.R.D. 7 (D.D.C. 2021).
• Identify regulators that can demand root cause reports, and work out how you would respond. Morrill v. Lakeview Loan Servicing, LLC, No. 1:22-cv-20955 (S.D. Fla. Mar. 27, 2025). Note: If a regulator requires a root cause report, the document you give it may be treated as a regulatory record. Plan on a separate report written for that purpose.
• For public companies, decide who makes the materiality call and how it is recorded. Form 8-K, Item 1.05; 17 C.F.R. Part 229.

Phase 3: Hours 0 to 72 (defense)

• Issue a written litigation hold, and suspend log rotation and auto-delete. Fed. R. Civ. P. 37(e). Note: Image before rebuilding. Assign someone to keep a dated preservation log.
• Engage outside counsel before the counsel-track vendor, and have counsel sign the engagement. United States v. Kovel, 296 F.2d 918 (2d Cir. 1961). Note: Being retained by counsel is necessary and far from sufficient. Kovel protects translation of client information for the lawyer, not the vendor's own expertise.
• Decide and record the structure: operations report, counsel report, or both. In re Target Corp. Customer Data Security Breach Litigation, 2015 WL 6777384 (D. Minn. Oct. 23, 2015), as described in Wengui v. Clark Hill, PLC, 338 F.R.D. 7 (D.D.C. 2021).
• State the litigation purpose in the engagement, with facts showing why litigation is expected. Fed. R. Civ. P. 26(b)(3); In re Rutter's Data Security Breach Litigation, No. 1:20-CV-382 (M.D. Pa. July 22, 2021). Note: In Rutter's, a scope to "determine whether" a compromise occurred showed no one yet expected litigation. Wait for confirmation before asserting anticipation, or explain what triggered it. The operations team can do the "whether."
• Set the distribution rule: privileged track reports go only to outside counsel and designated in-house lawyers. Experian, 2017 WL 4325583 (C.D. Cal. May 18, 2017); United States v. Deloitte LLP, 610 F.3d 129 (D.C. Cir. 2010). Note: Deloitte held that showing work product to an independent auditor did not waive it, yet Capital One treated wide distribution as evidence of business purpose. Limit distribution for both reasons.
• Code invoices for the counsel track to a legal budget from day one. Capital One. Note: Capital One's later re-designation of payments as legal expenses did not help.
• Send written notice to the cyber insurer and get written approval of counsel and vendors. See Placing and Tendering a D&O or Cyber Claim.
• Notify and tender to any vendor or customer whose contract requires it.
• Tell executives and the board how to communicate: no speculation by email, no forwarding, phone counsel with questions. Upjohn Co. v. United States, 449 U.S. 383 (1981).

Red flag: Someone proposes that the forensic firm "just send the draft to IT so they can fix things." That is the moment the Clark Hill and Capital One arguments get made. Have the operations track carry remediation.

Phase 4: The notice letter (before mailing)

• Confirm each factual statement against non-privileged sources. Fed. R. Evid. 502; Upjohn.
• List data types exactly. Holmes v. Elephant Insurance Co., 156 F.4th 413 (4th Cir. 2025); In re Drivestream, Inc. Data Breach Litigation, No. 1:26-cv-00713 (E.D. Va. Aug. 21, 2026). Note: A claim of spam failed in both cases because the compromised data did not include phone numbers.
• Use "no evidence of misuse" only if you can stand behind it and have someone monitoring. Drivestream; Webb v. Injured Workers Pharmacy, LLC, 72 F.4th 365 (1st Cir. 2023).
• Review protective advice for accuracy, and expect it to be quoted. In re Zappos.com, Inc., 888 F.3d 1020 (9th Cir. 2018); Galaria v. Nationwide Mutual Insurance Co., 663 F. App'x 384 (6th Cir. 2016).
• Decide on credit monitoring on its own merits. Beck v. McDonald, 848 F.3d 262 (4th Cir. 2017). Note: Beck declined to treat an offer as a concession, and other circuits may not be so kind. Holmes and Kemper both involved such offers. Offering it is still usually right for affected people.
• Check timing against state deadlines, and explain delay if it is long. In re Young Consulting Data Breach Litigation; Cal. Civ. Code § 1798.82. Note: Complaints plead delay as incremental harm. In Webb, nine months passed between discovery and notice.
• Line up the letter with any Form 8-K and regulator filings so that the three versions agree. 17 C.F.R. Part 229.

Phase 5: First complaints (days 1 to 30)

• Set up daily docket monitoring and maintain a complaint chart. Toolkit worksheet.
• Calendar the removal deadline for each case from the date of service. 28 U.S.C. § 1446(b); Federal Deadline Calendaring and Recovery Checklist.
• Map each case to its circuit's standing rule. Bohnak v. Marsh & McLennan Cos., 79 F.4th 276 (2d Cir. 2023); Holmes; Green-Cooper v. Brinker International, Inc., 73 F.4th 883 (11th Cir. 2023).
• Decide on removal, knowing that a jurisdictional defect means remand. 28 U.S.C. § 1447(c); Polo v. Innoventions International, LLC, 833 F.3d 1193 (9th Cir. 2016); CAFA Removal and Remand Checklist.
• Decide on consolidation under Rule 42 or a Panel motion under § 1407. Fed. R. Civ. P. 42; 28 U.S.C. § 1407; Fed. R. Civ. P. 16.1. Note: Rule 16.1 took effect December 1, 2025. See the MDL Case Management and Bellwether Checklist.
• Stipulate to a response date keyed to a consolidated complaint. Fed. R. Civ. P. 12.
• Collect every set of terms that might bind each named plaintiff. Maldini v. Accenture LLP (In re Marriott), 78 F.4th 677 (4th Cir. 2023).
• Decide promptly whether to invoke arbitration. Morgan v. Sundance, Inc., 596 U.S. 411 (2022).

Red flag: The first response mentions a class waiver as one line in a list of 40 affirmative defenses, and nobody mentions it again until the certification brief. Marriott eventually won, but it took two appeals and a district judge's suggestion of forfeiture along the way. Say it clearly, identify the contract, and repeat it.

Phase 6: Pleadings (months 2 to 12)

• Break down standing by plaintiff, by injury, and by form of relief. TransUnion LLC v. Ramirez, 594 U.S. 413 (2021); Clemens.
• Choose a facial or factual attack, and write down the waiver analysis if a declaration is filed. Fed. R. Civ. P. 12(b)(1); In re Union Home Mortgage Corp. Data Breach Litigation, No. 1:25-cv-01874 (N.D. Ohio Sept. 28, 2026). Note: The Union Home court considered an expert report on the factual attack only and viewed untested evidence as persuasive at most.
• Check each named plaintiff's dates and data against the incident. Brinker.
• Attack injunctive relief separately. Webb; Holmes; City of Los Angeles v. Lyons, 461 U.S. 95 (1983).
• Check the CCPA count for notice timing, data elements, business status, and exemptions. Cal. Civ. Code § 1798.150(b); Young Consulting; In re Warner Music Group Data Breach, No. 20 Civ. 7473 (S.D.N.Y. Sept. 3, 2025).
• Research the state's position on duty and the economic loss rule before briefing. Dittman; Collins v. Athens Orthopedic Clinic, P.A., 307 Ga. 555 (2019); Community Bank of Trenton v. Schnuck Markets, Inc., 887 F.3d 803 (7th Cir. 2018).
• Test implied contract and unjust enrichment against the actual documents. Paradies; Malvitz v. Fincantieri Marine Group, LLC, No. 24-cv-238 (D.D.C. June 12, 2025).
• Advise the client in writing what a standing win means. Tsao v. Captiva MVP Restaurant Partners, LLC, 986 F.3d 1332 (11th Cir. 2021). Note: Tsao affirmed dismissal without prejudice, and state courts aren't bound by Article III.
• Move to stay discovery, and be prepared for the court to refuse. Fed. R. Civ. P. 26(c).

Phase 7: Discovery (defense)

• Obtain a Rule 502(d) order and a tiered protective order early. Fed. R. Evid. 502; Privilege Clawback and Rule 502 Checklist.
• Agree on privilege log method and timing at the Rule 26(f) stage. Fed. R. Civ. P. 26(f); Fed. R. Civ. P. 16(b); Preparing a Privilege Log.
• Assemble the privilege record before plaintiffs move: engagement letters, invoices, distribution log, and sworn declarations. Clark Hill; Dominion Dental. Note: The burden is yours. Conclusory declarations failed in both cases.
• Produce the operations report and underlying facts. Upjohn; Target.
• Check interrogatory answers for statements undercutting a two-track position. Clark Hill. Note: Saying that all of the company's understanding comes through counsel undoes the claim that a business investigation existed.
• Prepare the Rule 30(b)(6) designee on the investigation's chronology and purpose. Fed. R. Civ. P. 30(b)(6); Rutter's; Deposition Witness Preparation Checklist.
• Calendar 14 days for Rule 72 objections to any adverse magistrate order. Fed. R. Civ. P. 72(a).
• Keep testifying experts away from the counsel-track work product. Fed. R. Civ. P. 26(b)(4).
• Depose each named plaintiff on other breaches, spending, time, and contract terms. Brinker; Webb.

Red flag: The board deck includes a slide titled "Findings from [counsel-track vendor]." Capital One's report reached its board, and the court considered distribution as evidence of the report's business purpose. Counsel can advise the board. A summary of the report travels with the report's problems.

Red flag: Your regulator's examiner asks for "the root cause analysis" and someone offers the privileged report to end the argument. In Morrill, that voluntary production led the court to reexamine, and reverse, its earlier ruling that the reports were protected.

Phase 8: Class certification (defense)

• Move or brief class waivers as a threshold issue. Marriott I; Marriott, 140 F.4th 123.
• Compare class definition to injury. Cordoba v. DIRECTV, LLC, 942 F.3d 1259 (11th Cir. 2019); Brinker.
• Challenge the damages model on fit. Comcast Corp. v. Behrend, 569 U.S. 27 (2013); Tyson Foods, Inc. v. Bouaphakeo, 577 U.S. 442 (2016); Class Certification Expert Checklist.
• Test issue classes for superiority. Fed. R. Civ. P. 23(c)(4).
• Preserve the uninjured class member argument. Laboratory Corp. of America Holdings v. Davis, No. 24-304 (U.S. June 5, 2025).
• Have a Rule 23(f) petition outline ready; the window is 14 days. Fed. R. Civ. P. 23(f).

Phase 9: Regulators and follow-on suits (defense)

• Keep one chronology and reconcile all regulator statements against it. 15 U.S.C. § 45; FTC v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015).
• Log everything given to any regulator, and under what confidentiality promise. Morrill; Fed. R. Evid. 502. Note: Rule 502 did not adopt selective waiver. Morrill left open whether mandatory production waives work product.
• Expect shareholder and derivative demands, and preserve board materials. Construction Laborers Pension Trust v. Marriott International, Inc., 31 F.4th 898 (4th Cir. 2022); Firemen's Retirement System of St. Louis v. Sorenson, C.A. No. 2019-0965-LWW (Del. Ch. Oct. 5, 2021). Note: Defendants won both, yet discovery and costs still accompany these suits.

Phase 10: Plaintiffs' counsel: case evaluation and filing

• Score the breach under the three factors: targeting, misuse in the dataset, and sensitivity. McMorris v. Carlos Lopez & Associates, LLC, 995 F.3d 295 (2d Cir. 2021).
• Search leak sites, attorney general portals, and press, and save copies. Brinker; Drivestream.
• Ask each client about dates, data, other breaches, spending, and fraud. Brinker; Webb. Note: Get documents, since Holmes noted that plaintiffs alleged time but no money spent.
• Read all terms the client agreed to, and look for clients who agreed to none. Marriott.
• Choose the forum, including a look at where an MDL would go. Holmes; Bohnak; 28 U.S.C. § 1407.
• Decide whether state court is better, especially for a risk-only plaintiff. Collins; Bland v. Urology of Greater Atlanta, LLC, No. A25A1133 (Ga. Ct. App. Oct. 6, 2025).
• Serve the CCPA notice and wait the full 30 days before seeking statutory damages. Cal. Civ. Code § 1798.150(b); Young Consulting.
• Plead dark web facts from knowledge, not on information and belief alone. Drivestream; Fed. R. Civ. P. 11.
• Plead specific security failures. Warner Music.
• Plead standing separately for each remedy. Webb.
• Prepare the interim counsel application with breach-specific work. Fed. R. Civ. P. 23(g)(3); In re Geisinger Health Data Security Incident Litigation, No. 4:24-cv-01071 (M.D. Pa. Jan. 30, 2025).
• Serve first discovery for contracts, invoices, and distribution lists before moving on the report. Capital One; Clark Hill; Fed. R. Civ. P. 34.

Red flag: The only injury your client can name is two hours of checking statements after a laptop theft. Under Beck and McMorris, that is a dismissal in most circuits, and you have spent your credibility with the court in a case that may need it later.

Phase 11: Settlement (both sides)

• Compare relief to documented loss and to deals in similar cases. Fed. R. Civ. P. 23(e)(2); Colcord v. Premera Blue Cross (In re Premera), No. 3:15-md-2633 (D. Or. July 29, 2019).
• Negotiate fees only after class relief is settled. Wawa.
• Remove reversion and scrutinize clear sailing language. In re Wawa, Inc. Data Security Litigation, 85 F.4th 712 (3d Cir. 2023).
• Confirm whether service awards are allowed in the circuit. Johnson v. NPAS Solutions, LLC, 975 F.3d 1244 (11th Cir. 2020); Huang v. Equifax Inc. (In re Equifax), 999 F.3d 1247 (11th Cir. 2021).
• Make security commitments specific, with a term and a way to verify them. Wawa. Note: Objectors point out when the commitment was already budgeted.
• Design notice around direct channels, and expect low claims rates. Wawa.
• Serve the CAFA notice and calendar the 90 days. 28 U.S.C. § 1715.
• Tie the release to the incident, and check other tracks and employees. Wawa.
• Obtain the insurer's written consent.
• Build the fee record, including a lodestar cross-check. In re Retina Group of Washington Data Security Incident Litigation, No. DKC 24-0004 (D. Md. July 21, 2025).

Use this list as a general starting point and not as legal advice on any particular incident, since the answers change with forum, data, and contracts.

Related Documents

Related Articles

• Data Breach Class Actions: Article III Standing, Negligence Claims, and Forensic Report Privilege: the reasoning behind these tasks.
• Data Breach Response and Notification: The Fifty-State Patchwork, Regulators, and Litigation: notification duties.
• Privacy Policies, Notices, and Consent: Drafting Disclosures That Are True and Survive the FTC: the promises plaintiffs quote.

Related Guides

• Defending or Bringing a Data Breach Class Action: A Practical Guide: the sequence in narrative form.
• Responding to a Data Breach: The First Seventy-Two Hours: first-response operations.
• Data Minimization and Avoiding the Over-Retention of Personal Information: reducing what can be stolen.
• Placing and Tendering a D&O or Cyber Claim: A Practical Guide: insurer notice and consent.

Related Checklists

• Ransomware Readiness and Response Checklist: A Practical Checklist: the operational companion.
• Vendor Cybersecurity Diligence Checklist: A Practical Checklist: vendor contract terms.
• CAFA Removal and Remand Checklist: A Practical Checklist: removal tasks.
• MDL Case Management and Bellwether Checklist: A Practical Checklist: MDL tasks.
• Preparing a Privilege Log: A Practical Checklist: logging the counsel track.
• Privilege Clawback and Rule 502 Checklist: A Practical Checklist: clawback tasks.
• Federal Deadline Calendaring and Recovery Checklist: A Practical Checklist: calendaring.
• Deposition Witness Preparation Checklist: A Practical Checklist: preparing the designee.

Related Toolkits

• Data Breach Litigation Toolkit: Privileged Investigation Protocols, Standing Motions, and Settlement Terms: templates for these tasks.
• Cybersecurity Compliance Toolkit: Written Information Security Programs, Risk Assessments, and Incident Disclosure Memos: building the security record.