Gregory Parks

About Gregory Parks

For more than 25 years, I have helped companies navigate cyber incidents, ransomware attacks, data breaches, and privacy crises—when speed, sound judgment, credibility, and clear calm communication are essential.As a partner at Morgan Lewis, I work closely with senior in-house legal teams to lead and support large and small cyber incident response matters of all kinds, many involving complex data environments, heightened regulatory scrutiny, and significant class action exposure. I regularly advise on breach response, regulatory enforcement and investigations, litigation strategy, and governance issues arising from data security and privacy events.I grew up as a class action litigator and continue to serve as a first-chair defense lawyer in high-stakes matters. That background allows me to help in-house teams evaluate how decisions made in the first hours of an incident—notifications, communications, scoping, and remediation—are likely to play out months or years later in class action litigation and regulatory proceedings. My practice sits at the intersection of cybersecurity, privacy law, and litigation, with a focus on helping clients make defensible decisions under intense time pressure.I partner closely with in-house legal teams, executives, forensic experts, and communications professionals to manage risk, meet regulatory obligations, and protect enterprise value and reputation. Clients rely on me for practical advice, clear-eyed risk assessment, and calm \"been there, done that\" leadership—especially when the stakes are high.This work also makes me a valuable advisor to clients on privacy compliance across the \"alphabet soup\" of privacy laws - California Consumer Protection Act (CCPA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), and all other state consumer privacy acts, the European General Data Protection Regulation (GDPR), the state data breach notification laws, the Fair Credit Reporting Act (FCRA), the FTC Red Flags rule, PCI-DSS mandates for credit card security, CAN-SPAM marketing email laws, the Telephone Consumer Protection Act (TCPA), FinCEN and other anti–money laundering rules, the Children’s Online Privacy Protection Act (COPPA), the Massachusetts Data Security Regulations, and global, federal, state, and local privacy laws.A longtime leader of the Morgan Lewis Retail Industry Team, I also help retail clients with privacy and other challenges ranging from advertising and marketing to gift cards, loyalty programs, pricing and litigation.

Experience

1. Partner

   Morgan, Lewis & Bockius LLP

   Sep 1997 — Present

   Counseling and litigation in data security incidents, consumer class actions, privacy, and retail operations issues. Primary Leader of the Morgan Lewis Cybersecurity Incident Response and Privacy (CIRP) Practice.

Education

• University of Pennsylvania Carey Law School

  Doctor of Law (J.D.)

  1994 — 1997

• Bucknell University

  Bachelor of Arts (B.A.), Political Science and Philosophy, Minor in Legal Studies

  1990 — 1994

Skills

• Courts
• Appeals
• Product Liability
• Privacy Law
• Commercial Litigation
• Class Actions
• Trials
• Arbitration
• Intellectual Property
• Civil Litigation
• Cyber-Security
• Legal Research
• Cyberlaw