Privacy Regulation and the Reputational Risk of Cyber Events
Christoph Jaenicke · North American Actuarial Journal · 2025
Against the background of increasing data privacy regulations in the United States and European Union, this study investigates the effect of privacy regulations on the reputational risk of cyber events. By extracting cyber events from the SAS Global OpRisk database, the world’s largest operational risk database, we find significantly larger cumulative abnormal returns (CAR) after the installation of privacy regulations. CARs are significantly influenced by firm size in the preregulation regime and by Tobin’s Q in the postregulation regime. Difference-in-differences regressions suggest a limited influence of regulation on key firm performance measures after a cyber incident. In the European Union, return on assets is significantly reduced in contrast to the United States. Overall, regulation amplifies the immediate consequences of an event compared with the preregulation era, but we find mixed evidence for these amplified consequences to be sustainable.