Zachary Heck

Zach’s practice focuses on privacy, data security and artificial intelligence (“AI”) counseling. Specifically, Zach assists clients in the areas of privacy compliance, data governance, and guidance in the aftermath of an information security incident. He regularly advises organizations on the responsible development, deployment, and governance of artificial intelligence systems, including compliance with emerging state, federal, and international AI regulations. In addition, he counsels technology providers on the regulatory, security, and governance considerations associated with FinTech innovations, including blockchain, digital assets, and AI-driven financial tools. Zach has experience advising clients with respect to FTC investigations, federal privacy regulations (such as HIPAA, FCRA, TCPA, and GLBA), state consumer privacy laws (e.g., CCPA/CPRA), foreign privacy regulations (e.g., PIPEDA and GDPR), AI and automated decision-making frameworks, and government contracting security requirements (e.g., NIST 800-171 and CMMC 2.0). For his clients, he also provides regulatory analysis, risk management, policy development, training, and audits. Zach speaks and writes regularly on cutting-edge data and AI governance issues, and is a Certified Information Privacy Professional in the fields of United States and European Union laws and regulations. Zach also holds the Certified Information Privacy Manager (CIPM) accreditation from the International Association of Privacy Professionals (IAPP). In 2025, Zach became a globally certified Artificial Intelligence Governance Professional (AIGP) through the IAPP, reflecting his leadership in AI ethics, risk management, and legal compliance.

• Panel, CMMC Impact on Small Businesses, University of Dayton School of Law Government Contracts Symposium, October 23, 205
• Presentation, AI, Kids, DNA & Disclosures: The FTC’s New Data Priorities Unpacked, October 17, 2025
• Presentation, Smart Tech, Smarter Diligence: Legal Essentials for AI in Business, October 8, 2025
• Presentation, Privacy by Design, Profit by Strategy: Cybersecurity and AI Laws a Business Booster, Not a Brake, September 9, 2025
• Panel, Managing Risk in the Age of AI and Automation, CincyAI Week, June 10, 2025
• Publication, Top 10 Technology Legal Issues to Watch for in 2025, Dayton Bar Briefs, January/February 2025
• Presentation, Privacy and AI, University of Dayton Program in Law & Technology, November 1, 2024
• Presentation, Data Dilemmas: How Consumer Health Data Laws Transform Data Governance and Security, Northern Kentucky University Cybersecurity Symposium, October 18, 2024
• Publication, Artificial Intelligence, Real Liability: Who’s on the Hook When Things Go Wrong?, Dayton Bar Briefs, September/October 2024
• Presentation, Avoiding Hacks and Ransomware Attacks: What Lawyers Need to Know, ALI-CLE, March 27, 2024
• Panel, Developing a Privacy Program, Masters Conference, September 12, 2023
• Presentation, OpenAI, Open Book: Emerging Privacy and Security Issues in the Age of Generative AI, Columbus IAPP KnowledgeNet, August 31, 2023
• Phishing Season: A Lawyer’s Guide to Navigating Ransomware, CinPA Security SIG June 15, 2023
• Panel, Federal Alignment to Cybersecurity, Cyber Dialogue with Industry, February 27, 2023
• Presentation, Security Vulnerabilities and Ransomware Shutdowns: Learning from Apache Log4j Vulnerability and the Associated Legal Duties, MyLawCLE and Federal Bar Association, August 25, 2022
• Presentation, Ran-some, Lose-some: Preparing for and Surviving Against Ransomware Attacks, Ohio Valley ABC, January 25, 2022
• Presentation, “Cybersecurity Maturity Model Certification: Policy and Technical Requirements,” Public Contracting Institute, November 3, 2021
• Presentation, “Your Privacy Program,” University of Dayton School of Law Program in Law & Technology Annual Seminar, June 11, 2021
• Presentation, “Doing Your HOMEwork: Setting Up an Effective Work from Home Framework,” Technology First, July 9, 2020
• Publication:  “Working from Home?  Online Scammers are Not Social Distancing,”  Dayton Bar Briefs, April 2020
• Presentation, “NIST Compliance and Industry Updates,” Wright Dialogue with Industry, July 18, 2019
• Presentation, “GDPR’s Paper Anniversary:  How We Have Documented Progress and Lessons Learned,” University of Dayton School of Law Program in Law & Technology Annual Seminar, June 7, 2019
• Presentation, “Can You Hack Back?”  Ohio Cyber Dialogue with Industry, May 8, 2019
• Publication, “A Litigator’s Primer on European Union and American Privacy Laws and Regulations,” American Bar Association Litigation Journal, Winter 2018
• Publication, “SEC Warns Celebrities About Cryptocurrency Endorsements,” TYL (American Bar Association), February 2, 2018
• Interviewed in “Net Neutrality Vote Pending,” WDTN 2 News, November 27, 2017
• Presentation, “Data Governance for Law Firms,” Dayton Chancery Club, November 17, 2017
• Publication, “HBO Refuses to Bend the Knee During Data Breach,” American Bar Association, November 2017
• Presentation, “Biometrics & The Importance of Privacy Impact Assessments: What We Can Do Better,” Indiana University Center for Applied Cybersecurity Research, October 19, 2017
• Presentation, “Virtual Reality: Altering the Way We Look at Data Governance & Privacy Impact Assessments,” Northern Kentucky University Cybersecurity Symposium, October 13, 2017
• Interviewed in “How to Spot and Prevent Cyberbullying: Twitter Q&A”, PBS NewsHour, July 12, 2017
• Quoted in “Can You Record Fireworks with a Drone?” Consumer Reports, July 1, 2017
• Interviewed in “Privacy Law with Zach Heck – Is CIPP/US Certification Worth it?” Law School Strategy, June 21, 2017