Zachary Heck

Zach’s practice focuses on privacy, data security and artificial intelligence (“AI”) counseling. Specifically, Zach assists clients in the areas of privacy compliance, data governance, and guidance in the aftermath of an information security incident.

He regularly advises organizations on the responsible development, deployment, and governance of artificial intelligence systems, including compliance with emerging state, federal, and international AI regulations. In addition, he counsels technology providers on the regulatory, security, and governance considerations associated with FinTech innovations, including blockchain, digital assets, and AI-driven financial tools.

Zach has experience advising clients with respect to FTC investigations, federal privacy regulations (such as HIPAA, FCRA, TCPA, and GLBA), state consumer privacy laws (e.g., CCPA/CPRA), foreign privacy regulations (e.g., PIPEDA and GDPR), AI and automated decision-making frameworks, and government contracting security requirements (e.g., NIST 800-171 and CMMC 2.0). For his clients, he also provides regulatory analysis, risk management, policy development, training, and audits. Zach speaks and writes regularly on cutting-edge data and AI governance issues, and is a Certified Information Privacy Professional in the fields of United States and European Union laws and regulations. Zach also holds the Certified Information Privacy Manager (CIPM) accreditation from the International Association of Privacy Professionals (IAPP). In 2025, Zach became a globally certified Artificial Intelligence Governance Professional (AIGP) through the IAPP, reflecting his leadership in AI ethics, risk management, and legal compliance. Zach was designated a Fellow of Information Privacy by IAPP in 2026.

• Presentation, Machining the Future:  AI Law from the Shop Floor to the Back Office, Precision Machined Products Association Annual Meeting, February 26, 2027
• Presentation, Reading the Fine Print Before You Press “Accept”:  Navigating the Legal Landscape of AI Procurement, NKU Cybersecurity Symposium, October 16, 2026
• Panel, Guidelines and Guardrails for AI Governance and Risk, Indiana IT Symposium, October 14, 2026
• Presentation, Keynote on State of AI Policy in Ohio and United States, Columbus AI Week, September 10, 2026
• Publication (Co-Contributor), “Where We Are Going with Blockchain,” Banking [on] Blockchain, 2^nd Edition, American Bar Association, August 2026
• Presentation, Rules of the Road:  Navigating Legal Risk Across the AI Lifecycle, Technology First Dayton AI Day, August 26, 2026
• Presentation, Latest on AI HR Landscape, Human Resource Association of Western Ohio, July 21
• Presentation, Artificial Intelligence and How to Navigate, AIM Municipal Law Seminar, June 26, 2026
• Presentation, Keynote on State of AI Policy, Privacy, and Compliance in the United States, Cincy AI Week, June 9, 2026
• Presentation, Legal Risks when Deploying AI in a Healthcare Setting, UC Analytics & AI Summit, May 5, 2026
• Panel, Cyber Insurance Considerations, GoCyber Cyber Insurance Summit, March 17, 2026
• Panel, Legal and Policy Perspectives of AI, February 25, 2026
• Podcast Interview, Legal Aspects of AI, The Economic Pulse Podcast, December 12, 2025
• Presentation, The Future of Cybersecurity for Leaders & Teams, Future Tech Forum,  December 10, 2025
• Presentation, AI in the Federal Courts, Federal Bar Association – Dayton Chapter, October 29, 2025
• Panel, CMMC Impact on Small Businesses, University of Dayton School of Law Government Contracts Symposium, October 23, 2025
• Presentation, AI, Kids, DNA & Disclosures: The FTC’s New Data Priorities Unpacked, Northern Kentucky University Cybersecurity Symposium, October 17, 2025
• Presentation, Smart Tech, Smarter Diligence: Legal Essentials for AI in Business, Cincy StartUp Week, October 8, 2025
• Presentation, Privacy by Design, Profit by Strategy: Cybersecurity and AI Laws a Business Booster, Not a Brake, Dayton StartUp Week, September 9, 2025
• Panel, Managing Risk in the Age of AI and Automation, CincyAI Week, June 10, 2025
• Publication, Top 10 Technology Legal Issues to Watch for in 2025, Dayton Bar Briefs, January/February 2025
• Presentation, Privacy and AI, University of Dayton Program in Law & Technology, November 1, 2024
• Presentation, Data Dilemmas: How Consumer Health Data Laws Transform Data Governance and Security, Northern Kentucky University Cybersecurity Symposium, October 18, 2024
• Publication, Artificial Intelligence, Real Liability: Who’s on the Hook When Things Go Wrong?, Dayton Bar Briefs, September/October 2024
• Presentation, Avoiding Hacks and Ransomware Attacks: What Lawyers Need to Know, ALI-CLE, March 27, 2024
• Presentation, OpenAI, Open Book: Emerging Privacy and Security Issues in the Age of Generative AI, Columbus IAPP KnowledgeNet, August 31, 2023
• Phishing Season: A Lawyer’s Guide to Navigating Ransomware, CinPA Security SIG June 15, 2023
• Panel, Federal Alignment to Cybersecurity, Cyber Dialogue with Industry, February 27, 2023
• Presentation, Security Vulnerabilities and Ransomware Shutdowns: Learning from Apache Log4j Vulnerability and the Associated Legal Duties, MyLawCLE and Federal Bar Association, August 25, 2022
• Presentation, Ran-some, Lose-some: Preparing for and Surviving Against Ransomware Attacks, Ohio Valley ABC, January 25, 2022
• Presentation, “Cybersecurity Maturity Model Certification: Policy and Technical Requirements,” Public Contracting Institute, November 3, 2021
• Presentation, “Doing Your HOMEwork: Setting Up an Effective Work from Home Framework,” Technology First, July 9, 2020
• Publication:  “Working from Home?  Online Scammers are Not Social Distancing,”  Dayton Bar Briefs, April 2020
• Presentation, “NIST Compliance and Industry Updates,” Wright Dialogue with Industry, July 18, 2019
• Presentation, “GDPR’s Paper Anniversary:  How We Have Documented Progress and Lessons Learned,” University of Dayton School of Law Program in Law & Technology Annual Seminar, June 7, 2019
• Presentation, “Can You Hack Back?”  Ohio Cyber Dialogue with Industry, May 8, 2019
• Publication, “A Litigator’s Primer on European Union and American Privacy Laws and Regulations,” American Bar Association Litigation Journal, Winter 2018
• Publication, “SEC Warns Celebrities About Cryptocurrency Endorsements,” TYL (American Bar Association), February 2, 2018
• Interviewed in “Net Neutrality Vote Pending,” WDTN 2 News, November 27, 2017
• Presentation, “Data Governance for Law Firms,” Dayton Chancery Club, November 17, 2017
• Publication, “HBO Refuses to Bend the Knee During Data Breach,” American Bar Association, November 2017
• Presentation, “Biometrics & The Importance of Privacy Impact Assessments: What We Can Do Better,” Indiana University Center for Applied Cybersecurity Research, October 19, 2017
• Presentation, “Virtual Reality: Altering the Way We Look at Data Governance & Privacy Impact Assessments,” Northern Kentucky University Cybersecurity Symposium, October 13, 2017
• Interviewed in “How to Spot and Prevent Cyberbullying: Twitter Q&A”, PBS NewsHour, July 12, 2017
• Quoted in “Can You Record Fireworks with a Drone?” Consumer Reports, July 1, 2017
• Interviewed in “Privacy Law with Zach Heck – Is CIPP/US Certification Worth it?” Law School Strategy, June 21, 2017