A recent study led by researchers from The University of Western Australia (UWA) has revealed that data breach laws are driving up the cost of private debt for businesses, though effective cybersecurity strategies can help mitigate these costs.
Published in The British Accounting Review, the study highlights how the US data breach notification (DBN) laws affect borrowing terms for companies, with a particular focus on the financial implications of breach disclosures.
Data breach notification laws, which require companies to notify individuals if their personal data has been compromised, are a critical part of consumer protection. While these laws serve to safeguard consumers, they also introduce financial burdens for businesses that suffer data breaches.
The research investigates the ripple effect these laws have on firms’ access to credit, revealing that firms operating in states with such laws face higher borrowing costs, as lenders adjust their risk assessments.
How DBN Laws Influence Borrowing Costs
The core of the study centers around the impact of DBN laws on private debt costs. These laws, which started in California in 2002, have now been adopted in all 50 U.S. states, compelling businesses to disclose data breaches to the public.
While this practice serves consumer interests, it also increases the perceived risk associated with lending to affected companies. According to the study, when companies are required to disclose breaches, lenders anticipate higher future costs, such as litigation fees and reputational damage, which can lead to more expensive loans for these firms.
Lead author Nishant Agarwal, a lecturer at UWA’s Business School, noted that the study confirmed lenders are factoring in the added risks posed by potential future data breaches when assessing loan applications.
“Our research shows that the increase in borrowing costs is driven by lenders’ concerns over future risks, including the potential for legal repercussions and reputational harm following a data breach,” Agarwal explained. This elevated risk perception results in higher interest rates for companies operating in breach-prone sectors, especially those that disclose cybersecurity risks in their filings.
However, the research also provides a silver lining: businesses that take proactive steps to address these cybersecurity concerns—by investing in robust security measures or appointing technology officers—can reduce their borrowing costs. These companies are viewed more favorably by lenders, which can translate into lower interest rates and better loan terms.
The Intersection of Cybersecurity and Finance
The study, which used data from 2002 to 2018 to assess the impact of staggered state-level adoption of DBN laws, sheds light on the relationship between cybersecurity and finance. It found that firms that have invested in strong cybersecurity infrastructure are perceived as less risky by lenders. This, in turn, can offset some of the cost increases typically associated with breach disclosures.
“Our findings suggest that businesses with a strong cybersecurity focus are better positioned to navigate the regulatory landscape created by DBN laws,” said Agarwal. “Investing in cybersecurity not only protects a company’s assets but also improves its financial resilience by reducing the risk of higher borrowing costs.”
The research also emphasizes the importance of forward-thinking risk management strategies in today’s increasingly digital world. Firms that integrate cybersecurity into their core business strategy, especially at the leadership level, can mitigate the negative impact of DBN laws on their financial performance.
A Closer Look at the Data
The study analyzed how the introduction of DBN laws has affected loan contracts and borrowing terms across various industries. The research revealed that firms in states with DBN laws face an average increase in loan spreads by 0.19% (approximately 39.79 basis points) compared to companies in states without such laws. The increase was particularly pronounced for firms in breach-prone industries such as technology, healthcare, and finance, where the risks associated with data breaches are inherently higher.
On the other hand, companies with strong cybersecurity measures, such as appointing dedicated technology officers or investing in advanced security technologies, saw a smaller increase in borrowing costs. This indicates that lenders recognize these companies as being proactive in mitigating risks, and as such, are more inclined to offer favorable loan terms.
One notable observation was that the increase in borrowing costs was also more significant for firms with internal control weaknesses or those that disclosed cybersecurity risks in their filings. This suggests that companies with higher exposure to data breach risks, or those perceived as poorly equipped to handle such risks, face a more substantial financial burden when borrowing.
Broader Implications for the Corporate World
The study’s results underscore a critical message for businesses operating in an increasingly digital landscape: cybersecurity preparedness is not just an IT concern, but a financial one as well. Firms that invest in robust security measures and integrate cybersecurity leadership into their corporate strategy can improve their financial resilience and avoid the costly repercussions associated with data breach disclosures.
In a statement, Agarwal added, “Our research highlights the growing intersection of cybersecurity, regulation, and finance. As data breach laws continue to evolve, firms that prioritize cybersecurity are better positioned to manage the financial challenges associated with these regulations.”
Conclusion
This research, led by Nishant Agarwal from The University of Western Australia, with contributions from Chandrani Chatterjee (University of Texas) and Swetha Agarwal (Indian School of Business), provides key insights into the impact of data breach notification (DBN) laws on borrowing costs.
The study highlights how these laws can increase the financial burden on businesses, particularly those in breach-prone industries. However, the findings also emphasize that companies can mitigate these costs by prioritizing strong cybersecurity and integrating risk management strategies into their operations.
The research highlights the growing need for companies to recognize the intersection of cybersecurity and financial decision-making, reinforcing that effective cybersecurity not only protects a company’s reputation but also contributes to more favorable financial outcomes in an increasingly competitive market.
