Erin Jane Illman

Erin Illman advises companies on privacy, data security and the legal questions that arise when technology becomes part of business operations. A Board Certified Specialist in Privacy and Information Security Law recognized by the State of North Carolina, she co-chairs Bradley’s Cybersecurity and Privacy Practice Group and leads the firm’s Fintech team. Her work spans privacy compliance, the development of digital products and services, security incidents, and privacy-related disputes and enforcement actions.

Erin advises on U.S. and international private-sector privacy requirements, including rules governing transfers of sensitive personal data between the United States, the European Union and other jurisdictions. Her compliance work covers CCPA, GLBA, HIPAA, COPPA, CAN-SPAM, FCRA, security breach notification laws, other federal and state privacy and data security requirements, and global data protection laws. She helps clients assess how they handle sensitive information, develop privacy policies and consumer-facing notices, review third-party agreements and vendor oversight, and establish privacy and security programs, including programs involving domestic and offshore vendors.

When an incident or dispute arises, Erin represents companies in response efforts, privacy-related litigation and enforcement matters. Her incident work includes insider cybersecurity threats, electronic and physical theft of trade secrets, and the investigation, analysis and notification associated with security incidents and breaches. She also handles disputes and enforcement actions involving alleged data privacy violations.

Erin’s technology counseling extends to e-commerce, electronic marketing, digital contracts and the launch of new products and services. She advises on privacy compliance for existing offerings and marketing activities, as well as electronic transactions under ESIGN and UETA. Her work for technology and e-advertising clients includes questions about the use and disclosure of consumer information under state and federal law, including TCPA, UDAAP/UDAP and associated FTC rules. She has assisted clients with products and services involving electronic identities, digital vaults, automated operations and cloud storage, and advises on legal obligations associated with social media, mobile applications, cryptocurrencies, digital ledger technology and biometric authentication.

Erin also brings experience in commercial and consumer lending. She has worked on trade finance, capital-backed subscription lines, and multi-bank, multi-state and international lending arrangements. Her consumer lending experience includes transactions, regulatory compliance disputes, enforcement defense, internal risk assessment and debtor-creditor matters, including remedies, Uniform Commercial Code issues, fraud and tort counterclaims, credit risk management and loss mitigation.

Erin holds the ANSI Certified Information Privacy Professional (CIPP/US) designation through the International Association of Privacy Professionals and serves on the North Carolina Bar Association’s Privacy and Security Committee.

Digital identity and safekeeping functions for national banks
Advised national banks on creation, implementation, oversight and legal requirements relating to setting up digital and electronic document file management and digital and biometric identity storage.

Digital and electronic business platforms
Advised financial institutions on implementation of controls, procedures and safeguards necessary for the operation of traditional and disruptive technologies.

Privacy, security and financial technology policies
Assisted in the creation and implementation of appropriate policies and procedures designed to limit transaction and reputation risk, and corresponding change control mechanisms to ensure policies and procedures are implemented throughout the appropriate business units.

ESIGN and UETA
Advised clients on creation of electronic contracts and related policies and procedures and risk management relating to the roll-out and use of electronic agreements.

Third-party and vendor management
Review vendor contracts and negotiate provisions pertaining to privacy and security, audits, tests, evaluations, monitoring, breach incident response, and other privacy-related obligations.

• University of Alabama School of Law, J.D., 2005
• University of North Carolina at Chapel Hill, B.A., 2000, Psychology and Communication Studies

• California
• North Carolina

• Listed in The Best Lawyers in America^®, Privacy and Data Security Law, 2027
• Listed inChambers USA, Nationwide: Privacy & Data Security: Cybersecurity, 2025-2026
  • Global Guide, Privacy & Data Security: Cybersecurity, 2026
• JD Supra Readers’ Choice Award, “Top Read Article,” Cybersecurity and Data Privacy, 2022
• Listed in Charlotte Business Journal, "Women in Business," 2021
• Listed in North Carolina Lawyers Weekly, "Leaders in the Law," 2018
• Listed in The Mecklenburg Times, "50 Most Influential Women," 2019
• North Carolina Pro Bono Honor Society, 2019-2020

• American Bar Association
  • Cybersecurity Legal Task Force, 2021
• North Carolina State Bar
  • Privacy and Information Security Law Specialization Committee, Chair, 2025 
• North Carolina Bar Association
  • Privacy and Data Security Section, Chair, 2020-2021
• Mecklenburg County Bar
  • Law and Society Committee, Chair, 2018-2019
• Charlotte Mecklenburg Food Policy Council, Chair, 2018-2020
• Leadership Charlotte, 2016
• ANSI Certified Information Privacy Professional (CIPP/US)
• National Association of College and University Attorneys