Gregory Szewczyk

Greg Szewczyk is a Denver-based partner at Ballard Spahr and Practice Leader of its Privacy and Data Security Group. He advises companies on privacy and data security compliance, drawing on experience in transactions and litigation to address the risks that arise under state, federal and international requirements. His work includes helping businesses ranging from startups to Fortune 500 companies build and maintain privacy and data security programs.

Greg has advised hundreds of companies on compliance questions involving artificial intelligence, vendor management and the data processing decisions that arise in day-to-day operations. His advice has addressed the Colorado Privacy Act, California Consumer Privacy Act and California Privacy Rights Act, Virginia Consumer Data Protection Act, General Data Protection Regulation and Illinois Biometric Information Privacy Act, among other laws. He also works on matters involving the Payment Card Industry Data Security Standards, the Gramm-Leach-Bliley Act, state financial privacy laws and the Telephone Consumer Privacy Act.

In mergers, acquisitions and partnerships, Greg helps clients assess data-related risks and develop ways to address them. He also advises on data breach response, including incidents affecting consumers across all 50 states and internationally. When disputes follow data incidents or alleged misuse of data, he has defended companies in privacy and data breach class actions and represented them in business-to-business litigation, including matters involving artificial intelligence.

Greg is co-leader of Ballard Spahr’s Artificial Intelligence Team and holds the Certified Information Privacy Professional/United States (CIPP/US) credential from the International Association of Privacy Professionals. Before joining Ballard Spahr, he was an associate at Simpson Thacher & Bartlett LLP in New York. During law school, he completed a legal internship with the U.S. Army Judge Advocate General Corps.

• Advised on various types of transactions—including mergers and acquisitions, business partnerships, co-branded and private label credit cards, and rounds of funding—by conducting due diligence, assessing risks, and negotiating representations and warranties relating to privacy and data security issues
• Counseled on building and modifying privacy and data security programs, including privacy policies, vendor management policies, information security plans, incident response programs, terms of use, biometric consent and retention policies, and various other policies
• Advised on the potential legal implications and risks from incorporating artificial intelligence into business operations, including by developing AI governance policies
• Assisted in performing internal trainings for employees across substantive fields, including executive decision-makers and information technology teams
• Defended data breach and privacy class action lawsuits, including lawsuits involving international media publications, casinos, industrial manufacturers, and retailers

• Represented companies in various business-to-business litigation arising from data breaches
• Assisted in the forensic investigation of multiple cybersecurity incidents, including incidents involving email phishing scams targeting company employees; theft of information by former employees; lost or stolen storage devices; unlawful or unauthorized access of third-party databases; inadvertent disclosure of information to vendors unauthorized to receive the information; and ransomware attacks
• Advised numerous clients in responding to data breaches, including breaches implicating notification obligations under the laws of all 50 states and foreign countries

• Harvard Law School (J.D. 2009)
• University of Notre Dame (B.A., cum laude, 2006)

• Colorado
• New York
• U.S. District Court for the District of Colorado
• U.S. District Court for the Eastern District of New York
• U.S. District Court for the Southern District of New York
• U.S. Court of Appeals for the Ninth Circuit
• U.S. Court of Appeals for the Tenth Circuit

• Denver Business Journal, "40 Under 40," 2023
• JD Supra Readers' Choice Award, Top Author in Cybersecurity and Data Privacy, 2023, 2025
• Benchmark Litigation, "40 & Under List," - Entertainment, Intellectual Property, Media (Midwest), 2022-2024; Future Star, 2026
• Certified Information Privacy Professional/United States 

• American Bar Association
• Colorado Bar Association
• Denver Bar Association
• New York City Bar Association, Military Affairs and Justice Committee
• Protect Our Winters, Advisory Board

Chapter Co-author, "Privacy Regulations Applied to AI Technologies," Artificial Intelligence & Intellectual Property, 2025

Author, "Navigating the Biggest Privacy Risks Facing Media Companies Today," Headlines and Deadlines, Pennsylvania Newsmedia Association, November 2023

Co-author, "What Is the Potential Liability for Zoombombing, and How Safe Are Zoom Alternatives?," Cybersecurity Law Report, April 29, 2020

Co-author, "Utah Privacy Law Would Be First to Require Search Warrant for Government to Access Stored Data," The National Law Review, March 28, 2019 

Co-author, "What Companies Need to Know About Changes to Colorado's Cybersecurity Law," ColoradoBiz Magazine, September 16, 2018

Co-author, "Update on Colorado's Proposed Privacy and Cybersecurity Legislation," Pratt's Privacy & Cybersecurity Law Report, May 2018

Co-author, "Oregon, New York, Alabama, and Rhode Island Join List of States Considering Data Breach Legislation Post-Equifax," Pratt's Privacy & Cybersecurity Law Report, May 2018  

Co-author, "What New Mexico Companies Need to Know to Respond to a Data Breach," February 21, 2018 

Co-author, "What New Mexico Companies Need to Know About the State's Cybersecurity Law," February 13, 2018 

Co-author, "How To Comply with the Colorado Division of Securities Cybersecurity Rules," January 17, 2018

Co-author, "What Colorado Companies Need to Know to Respond to a Data Breach," January 12, 2018 

Co-author, "Colorado Privacy & Cybersecurity Handbook," September 25, 2017 

Co-author, "Overview of the Association of Corporate Counsel Model Information Protection and Security Controls for Outside Counsel Possessing Company Confidential Information," Ballard Spahr memo, April 2017   

Co-author, "Fending Off and Fighting Cybercriminals," Law Week Colorado, September 12, 2016