Do data breach notification laws affect accounting conservatism?

Abstract

Purpose This paper studies the impact of data breach notification (DBN) law on corporate accounting conservatism. Design/methodology/approach The staggered adoption of state-level data breach notification (DBN) laws in the U.S. provides a natural quasi-experiment for our study. We use Ordinary Least Squares (OLS) regression to test the DBN laws' impact on earnings conservatism measures. The findings are validated using an entropy-balanced sample, the parallel trends assumption, and alternative accounting conservatism measures. Findings We find that mandatory data breach notification laws lead to greater accounting conservatism. Further analysis shows that the impact is more pronounced in financially constrained firms. Our results suggest that firms reduce their risk preferences by reporting earnings more conservatively when confronted with increased risks and costs related to data breach disclosure requirements. Research limitations/implications In this study, we did not analyze the accounting policy changes of the breached companies around the dates of the data breaches. Researchers could validate the findings with more specific information using case studies in the future. Practical implications Data breaches can result in substantial financial and reputational setbacks for firms, particularly when these breaches are not promptly reported. The comprehension of how the obligatory disclosure of corporate data breaches influences a company's accounting policy holds profound significance for both policymakers and corporations. Originality/value To the authors' knowledge, this paper is the first to examine the impact of DBN laws on accounting conservatism.