Data Breach Disclosure Laws and Corporate Tax Planning Activities

Cybersecurity has become an increasingly critical challenge worldwide. Prior literature demonstrates that cybersecurity breaches can adversely affect corporate operations and financing activities. However, the understanding of how firms can proactively prepare for future cybersecurity threats remains limited. We posit that firms could intensify their tax planning efforts to reserve internal cash flow to mitigate the potential shock of future cybersecurity threats. To investigate this, we leverage the staggered adoption of data breach disclosure laws in the United States, the first country to implement this type of cybersecurity legislation, as our research setting. The enhanced disclosure requirements heighten firms’ concerns and awareness about cybersecurity risk, and we find that firms increase their tax planning following the enactment of these disclosure laws. Consistent with our theoretical arguments, this relation is more pronounced when a firm is likely to face more severe losses from data breaches, when it is more financially constrained, and when it has a higher incentive to protect shareholders’ interests. Conversely, we find that tax planning efforts diminish in firms with high levels of IT capabilities. Moreover, proactive tax planning can help mitigate the negative effects of data breaches. We also demonstrate that federal guidance on cybersecurity disclosure and the Tax Cuts and Jobs Act further stimulate firms’ tax planning activities. Overall, this study suggests that tax planning can serve as a risk-management strategy to alleviate the potential shocks associated with cybersecurity risks.