Data breach notification laws and corporate payout policy

We examine the effect of data breach notification laws on corporate payout policy in the U.S. We find that, following the enactment of mandatory state-level data breach notification (DBN) laws, firms reduce cash dividends while increasing share repurchases, leaving total payout largely unchanged. The results are more pronounced in financially constrained firms, firms with weaker corporate governance structures, and firms with limited external monitoring. The relation is also more pronounced in high-tech industries and industries with high litigation risk, but less so in firms that have a chief technology officer or other IT-related high-ranking officers. We also find strong results using actual firm data breach incidents. These results suggest that when faced with increased cash flow risk following the adoption of DBN laws or actual data breaches, firms adjust their payout policy by reducing the stickier cash dividends, while increasing share repurchases, a more flexible form of payout.