Data breach disclosure laws and corporate tax planning activities
研究发现美国数据泄露披露法律的实施促使企业加强税务筹划以储备内部现金流，应对未来网络安全威胁，且该效应在财务受限或股东保护激励强的企业中更显著。
Cybersecurity has become an increasingly critical challenge worldwide. Prior literature demonstrates that cybersecurity breaches can adversely affect corporate operations and financing activities. However, the understanding of how firms can proactively prepare for future cybersecurity threats remains limited. We posit that firms could intensify their tax planning efforts to reserve internal cash flow to mitigate the potential shock of future cybersecurity threats. To investigate this, we leverage the staggered adoption of data breach disclosure laws in the United States, the first country to implement this type of cybersecurity legislation, as our research setting. The enhanced disclosure requirements heighten firms’ concerns and awareness about cybersecurity risk, and we find that firms increase their tax planning following the enactment of these disclosure laws. Consistent with our theoretical arguments, this relation is more pronounced when a firm is likely to face more severe losses from data breaches, when it is more financially constrained, and when it has a higher incentive to protect shareholders’ interests. Conversely, we find that tax planning efforts diminish in firms with high levels of IT capabilities. Moreover, proactive tax planning can help mitigate the negative effects of data breaches. We also demonstrate that federal guidance on cybersecurity disclosure and the Tax Cuts and Jobs Act further stimulate firms’ tax planning activities. Overall, this study suggests that tax planning can serve as a risk-management strategy to alleviate the potential shocks associated with cybersecurity risks.