Abstract This article is based on a talk given by the author in May 2007 discussing the legal aspects of IT security. After first going through security-specific regulation applicable to all industries it describes in some detail relevant regulations applicable specifically to the financial services and communications' industries and explores the practical implications of these regulations for in-house lawyers and those advising them. The second part of the article discusses security-related provisions which should be considered for inclusion in any IT services contract.