Every company that collects personal data now answers to a mix of state, federal, and foreign rules, enforced by regulators, state attorneys general, and plaintiffs' firms. Our privacy and data security services help you build a program that reflects how your systems actually handle data, write public commitments you can keep, and respond fast when something goes wrong. Because we understand how software, databases, and cloud services move information, we can map data flows with your engineers instead of relying on a questionnaire. And because we litigate, we draft policies and incident records with an eye on how they will read to a regulator or a judge months or years later.
What Our Privacy Work Covers
Privacy and data security law in the United States is a patchwork. The California Consumer Privacy Act, as amended by the CPRA, sits alongside comprehensive privacy laws in a growing list of states, including Virginia, Colorado, Texas, and Tennessee. Sector laws add HIPAA for health information, the Gramm-Leach-Bliley Act and the FTC Safeguards Rule for financial data, COPPA for children's data, and the Illinois Biometric Information Privacy Act for biometrics. The FTC polices unfair and deceptive practices under Section 5 of the FTC Act, and the EU and UK GDPR reach many U.S. companies with European users. Our services cover compliance programs, policies, data governance, vendor contracts, cross-border transfers, breach response, regulatory inquiries, and the litigation that follows incidents.
The Privacy Services We Offer
Privacy compliance builds programs grounded in what data you collect and how it moves, including privacy impact assessments and the policies regulators expect. GDPR/CCPA counsel harmonizes European and California requirements into one workable program covering consumer rights requests, opt-outs, sensitive data, and cross-border transfers. Data governance sets classification, retention and disposal schedules, access controls, and vendor terms. Privacy policies produces readable public notices that match what your product actually does and meet jurisdiction-specific disclosure rules. Breach response coordinates the first hours of an incident under privilege, including forensics, notifications, and regulator contact. Data breaches carries that work into the aftermath: multi-state notification, attorney general inquiries, and defense of the class actions that often follow. Each service has its own page with more detail.
Incidents, Regulators, And Class Actions
When an incident happens, the legal clock starts quickly. All fifty states have breach notification statutes with different triggers and deadlines, the GDPR generally requires notice to a supervisory authority within 72 hours of becoming aware of a breach, and public companies may need to file a Form 8-K under Item 1.05 within four business days after determining that an incident is material. We engage forensic firms through counsel and structure the engagement to protect privilege, since courts have ordered forensic reports produced when that structure was missing. We handle notifications, law enforcement contacts, and inquiries from state attorneys general, the FTC, HHS, and European authorities. When class actions follow, we challenge standing, oppose class certification, and work toward resolution using the facts developed during the response.
Programs, Policies, And Vendor Terms
Compliance work starts with a data map: what personal data you collect, where it is stored, who receives it, and how long you keep it. From that map we build the pieces regulators look for, including privacy notices, consumer request workflows, records of processing, data protection impact assessments, retention schedules, and incident response plans. We draft and negotiate data processing agreements and vendor security terms, and for transfers out of Europe we rely on the EU-U.S. Data Privacy Framework or Standard Contractual Clauses with transfer assessments. For product teams, we review new features for privacy issues before launch, such as tracking pixels, biometrics, precise location data, and AI training on user data. In transactions, we diligence a target's privacy practices and breach history.
How A Privacy Engagement Runs
Program engagements begin with interviews of your product, engineering, marketing, and security leads and a review of your systems, vendors, and existing documents. The first deliverable is a written gap assessment that identifies which laws apply, where you fall short, and what to fix first. We then draft or revise policies, notices, and agreements, and help your team implement workflows for consumer requests and data retention. A typical program build takes several weeks to a few months depending on the size of the business. Breach engagements run on a different clock: we start the day you call, set up privileged forensics, build a notification analysis by jurisdiction, draft notices and regulator submissions, and stay through any inquiry or lawsuit that follows.
Data, Technology, And Disputes
Privacy is where technology choices become legal exposure. A tracking pixel added by marketing, a log file that captures more than intended, or a misconfigured cloud bucket can turn into a regulatory inquiry or a class action under wiretapping, video privacy, or biometric statutes. Our technical background lets us read the code and configuration behind the issue, ask engineers the right questions, and describe practices accurately in policies and in court. Privacy also runs through the rest of our work: trade secret programs, technology contracts, and M&A diligence all depend on how data is governed. We serve software and SaaS companies, AI developers, fintech and financial services firms, healthcare and life sciences businesses, retailers and e-commerce brands, education companies, and media platforms.
Flat Fees, Estimates, And Response
Defined work, such as a privacy policy for a product or a standard data processing agreement, can often be handled at a flat fee with a fixed price, a stated scope, and a set turnaround. Program builds, governance frameworks, and multi-jurisdiction compliance projects are scoped and estimated in writing after an initial assessment. Breach response is estimated by phase, and we will tell you early which costs your cyber insurance policy may cover. Call us before launching a product that collects new types of data, before entering a new state or country, and when you receive a consumer demand letter, a regulator inquiry, or a wiretapping complaint. If you suspect an incident, call before you notify anyone or engage forensics, so the investigation is set up under privilege.
