Privacy, Data Protection, and AI Regulation
Your customers ask how you handle their data. Have a good answer ready.
An enterprise prospect sends a security questionnaire with 300 rows. A European customer wants a DPA and transfer terms this week. Your product team ships an AI feature, and nobody has checked what data it trains on or what the law now requires.
I build privacy and AI compliance programs that start from your product architecture and data flows. I worked as product and privacy counsel at a SaaS company, building privacy compliance from the ground up. You get policies your engineers can follow and documents that pass a buyer's review.
What I handle
- GDPR, CCPA, and global privacy compliance programs
- Privacy notices, DPAs, and cross-border data transfer mechanisms
- Privacy management platform deployment
- Privacy-by-design counseling for product and engineering teams
- Incident response and data breach legal support
- AI product compliance and risk counseling
- Enterprise AI usage policy drafting
Who this is for
SaaS, FinTech, and AI companies that process customer data, sell to enterprise buyers with strict vendor requirements, expand into the EU, or build features on AI models.
How the work runs
Most engagements start with a data map and a gap review, then a prioritized plan. Retainer clients get ongoing privacy and AI counseling inside their monthly scope. Program builds are quoted as fixed-fee projects.
Common questions
Does GDPR apply to a US company?
It can. GDPR applies when you offer goods or services to people in the EU or monitor their behavior, even if you have no office there. The answer depends on who your users are and what data you collect, so we start by mapping both.
How long does it take to build a privacy program?
A baseline program with a privacy notice, data map, DPA template, and a process for data subject requests usually takes four to six weeks. Programs covering several jurisdictions or tied to a SOC 2 audit take longer. I scope the work to your actual risk.
Does the EU AI Act affect US companies?
It can. The Act reaches providers and deployers whose AI systems are placed on the EU market or used in the EU, wherever the company sits. Your obligations depend on your role and on the risk category your system falls into, so we classify your product first.
What AI policies does our company need?
At minimum, an internal AI use policy covering which tools employees can use and with what data, and a review process for AI vendors. If your product uses AI, you also need customer-facing terms and a risk assessment you can share during sales reviews.
Tell me what you are working on, and I'll tell you how I would approach it.
This page provides a general overview of Privacy, Data Protection, and AI Regulation matters. Every situation is different. Contact us to discuss the specifics of your matter.