Data Protection & Privacy

Personal data obligations apply from the moment a business starts collecting information, not from the moment it is asked about them. This practice area covers privacy compliance under the Digital Personal Data Protection Act, 2023 and, where a business has international exposure, under the GDPR and the CCPA.

Work in this area typically includes data mapping and record keeping, privacy notices and consent design, data processing and cross border transfer agreements, breach response procedures, retention schedules, and handling of data principal and data subject requests.

Privacy questions are treated as design questions. Reviewing how a product or process collects and moves data before it is built is usually less expensive than remediating it afterwards.