If your company collects personal information from California residents (defined broadly to include for example, name and email), then you need to post a privacy policy that meets certain criteria.

If your company is a ‘covered business’ as defined by the California Consumer Protection Act (CCPA) then there are several steps that need to be taken including proper disclosures in your privacy policy, certain written agreements with vendors considered to the “Service Providers” under CCPA, and operationalizing your business to respond to security breaches and consumers requests related to their personal information. 

If your company solicits goods or services from EU residents then you need to be compliant with the EU’s General Data Protection Regulation (GDPR). In simple terms, the GDPR requires a compliant privacy notice (often referred to in U.S. as a privacy policy) and certain written agreements with subprocessors.  An analysis under GDPR of whether your company is acting as a data controller or data processor is important. If the former, then it is also necessary to identify the applicable legal basis for collecting the personal data. If a company is relying on legitimate interests as the basis it needs to have conducted appropriate due diligence and analysis to support that finding. Also internal practices including record keeping, data mapping, and personnel training are a key part of our privacy compliance. Finally your company needs to operationalize the business to respond to security breaches and data requests.  

Jenny has significant experience counseling small to medium size companies on their CCPA & GDPR compliance strategy. This includes drafting their privacy policy (or notice under GDPR), and model written agreements with subprocessors (often referred to as Data Processing Addendums), and offering them sound advice on the GDPR internal practice requirements. She can provide recommendations for outsourcing data mapping and other GDPR technical requirements.

She has counseled companies on the upcoming California Consumer Protection Act (CCPA) and their compliance strategy. Similar to GDPR compliance, she can recommend outsourcing vendors for data mapping and other CCPA technical requirements.

 In technology transactions, she has deep experience with data protection issues both on the customer and the vendor side of technology agreements.