Data privacy refers to requirements that govern all the ways your business interacts with and touches information about individuals (aka personal data). These requirements are often overlapping and may be a federal, state or other country law, regulation, or an industry standard. Data privacy laws in the United States are a patchwork of state laws often relating generically to individuals as resident consumers and federal laws often relate to a particular segment of society such as healthcare information, genetic information, or criminal justice information.

In other countries, data privacy is usually referred to as data protection. Global data protection requirements are also overlapping but are typically based on the individual as a human (not a consumer) and may or may not be based on the individual as a resident. If the data protection requirements are not based on the individual being a resident, this means your business is required to comply if the parameters fit – and often they do.

Data privacy legal requirements can be overwhelming, and businesses are sometimes tempted to sidestep data privacy because it seems like a heavy lift. The key is to start somewhere, determine the most impactful priorities, and regularly continue to build in governance and compliance layers. If your business provides a solution that ingests, stores, processes, or uses information about individuals, you will need a privacy compliance framework to interlock with development of the solution and go beyond the technology build and go to market phases. ITLG’s focus is for you to feel confident and secure in your data privacy/protection program and approach so you can concentrate on the core of your business.

Below are some ways we help clients with data privacy:

• Compliance: identify current and emerging legal, regulatory, and industry privacy requirements relevant to your business and assist in developing and implementing compliant privacy practices including cross border data transfers and privacy impact assessments. Overlapping compliance requirements are common and your business could be subject to federal, state, sector-specific, and foreign requirements such as the European Union General Data Protection Regulation (GDPR).

• Contracting: negotiate and draft agreements that address data privacy risk and requirements including agreements with customers, vendors, and partners.

• Data Governance & Assessments: review existing data governance program and policies and provide a gap analysis or assist in establishing a data governance program, as well as draft internal policies and procedures relating to the business use of personal data and assist in developing often-required privacy impact assessments.

• Privacy Policies: draft clear privacy policies that describe your business practices relating to the collection, storage, processing and use of personal data. Privacy policies are required on websites and similar public online locations that gather or track personal data of visitors; however, internal privacy statements about personal data of employees and contractors are also advisable.

• Data Breach Response: identify and assist with data privacy implications of a data breach such as governmental and breach notification requirements.

• Privacy by Design: intersect with the product design and development of a technology solution, to incorporate Privacy by Design principles into development.