Privacy and data-protection counsel for companies that collect, process, and move personal data. We build the compliance programs, vendor terms, and cross-border transfers, and we run the calm, fast response a breach demands.
Every US state has a breach-notification statute, and they do not agree on the clock. Several give 30 days from discovery, HIPAA allows 60, and Illinois adds a notice to the Attorney General once more than 500 of its residents are affected. Each clock starts before anyone knows what was taken, which is why we draw the data map before the incident, not during it.
The law follows the customer, not the charter. A Delaware company with buyers in California, staff clocking in by fingerprint in Illinois and a server in Frankfurt answers to the CCPA, the Biometric Information Privacy Act and the GDPR at once, and each defines personal data differently. We inventory what the company holds and where it moves, then match each flow to its regime. That inventory is the first document a regulator asks for.
Vendors carry the data and the company keeps the liability, so processing agreements, transfer clauses and retention schedules are negotiated rather than accepted. Retention is the quiet lever: data the company never kept cannot be breached or demanded. When the call comes, we run the response under privilege, with the deadlines already calendared.
Building privacy programs mapped to the laws that apply to the company, from US state privacy statutes and sector rules such as HIPAA and GLBA to GDPR and UK GDPR where it reaches customers abroad, with policies, notices, and data-subject-rights processes that hold up under scrutiny.
Data inventories and data-flow mapping that show what personal and sensitive data a company holds, where it lives, and who touches it, which is the foundation for retention schedules, access controls, and a defensible record of how data is handled.
Negotiating data processing agreements, security addenda, and confidentiality terms with the vendors and platforms that handle data on a company's behalf, so obligations and liability sit with the right party across the supply chain.
Structuring lawful transfer mechanisms, including standard contractual clauses, adequacy bases, and transfer-impact assessments, for data that moves between jurisdictions, coordinating with locally admitted counsel where a specific country's law requires it.
Counsel through the full arc of a data incident, covering containment, evidence preservation, scope assessment, notification obligations under the applicable laws, and regulator and customer communications, with the speed and discipline a breach demands.
Reviewing product, data, and AI-feature architecture before launch so consent flows, retention limits, and data-subject rights are engineered into the product from the start.
The CCPA reaches any for-profit business that does business in California and takes in more than about $25 million a year, or handles the personal information of 100,000 or more consumers or households, or earns half its revenue from selling or sharing it. Where the company is incorporated does not enter the test.
Even data that escapes a particular statute is rarely free of obligation, because anti-fraud, security, contractual, and sector duties remain. The exemption analysis is where the program starts.
Under HIPAA a breach is discovered on the first day it is known, or with reasonable diligence would have been known, to anyone in the workforce other than the person who caused it. The clock therefore often starts before the security team is told. Legal scope assessment runs alongside the forensics, not after them.
Article 28 of the GDPR lists eight terms a processor contract must contain, from processing only on documented instructions to deletion or return when the engagement ends, and the US state privacy statutes require a written controller-processor contract of their own. A vendor's standard form is written for the vendor; the addendum is where the liability sits.
Article 25 of the GDPR makes privacy by design a legal duty rather than a slogan, and Article 35 requires a documented impact assessment before any processing likely to pose a high risk to individuals. The questions are the same in every regime: what is collected, why, and who can see it. Asked at design, they cost a meeting.
Article 30 of the GDPR requires a written record of processing activities, and its exemption for companies under 250 employees falls away as soon as the processing is more than occasional or includes sensitive data, which is to say almost always. Regulators open with a request for that record; the company that has it answers in a day.
Before anything is drafted, we trace what personal and sensitive data the company holds, through every system, vendor, and border it crosses, and match each flow to the regime that governs it. The inventory becomes the record a regulator will one day ask to see.
Notices, consent flows, retention schedules, and data-subject-rights processes are drafted against the strictest regime in scope, then documented as decisions rather than defaults. What ships in the product is what the policy promises, byte for byte.
Every processor, sub-processor, and cross-border transfer gets its contract: data processing agreements, security addenda, standard contractual clauses, and transfer-impact assessments, so when something fails downstream the liability sits where it was negotiated to sit.
When the four a.m. call comes, counsel directs forensics under privilege, fixes the scope of what was taken, and works the notification deadlines regulator by regulator, so a chaotic night ends as a documented, defensible response.
A breach is investigated twice, once by your forensics team and once by everyone else. We prepare you for the second investigation.
Hart David Carson LLP advises companies on the full lifecycle of personal and sensitive data: building privacy compliance programs, drafting policies and notices, negotiating vendor and data-processing terms, structuring cross-border transfers, and managing incident and breach response. The work runs from the privacy architecture chosen at product design through the obligations that attach when something goes wrong.
It depends on where your customers are, what data you collect, and your sector. A US company may face state privacy statutes such as the California regime alongside sector rules like HIPAA or GLBA, while reaching customers in the UK or EU brings GDPR and UK GDPR obligations into scope. We map your data flows to the regimes that govern them.
Retain counsel before the forensic firm, so the investigation runs under privilege and its report is not the plaintiff's first exhibit. Preserve logs and disk images before any system is rebuilt. Read the cyber policy the same day: most require prompt notice to the carrier and many require its panel vendors, and missing either condition can cost the coverage. Then fix the scope of what was taken, because every notification deadline keys off it.
Usually yes. When a vendor handles personal data on your behalf, most privacy regimes require contractual terms governing how that data is used, secured, and returned or deleted, and your own liability often turns on those terms. We negotiate data processing agreements, security addenda, and cross-border transfer mechanisms so the obligations sit with the right party and the chain of accountability holds.
Through a recognized mechanism, documented before the data moves. For transfers from the EU to a US company the choices are self-certification to the Data Privacy Framework with the Department of Commerce or the 2021 standard contractual clauses backed by a written transfer-impact assessment; the UK requires its own addendum to the clauses. Transfers to a country with an adequacy decision need neither. We select the mechanism that fits the flow and coordinate with locally admitted counsel where a specific jurisdiction's law requires it.
Yes, and the law assumes it will be. Article 25 of the GDPR requires data protection by design and by default, and the US state statutes impose data-minimization duties in similar terms. In practice it means answering three questions before the feature ships: what is collected, why, and how long it is kept. A feature that never stores the data carries no notification obligation when the system around it is breached. We review product and data architecture at the design stage so those answers are engineered in rather than argued later.
Buy- and sell-side counsel across the deal lifecycle, where data assets, privacy exposure, and breach history increasingly drive diligence and the terms of the transaction.
Explore →Counsel for public companies on disclosure, reporting, and governance, including the cybersecurity-incident and risk disclosures that now sit within securities compliance.
Explore →Board structure, fiduciary duty, and securities compliance, now that data risk and cybersecurity oversight are standing items on the board's agenda.
Explore →Governance, disclosure, and risk counsel on environmental, social, and governance matters, including the data-governance and trust questions that fall under the "G."
Explore →Reviewed by Jonathan D. Herpy, Sr., Senior Partner · Last updated October 2026 · Educational overview · Not legal advice
One partner is accountable for the whole matter, and you have that partner's direct line. Chicago, London, and Dubai work to the same standard.