Services

Data Privacy Consulting

Data privacy and data security overlap but they're not the same question. Security asks whether data is protected from unauthorized access. Privacy asks whether you should be collecting and using that data the way you are in the first place, whether people know about it, and whether you can actually honor the rights regulations like GDPR and CCPA give them, like deleting someone's data on request or telling them exactly what you hold.

The trouble most organizations run into isn't malicious intent, it's that data collection practices grew organically over years, a marketing tool here, an analytics script there, a form that collects more than it needs, until nobody can give a clean answer to "what personal data do we actually have, and why." That gap is exactly what a privacy audit surfaces, and exactly what gets you in trouble if a regulator or a customer asks the same question.

How I approach this

I start with data mapping, figuring out what personal data you actually collect, where it's stored, who has access, and why it's being collected in the first place. A surprising amount of privacy risk disappears the moment you stop collecting data you never needed. From there, I look at your obligations under the relevant regulations, GDPR for EU data subjects, CCPA for California residents, and whatever industry-specific rules apply, and build the actual mechanisms to honor them: a working process for data subject access and deletion requests, clear and accurate privacy notices, and consent mechanisms that actually reflect what you're doing with the data.

I also look at vendor relationships, because a lot of privacy exposure isn't your own data handling, it's a third-party processor you've handed data to without a proper data processing agreement or any visibility into how they handle it.

Who needs this

If you're not confident you could answer a data subject access request within the required timeframe, if your privacy policy doesn't actually match what you're doing with data, or if you're expanding into a market with privacy regulations you haven't dealt with before, this is worth sorting out proactively.

Get in touch and let's map out what data you're actually holding and what you owe the people it belongs to.