Navigating AI Training Data Acquisition and IP Implications
AI training data acquisition involves critical intellectual property (IP) considerations that companies must address to mitigate legal risks and protect their…
[SERVICE]Privacy and data protection
Data privacy attorneys for products that handle personal data
Personal data brings real legal risk. We write privacy policies that match how your product works, build compliance for the laws that apply and help you prepare for a breach.
[01]Who it's for
For companies whose product runs on data.
Good privacy practice keeps you compliant, builds customer trust, reduces the impact of a breach and can set you apart from competitors.
SaaS and apps
User accounts, analytics and customer data, with a privacy policy that matches the product.
Health and wellness products
Patient and health data, where HIPAA or the FTC’s health breach rule can apply.
Fintech
Financial data covered by the Gramm-Leach-Bliley Act and partner requirements.
Companies with users abroad
Customers in the EU and other countries with their own privacy laws.
[02]What we handle
Privacy built into how you operate.
The firm’s privacy and data protection work goes beyond a checkbox. We help fit the requirements into your processes so compliance is part of how the business runs. We do not promise any regulator’s view of your program.
Privacy terms also belong in your customer and vendor contracts, which we handle with the same team.
What we help with
- Privacy policiesDrafted or reviewed for your data practices, and adapted for each country and platform you operate in.
- Data protection strategyData audits and mapping, classification and handling procedures, minimization and retention, and advice on encryption and anonymization.
- Compliance programsFor GDPR, CCPA, HIPAA and industry rules such as GLBA.
- Incident response, vendors and trainingResponse plans and tabletop exercises, vendor contracts and data processing agreements, and employee training.
Gaps we look for
- A policy that does not match the productPromises your app or data flows do not keep.
- Unknown dataPersonal data collected without anyone knowing where it goes.
- Vendors without termsCustomer data shared with tools that never agreed to protect it.
- No breach planNotification deadlines discovered during the breach.
[03]The basics
Which privacy laws apply to your startup?
A data privacy attorney works out which laws apply to the data you collect, writes the policies and contracts they require, and builds a program you can run. In the US there is no single federal privacy law, so the answer depends on where your users are, what data you handle and your industry.
| Law | Who it generally applies to | What it requires |
|---|---|---|
| California Online Privacy Protection Act | Websites and apps that collect personal information from California residents | A posted privacy policy |
| CCPA, as amended by the CPRA | For-profit businesses in California that meet a revenue or data volume threshold, such as handling the personal information of 100,000 or more California consumers or households | Notices, rights to know, delete and opt out, and contract terms with service providers |
| Other state privacy laws | A growing number of states with comprehensive privacy laws of their own | Similar notices and consumer rights, with different thresholds |
| GDPR | Companies that offer goods or services to people in the EU, or monitor their behavior, even from outside the EU | A lawful basis, transparency, data subject rights and data processing agreements |
| HIPAA | Health care providers, health plans and their business associates | Privacy and security safeguards and breach notification |
| FTC Health Breach Notification Rule | Many health apps and devices not covered by HIPAA | Notice to users and the FTC after a breach |
| Gramm-Leach-Bliley Act | Financial institutions, including many fintech companies | Privacy notices and a security program |
| COPPA | Services directed to children under 13, or that knowingly collect their data | Verifiable parental consent |
| FTC Act | Most businesses | Not misleading users about privacy or security |
Every state also has a data breach notification law. Which ones apply depends on where the affected people live, not where your company is.
Training an AI model on personal data raises its own questions, covered in navigating AI training data acquisition and IP. Subscription businesses should also read the FTC click-to-cancel rule.
[04]Data protection
Data protection strategy and vendor management.
A privacy policy describes your practices. A data protection strategy is how you make them true.
Data protection strategy
- Data audits and mapping. What personal data you collect, where it is stored and who it is shared with.
- Classification and handling. Procedures for each kind of data, in line with the rules that apply.
- Minimization and retention. Collecting only what you need and deleting it on a schedule.
- Encryption and anonymization. Advice on adding these layers to how you manage data.
Third-party vendors
Your data protection is only as strong as the vendors you share data with. We review vendor contracts for privacy and data protection terms, build assessment questionnaires to check a vendor before you share data, and advise on data processing agreements. Those terms sit in the same contracts covered on our business contracts page.
Employee training
We develop training on privacy practices and each employee’s role in protecting data, including data handling procedures and employee monitoring and workplace privacy.
[05]Incident response
Plan for a data breach before one happens.
A prepared company limits the damage and keeps the trust of customers and partners. Notification deadlines can be short, so the plan has to exist first.
- Response plan. Clear procedures for detecting, responding to and recovering from a breach.
- Tabletop exercises. Simulated breaches so your team tests the plan before it is needed.
- Notification guidance. Which people, regulators and partners must be notified, and when.
- Post-incident review. Analysis and reporting so the same gap does not open twice.
Products that are also medical devices carry FDA cybersecurity duties, covered on our FDA regulatory compliance page.
[06]Fees
One flat fee, quoted before work begins.
There is no hourly billing. Your privacy work is quoted as a flat fee on your strategy call, once the scope is clear, and nothing starts until you approve it.
Book A Free Strategy CallWhat sets the fee is the work itself, not the time on the clock.
- The deliverable. A privacy policy, a compliance program, vendor terms, an incident response plan or training.
- The laws involved. One state and US users, or several jurisdictions.
- How much data mapping it needs. The number of products, data flows and vendors.
Ongoing work for a growing company can run on a monthly Fractional IP Counsel plan instead of one fee per document. This service is not covered by The RLG Guarantee, which applies to patentability searches, provisional patents, design patents and trademarks.
[07]The process
From first call to a working privacy program.
What happens at each step and who does the work.
PrivacyCall to program
- Day one01Day oneStrategy callFree. Walk us through the deal, the documents or the problem.
- Flat fee02Flat feeScope and flat feeWhat the work covers and its price, in writing, before it begins.
- 03Data map and gapsWhat you collect, where it goes and which laws apply.
- 04Policies and contractsPrivacy policy, internal procedures and vendor terms, for your approval.
- 05Ongoing updatesPolicy updates and compliance questions as laws and the product change.
[08]Questions
Questions about data privacy.
Still deciding? Your first call is free and comes with a straight answer on which laws apply.
Book A Free Strategy CallWhat does a data privacy attorney do?
Works out which privacy laws apply to the data your company handles, drafts privacy policies and data terms, builds compliance programs and incident response plans, and reviews vendor contracts for data protection.
Does my startup need a privacy policy?
If your website or app collects personal information from California residents, which most do, California law requires a posted privacy policy. App stores and many partners require one too. It must describe what you actually do with data.
Does the CCPA apply to my startup?
It applies to for-profit businesses doing business in California that meet a threshold, such as annual revenue above a level the law sets and adjusts, handling the personal information of 100,000 or more California consumers or households, or earning half their revenue from selling or sharing it. Many early startups are below it, but other laws can still apply.
Does GDPR apply to a US company?
It can. GDPR applies to companies outside the EU that offer goods or services to people in the EU or monitor their behavior, for example through tracking on a website aimed at EU users.
Is my health app covered by HIPAA?
Only if you are a covered entity, such as a provider or health plan, or a business associate working for one. Many consumer health apps are not, but they can still fall under the FTC Health Breach Notification Rule and state laws.
What should I do after a data breach?
Contain it, preserve evidence, and get advice on notification quickly, because state laws and contracts can set short deadlines. An incident response plan prepared in advance makes each of these steps faster.
Can you guarantee my company is compliant?
No one honestly can, because laws change and regulators decide. What we do is identify the laws that apply, help you meet their requirements and keep your policies current as things change.
How much does privacy and data protection work cost?
With us it is a flat fee, quoted on your strategy call before any work begins. It depends on the deliverable, the laws involved and how much data mapping your products need.
[09]Learning Center
Go deeper on data and compliance.
SaaS Agreements: Developing A Strong Legal Foundation (Checklist Included)
Over the past 20 years, Software as a Service (SaaS) has seen substantial growth in sales. Although annual growth is starting to slow compared to other service models…
New FTC Click to Cancel Rule Simplifies Ending Recurring Subscriptions
FTC Click to Cancel Rule, a new regulation, simplifies subscription cancellations for consumers. Part of broader amendments to the Negative Option Rule, it enforces clear…
[10]Client reviews
Companies that built with us.
4.7 across 614 public reviews on Google, Trustpilot and Avvo.
#1Top reviewed IP law firm*
Read client reviews“The Rapacke Group stands by their fees with no surprises.”
Lowell CrawfordClient review “From creating a new business and checking to make sure we were in full compliance, the team at The Rapacke Law Group handled everything with ease for us.”
Aqua Fire PitBusiness formation · Client review “I always felt confident that my intellectual property was in good hands.”
JakePatent · Client review
Reviews reflect individual client experiences. Quotes are excerpts. Prior results do not guarantee a similar outcome. *#1 top reviewed means the most public client reviews on Google, Trustpilot and Avvo of any US patent or trademark firm.
Earn your users’ trust.
Talk through your product and the data it handles. The call is free, with no obligation.