Looking to get started?

Simply reach out to me here. Share your situation and concerns, and let me show you how I can help.

Do a state’s privacy laws apply to my company if we have no office or employees in that state?

Usually yes. Most state privacy laws key on where your customers live, not where your company sits. If you are doing business in a state or targeting its residents and you cross that state’s threshold, you are in scope regardless of your physical footprint.

The thresholds are where it gets messy, because they are not uniform. Some states start at 25,000 residents, others at 100,000, and Tennessee does not begin until 175,000. Texas and Nebraska skip the numeric test altogether and use a different standard. A single customer list can put you squarely inside one state’s law and comfortably outside its neighbor’s.

The practical answer is that this is a counting exercise before it is a legal one. Map where your users actually are, then work out which laws you have crossed into.

We use subprocessors. Are we responsible for what they do with our customers’ data?

In large part, yes. Handing data to a vendor does not hand off your accountability with it. You are generally expected to choose vendors with reasonable care, bind them with appropriate contract terms, and be able to show both.

That is what the contract is for. Done properly, the terms flowing down to your subprocessors mirror the commitments you made upstream to your own customers, so you are not promising something you have no way to deliver. The gap I usually find is not the first-tier vendor, which is typically papered. It is the subprocessors that vendor engages behind them.

What is a Data Processing Agreement, and do we actually need one?

A Data Processing Agreement (“DPA”) is the contract that governs what a vendor is allowed to do with personal data you hand them. It sets the purpose, the limits, the security expectations, what happens when the relationship ends, and what the vendor must do if something goes wrong.

You likely need one in both directions. If you use vendors that touch your customers’ personal data, and nearly every SaaS company does, the law generally requires that relationship be papered with specific terms. And your own enterprise customers will almost certainly require one from you before they sign. A DPA is not boilerplate to attach at closing. It is where a meaningful amount of your risk actually sits.

We have a privacy policy. Doesn’t that mean we’re compliant?

No, and this is the most common misunderstanding I encounter. A privacy policy is a disclosure document. It describes what you do. Compliance is whether you actually do it, and whether the machinery behind it works: honoring deletion and access requests on time, contracting properly with vendors, handling opt-outs, and collecting only what you disclosed.

The bigger exposure is a policy that no longer matches reality. Companies change products, add analytics tools, and bring on new vendors without revisiting the policy that describes them. At that point the document has stopped protecting you and started creating a problem, because a policy that misdescribes your actual practices is treated as a deceptive statement in its own right, separate from whatever the underlying privacy law requires.