Data Privacy Compliance

Where the obligations come from

Most companies are subject to more law than they realise, because privacy statutes follow the data rather than the office. A single product can pull in a European regulator through the GDPR, a California regulator through the CPRA, and a health regulator through HIPAA, all at once. We start by identifying which regimes genuinely apply to you and which do not, so effort goes where it counts.

• GDPR and UK GDPR: a lawful basis for every use, transparency at the point of collection, honoured data subject rights, documented processing, a lawful route for international transfers, and breach notification measured in hours rather than weeks.
• CCPA and CPRA: notice at collection, opt-out of sale and sharing, limits on sensitive personal information, prescribed contract terms with every service provider and third party, and risk assessments for higher-risk processing.
• HIPAA: covered entity and business associate status, executed business associate agreements, the Privacy Rule on use and disclosure, the Security Rule on administrative, physical and technical safeguards, and the Breach Notification Rule.
• US state privacy laws: a growing body of statutes with common architecture and inconsistent detail, particularly on universal opt-out signals, sensitive data consent, and assessment obligations.

How Wall Law helps you comply

Advice that stops at a memorandum leaves the work undone. Our engagements are built to end in artefacts you can hand to a regulator, a customer, or an acquirer, and in processes your teams can run without counsel in the room.

• A gap assessment that reads your systems and contracts, not just your policies, and states plainly where you stand against each applicable law.
• A remediation roadmap sequenced by exposure and effort, so the board can see what is being fixed this quarter and what is deliberately waiting.
• Drafted and negotiated documents: privacy notices, consent and preference language, data processing agreements, standard contractual clauses, transfer impact assessments, and business associate agreements.
• Rights handling that works at volume, with intake, identity verification, response templates, and an audit trail that shows you met the statutory deadline.
• Vendor and sub-processor diligence, including the contract terms each regime specifically requires rather than a generic addendum.
• Regulator and customer correspondence, questionnaires and audits, handled with counsel rather than improvised by the account team.

Evidence, not assurances

When an authority opens a file, it does not ask whether you intended to comply. It asks for records: your processing inventory, your assessments, your notices as they appeared on the day in question, your contracts, and the log of how you answered the individual who complained. We build those records as a by-product of the work, so producing them later is retrieval rather than reconstruction.