Graves Legal LLC
Schedule a consultation
All practice areas

Data Privacy

Privacy policies, data handling, and compliance for the information your business collects.

What This Covers

The starting point is how your business handles information: what it collects, where it goes, which vendors and tools touch it, and whether the privacy policy on your site accurately describes those practices.

From there, the work typically includes privacy policies, mapping how data moves through the business, reviewing vendor data processing agreements, determining which state privacy laws apply, and planning how you would respond to a data breach.

How the Work Starts

With a first conversation about what information your business collects and where it goes. A list of the tools and vendors you use is a helpful start. See how engagements work.

What Shapes the Scope

Cost depends on the kinds of information involved, the states where your customers are, and the number of vendor agreements to review.

Questions people ask

Questions About
Data Privacy

Quick answers to the things owners ask before they call.

If you collect personal information through a website or app, almost certainly yes. Several state laws require one, as do many platforms and service providers businesses rely on. Regulators also enforce against policies that don’t match actual practice, so an inaccurate policy can be worse than a generic one.

It depends on where your customers are, what information you collect, how much of it, and whether you sell or share it. A growing number of states have comprehensive privacy laws with different thresholds, and sector-specific laws cover health, financial, and children’s information. Sorting out which ones apply is the first step.

A template describes someone else’s practices. Your policy has to describe yours: what you actually collect, who you share it with, and how people can exercise their rights. Starting with how your business really handles information is what makes the policy accurate.

Move quickly. State breach notification laws set deadlines and requirements for notifying affected people and sometimes regulators. Contain the problem, preserve the evidence, and involve counsel early. Having a response plan before anything happens makes those first days far less chaotic.

Yes. Many privacy laws require specific terms in contracts with vendors that handle personal information for you, and vendors are a common source of breaches. Reviewing those agreements is often the most practical step a business can take.

Explore Other
Practice Areas

See all practice areas