Privacy, Digital and AI
Personal data, technological services, and artificial intelligence systems enter business processes through contracts and organizational decisions. The legal assessment must understand how the tools are used, what information they involve, and who makes the decisions.
Start with actual data processing and tools
Data protection isn't limited to information notices. It's important to know what information a company collects, for what purposes, who uses it, where it's stored, and with which vendors it's shared. Let's start with the actual processes: customers, staff, marketing, website, applications, and digital services.
The audit identifies roles, processing bases, retention periods, access, and necessary documentation. Legal and organizational measures must be coordinated with technical measures, entrusted to competent professionals, and proportionate to the nature of the processing.
Documents, suppliers and authorized persons
We assist in reviewing information notices, agreements with data processors, instructions, records, and procedures required by the scope of the assignment. A document is useful if it accurately describes the process and is implemented; text copied from other organizations can create inconsistencies.
For cloud services and platforms, we review contractual conditions, subcontractors, data transfers, retention, restitution, and deletion. For personnel, we also consider their interaction with labor regulations and the tools that can enable controls.
Website, marketing and digital activity
Contact forms, newsletters, analytics tools, cookies, and profiling require a coordinated analysis of the user's purposes, information, and choices. This work includes legal verification of data flows and documents, in coordination with those who create the website or configure the platforms.
In digital contracts, we examine the scope of the service, support levels, data availability, liability, security, continuity, and provider termination. The technical choice must be accompanied by clear rules regarding what happens during the relationship and upon its termination.
Artificial intelligence in business
Before introducing an AI tool, it's necessary to identify its intended use, the data entered, the recipients of the results, and the company's role. We evaluate the contractual, confidentiality, intellectual property, data protection, and applicable regulations for the systems used. Obligations depend on the characteristics, role, and specific use.
The work may include internal usage criteria, rules on acceptable data, results verification, decision-making responsibilities, and training consistent with the project. A policy does not replace the examination of the individual tool and does not automatically authorize every processing or use of the content produced.
Incidents and data subject requests
Data loss, unauthorized access, or transmission to the wrong recipient requires promptness and coordination. We reconstruct the facts, the data involved, the measures taken, and the risks to individuals, assessing documentation, communication, and notification obligations within the applicable timeframes.
For example, a department wants to enter customer documents into an AI service. Before use, the data, purpose, provider conditions, and alternatives must be checked. This example is illustrative; the absence of obvious names does not in itself prove that the documents are anonymous.
Where do we start?
A list of systems and vendors, policies and agreements in use, a process map, any logs, policies, and communications received are useful. For an incident, a history and available technical information are also required. We define priorities, documents to update, and actions to assign to the appropriate managers.
Frequently asked questions
Is consent always required?
The legal basis must be identified for each processing operation.
Does purchasing a compliant service make the company compliant?
Configuration and usage methods must also be evaluated.
Can AI be used with personal data?
A case-by-case assessment is required, not a generic authorization.
Related services