SunCrest Law / Services / Data privacy
A privacy program is a workflow, not a document.
Most privacy programs are a notice written some years ago and a cookie banner somebody installed. That holds until the first access request arrives from a jurisdiction with a deadline, or until someone asks what data you are actually holding and for how long.
- Your privacy notice predates the state privacy laws now in force.
- Access and deletion requests arrive and get handled ad hoc, or not at all.
- You transfer personal data across borders without a documented mechanism.
- Nobody can say with confidence what your retention rules are.
This program rebuilds the whole stack: the public documents, the consent infrastructure behind them, the request-handling workflow, and the retention rules that determine what you are exposed to in the first place. The output is a program your team can run without calling a lawyer every time a request comes in.
The retention piece is the one companies skip and the one that pays for itself. Data you no longer hold is data you cannot lose, cannot be compelled to produce, and cannot be asked to delete.
What you get
Every item below is a document or a working process delivered to your team — not a memo describing what one would look like.
-
01
Document suite
Privacy notice, terms of use, cookie policy, and DMCA policy, drafted as a coherent set rather than four documents that contradict each other.
-
02
Consent management specification
Platform selection, banner behavior by jurisdiction, and handling of Global Privacy Control and Do Not Track signals, written so engineering can implement it.
-
03
Request-handling workflow
Intake, identity verification, authorized-agent handling, response templates, and tracking that produces a defensible record.
-
04
Retention and deletion schedule
By data category, with tax, employment, and regulatory carve-outs mapped so deletion does not create a different problem.
-
05
Cross-border transfer assessment
Mechanisms for each transfer route, and the agreements to paper them where they are required.
-
06
Marketing compliance review
TCPA and CAN-SPAM exposure in current campaigns, with remediation priorities.
Ongoing request handling, annual notice review, new-jurisdiction assessments as you expand, and vendor diligence on processors.
Ongoing work is arranged separately once the program is complete, so the decision to continue is made with the finished product in hand rather than at the outset.
Led global privacy program modernization for a publicly traded company across the EU–U.S. Data Privacy Framework, GDPR, UK GDPR, and the U.S. state patchwork. CIPP/US, CIPP/E, and IAPP Fellow of Information Privacy. Published on EU data transfers in the Utah Bar Journal, on China's personal information law, and co-authored a third-country assessment for OneTrust DataGuidance.
How this is priced
This program is quoted as a fixed fee, agreed in writing before any work begins. The scoping call that produces the quote is free and carries no obligation. Where a matter genuinely does not suit a fixed fee, that is said upfront rather than discovered at the first invoice.