SunCrest Law / Fractional counsel / Data privacy
A privacy program is a workflow, not a document.
Most privacy programs are a notice written some years ago and a cookie banner somebody installed. That holds until the first access request arrives from a jurisdiction with a deadline, or until someone asks what data you are actually holding and for how long.
Who this is for
- Your privacy notice predates the state privacy laws now in force.
- Access and deletion requests arrive and get handled ad hoc, or not at all.
- You transfer personal data across borders without a documented mechanism.
- Nobody can say with confidence what your retention rules are.
What this program addresses
This program rebuilds the whole stack: the public documents, the consent infrastructure behind them, the request-handling workflow, and the retention rules that determine what you are exposed to in the first place. The output is a program your team can run without calling a lawyer every time a request comes in.
The retention piece is the one companies skip and the one that pays for itself. Data you no longer hold is data you cannot lose, cannot be compelled to produce, and cannot be asked to delete.
What you get
Every item below is a document or a working process delivered to your team — not a memo describing what one would look like.
- Document suite
Privacy notice, terms of use, cookie policy, and DMCA policy, drafted as a coherent set rather than four documents that contradict each other.
- Consent management specification
Platform selection, banner behavior by jurisdiction, and handling of Global Privacy Control and Do Not Track signals, written so engineering can implement it.
- Request-handling workflow
Intake, identity verification, authorized-agent handling, response templates, and tracking that produces a defensible record.
- Retention and deletion schedule
By data category, with tax, employment, and regulatory carve-outs mapped so deletion does not create a different problem.
- Cross-border transfer assessment
Mechanisms for each transfer route, and the agreements to paper them where they are required.
- Marketing compliance review
TCPA and CAN-SPAM exposure in current campaigns, with remediation priorities.
After the program
Ongoing request handling, annual notice review, new-jurisdiction assessments as you expand, and vendor diligence on processors.
Ongoing work is arranged separately once the program is complete, so the decision to continue is made with the finished product in hand rather than at the outset.
Relevant experience
Led global privacy program modernization for a publicly traded company across the EU–U.S. Data Privacy Framework, GDPR, UK GDPR, and the U.S. state patchwork. CIPP/US, CIPP/E, and IAPP Fellow of Information Privacy. Published on EU data transfers in the Utah Bar Journal, on China's personal information law, and co-authored a third-country assessment for OneTrust DataGuidance.
How this is priced
This program is quoted as a fixed fee, agreed in writing before any work begins. The scoping call that produces the quote is free and carries no obligation. Where a matter genuinely does not suit a fixed fee, we say so upfront rather than letting you discover it at the first invoice.
A scoping call, then a fixed fee.
Bring the messy version. Thirty minutes is usually enough to tell whether this is a program engagement, a smaller piece of work, or something you should handle another way — and we will say so either way.