Technology law
Privacy and data protection
Data protection concerns how an organisation collects, uses, stores and shares information about individuals. We help businesses and professionals apply the GDPR and Italian law, aligning documentation with the activities actually carried out.
When a privacy review is useful
Launching a website or online shop, adopting management software, running a marketing campaign or outsourcing services can change how data is processed. A review is also useful for updating existing documents or dealing with an access request, complaint or breach.
The controller determines the purposes and means of processing; a processor handles data on its behalf. Identifying these roles correctly helps determine the relevant agreements and requirements. Consent is one possible legal basis and is not required for every processing operation.
How the firm can help
Processing analysis and organisation
We examine which data is processed, for what purposes, by whom and for how long, to identify priorities and responsibilities.
- Assessment of legal bases, retention periods and collection methods.
- Assistance with records of processing activities, where required, and internal instructions.
- Assessment of the need for a data protection impact assessment (DPIA) and the appointment of a data protection officer (DPO).
Privacy notices, websites and marketing
We draft and review information for customers, staff and users, ensuring it reflects how the services operate.
- Privacy notices and data collection forms, with separate consents where needed.
- Legal assessment of cookies, tracking tools and the associated choice mechanisms.
- Review of the conditions for newsletters, promotions and other marketing communications.
Suppliers and data flows
Choosing a cloud service or platform also requires a review of the chain of parties that can access the data.
- Data processing agreements and allocation of obligations between controllers.
- Review of subcontractors, processing locations and contractual service terms.
- Assessment of transfers outside the European Economic Area and the applicable safeguards.
Individual rights and data breaches
We assist with data subject requests and the legal aspects of incidents involving personal data.
- Procedures for responding to requests for access, rectification, erasure and objection.
- Assessment of data breach documentation, notification and communication obligations.
- Assistance with responses to the Italian data protection authority and disputes concerning data processing.
Documents and initial discussion
Our work may result in a priorities report, privacy notices, processing agreements, procedures and revised documentation. Technical measures are considered from a legal perspective in coordination with IT contacts; technical implementation requires dedicated expertise.
Useful starting documents include a description of your activities, existing privacy notices, a list of services used and contracts with suppliers that process data.