Expertise · Privacy and data governance
Data Privacy, GDPR and AI Governance Expert
Privacy and AI disputes require more than policy language. A defensible assessment maps what personal data entered a system, where it was processed, who could access it, how long it was retained and whether the configured technical controls match the legal and contractual account.
Questions for expert analysis
- Did an AI system or software platform process personal data?
- Where was data stored or processed, and did it cross borders?
- Which users, vendors or subprocessors could access it?
- Do retention, deletion, permission and security settings match the stated policy?
- Does the alleged privacy harm match the technical data flow?
Evidence reviewed
- System architecture and end-to-end data-flow maps
- AI tool configuration, prompts, input records and output handling
- Vendor terms, data-processing agreements and subprocessor records
- Access logs, permissions, retention settings and deletion evidence
- Processing locations, data-residency controls and cross-border transfer records
- GDPR, privacy and incident-response documentation
Legal-technical focus
The analysis connects GDPR, data-protection and data-residency questions to the systems that actually collected, transmitted, stored or exposed the information. It can identify gaps between contracts, policies, vendor claims and technical reality.
Public sources
Engagement-specific evidence is reviewed under appropriate confidentiality and scope controls.
For counsel
Discuss the technical record.
Engagements are subject to conflicts and scope review. Initial enquiries are treated as confidential.
Contact Leo Herps ↗