Privacy & Data Protection

Personal data sits at the core of every digital business, from user onboarding and payments to analytics and AI. Borders don't limit the GDPR. Any company that offers goods or services to people in the EU, or monitors their behavior, must comply with it, wherever the company is based.

The framework now extends well beyond the GDPR. It includes the ePrivacy rules on cookies and tracking, the Data Governance Act, and the Data Act, which introduces new data-sharing obligations for connected products and cloud services. The AI Act adds rules on the data used to build and run AI systems. Crypto businesses face specific challenges of their own, from reconciling immutable ledgers with data subject rights to handling KYC and travel rule data.

We support EU and non-EU companies, both crypto and non-crypto, in meeting their data protection obligations in Europe. We handle one-off projects, such as a new product launch or a data breach. We also take on ongoing roles, acting as your outsourced DPO or your EU representative.

How we can help

• Outsourced DPO services: acting as Data Protection Officer for EU and non-EU companies, whether the appointment is mandatory or voluntary
• EU representative (Article 27 GDPR): acting as the point of contact in the EU for supervisory authorities and data subjects on behalf of non-EU companies
• GDPR compliance programs: gap analysis, privacy notices, records of processing activities, legitimate interest assessments, consent mechanisms and data subject request procedures
• DPIAs: impact assessments for high-risk processing such as AI systems, blockchain applications, biometric data and large-scale profiling, including prior consultation with supervisory authorities where required
• Blockchain, crypto and privacy-enhancing technologies: on-chain data and the right to erasure, KYC and travel rule data, zero-knowledge proofs and other privacy-by-design solutions
• International data transfers: EU–US Data Privacy Framework, standard contractual clauses, transfer impact assessments and binding corporate rules, including transfers to and from the UK
• Data breach response: incident assessment, notifications to authorities and individuals, handling of regulatory investigations and incident response plans
• Vendors and employee data: data processing agreements and vendor assessments, workplace monitoring, background checks and retention of HR data
• Data Act and EU digital data laws: data-sharing obligations for connected products, cloud switching rules, the Data Governance Act, cookie audits and consent management under the ePrivacy rules, and the data provisions of the AI Act

Serving companies inside and outside the EU

Many non-EU companies don't realize that the GDPR applies to them. If you target users in the EU or monitor their behavior, you are generally required to appoint an EU representative under Article 27. In some cases you must also appoint a DPO, even without any office in Europe. This applies when your core activities involve large-scale, regular and systematic monitoring of individuals, or large-scale processing of sensitive data. Crypto platforms that monitor transactions or profile users can fall into this category.

We act as outsourced DPO or as Article 27 representative, depending on what your company needs. We become your point of reference for European data protection matters: we deal with supervisory authorities, respond to data subjects and keep your documentation current. When your business is also subject to privacy laws outside Europe, such as the CCPA in California or the LGPD in Brazil, we coordinate with local counsel so that your compliance program works across jurisdictions.

Our approach

We aim for data protection that is proportionate and practical. That means documents your team can actually use and processes that fit how you operate. It also means advice that helps you launch products rather than blocking them. Done well, data protection is not just a legal obligation but a way to earn the trust of users and business partners.