--- title: Four Steps to Building a Data Privacy Program description: Companies must develop programs to bulk up security related to maintaining the privacy of customer information. Data privacy programs are essential. image: https://blog.linksquares.com/hubfs/Copy%20of%20General_Thumbnail%20copy.png --- [Skip to content](https://blog.linksquares.com/building-a-data-privacy-program#main-content) [LinkSquares](https://blog.linksquares.com/) Open Mobile Menu [LinkSquares](https://linksquares.com/) Close Mobile Menu [Why LinkSquares](https://linksquares.com/why-linksquares/) [Products](https://linksquares.com/products/) --- [The LinkSquares Cloud One platform for all your in-house legal needs](https://linksquares.com/products/linksquares-cloud/) --- Contract Lifecycle Management Create, review, manage and sign contracts Legal Project Management Centralize your work and keep projects moving Cross-product capabilities Get scalability, efficiency and connectivity LinkSquares Onboarding Experience A step by step guide to get started today --- [Solutions](https://linksquares.com/solutions/) [Customer Stories](https://linksquares.com/customers/) Resources Content [LinkSquares+ Content curated for in-house leaders](https://linksquares.com/plus/) [The Library](https://linksquares.com/library/) In the studio [Demo Library](https://linksquares.com/demo-library/) Community & Events [Customer Stories](https://linksquares.com/customers/) [Events & Webinars](https://linksquares.com/events/) Learning [Blog](https://blog.linksquares.com/) [In-House Insights](https://linksquares.com/inhouse-insights/) [Knowledge Base](https://help.linksquares.com/) [Events](https://linksquares.com/events/) [About Us](https://linksquares.com/about-us/) [Careers](https://linksquares.com/careers/) [Press](https://blog.linksquares.com/tag/linksquares-news-press) [Pricing](https://linksquares.com/pricing/) [Request a demo](https://linksquares.com/demo-request/) Back Close Mobile Menu [Contract Lifecycle Management](https://linksquares.com/products/) [Finalize Streamline your contract creation process](https://linksquares.com/products/finalize/) [Sign Get your contracts executed faster](https://linksquares.com/products/sign/) [Analyze Your post-signature analytics & repository](https://linksquares.com/products/analyze/) [CLM Suite One platform to rule them all](https://linksquares.com/products/) [Request a demo](https://linksquares.com/demo-request/) Back Close Mobile Menu [Legal Project Management](https://linksquares.com/products/) [Prioritize Manage, track, and report on legal work in one place](https://linksquares.com/products/prioritize/) [Request a demo](https://linksquares.com/demo-request/) Back Close Mobile Menu [Cross-product capabilities](https://linksquares.com/products/) [LinkAI Predictive and generative AI](https://linksquares.com/products/analyze/features/ai/) [Integrations Connect the tools you love](https://linksquares.com/integrations/) [Reporting Improve your teams efficiency with KPIs](https://linksquares.com/products/analyze/features/dashboard/) [API Integrate with any third-party app](https://linksquares.com/integrations/linksquares-api/) [Request a demo](https://linksquares.com/demo-request/) Back Close Mobile Menu [Cross-product capabilities](https://linksquares.com/products/) [Onboarding We're here for you from day one](https://linksquares.com/onboarding-services/) [Services Short on time? We can help!](https://linksquares.com/services/) [Support Get answers to all of your technical questions](https://linksquares.com/contact-us/) [Request a demo](https://linksquares.com/demo-request/) [LinkSquares](https://linksquares.com/) - [Why LinkSquares](https://linksquares.com/why-linksquares/) - Products ![](https://images.ctfassets.net/a3hff24q6nt8/104udRs2GzBis3lVOIsQfq/24c371c6c0463777709a98a8bd89cc8c/Image.png) Introducing: Agentic AI for Contract Management Search, edit, and create contracts like never before. [Learn more](https://linksquares.com/agentic-ai/) Contract Lifecycle Management Create, review, manage and sign contracts Legal Project Management Centralize your work and keep projects moving Unified Capabilities Get scalability, efficiency and connectivity LinkSquares Onboarding Experience A step by step guide to get started quickly [Finalize Streamline your contract creation process](https://linksquares.com/products/finalize/) [Sign Get your contracts executed faster](https://linksquares.com/products/sign/) [Analyze Your post-signature analytics & repository](https://linksquares.com/products/analyze/) [CLM Suite One platform to rule them all](https://linksquares.com/products/) [Prioritize Manage, track, and report on legal work in one place](https://linksquares.com/products/prioritize/) [LinkAI Predictive and generative AI](https://linksquares.com/ai/) [Agentic AI Smarter contracting with a multi-agent approach](https://linksquares.com/agentic-ai/) [Integrations Connect the tools you love](https://linksquares.com/integrations/) [Reporting Improve your teams efficiency with KPIs](https://linksquares.com/products/analyze/features/dashboard/) [API Integrate with any third-party app](https://linksquares.com/integrations/linksquares-api/) [Onboarding We're here for you from day one](https://linksquares.com/onboarding-services/) [Services Short on time? We can help!](https://linksquares.com/services/) [Support Get answers to all of your technical questions](https://linksquares.com/contact-us/) - Solutions Use Cases [Crisis Management](https://linksquares.com/solutions/crisis-management/) [Contract Review](https://linksquares.com/solutions/contract-review/) [Contract Storage](https://linksquares.com/solutions/contract-storage/) [Data Privacy & Compliance](https://linksquares.com/solutions/data-privacy-compliance/) [Deal Acceleration](https://linksquares.com/solutions/deal-acceleration/) [Mergers & Acquisitions](https://linksquares.com/solutions/fundraising-and-ma/) [Vendor Management](https://linksquares.com/solutions/vendor-management/) --- DEPARTMENTS [Legal](https://linksquares.com/solutions/linksquares-for-legal/) [Procurement](https://linksquares.com/solutions/linksquares-for-procurement/) [Sales](https://linksquares.com/solutions/linksquares-for-sales/) - Resources Content [LinkSquares+ Content curated for in-house leaders](https://linksquares.com/plus/) [The Library](https://linksquares.com/library/) Community & Events [Customer Stories](https://linksquares.com/customers/) [Events & Webinars](https://linksquares.com/events/) In the studio [Demo Library](https://linksquares.com/demo-library/) Learning [Blog](https://blog.linksquares.com/) [In-House Insights](https://linksquares.com/inhouse-insights/) [Knowledge Base](https://help.linksquares.com/) [![](https://blog.linksquares.com/hubfs/Navigation/website-menu-navigation-hs-risk-scoring.png)](https://linksquares.com/events/product-spotlight-webinar-risk-revolution/) - Company [About Us](https://linksquares.com/about-us/) [Careers](https://linksquares.com/careers/) [Events](https://linksquares.com/events/) [Partner Program](https://linksquares.com/partners/) [Press](https://blog.linksquares.com/tag/linksquares-news-press) - [Pricing](https://linksquares.com/pricing/) - [Login](https://app.linksquares.com/) - [Request a demo](https://linksquares.com/demo-request/) ![data privacy](https://blog.linksquares.com/hs-fs/hubfs/Copy%20of%20General_Header%20(1)%20copy.png?width=575&name=Copy%20of%20General_Header%20(1)%20copy.png) [Tim Parilla](https://blog.linksquares.com/author/tim-parilla) Sep 02, 2022 10 min read # Four Steps to Building a Data Privacy Program Digital transformation has come for all organizations; it doesn’t discern between industries, and it doesn’t care if your organization is a fledgling startup or an established multinational corporation. Emerging technologies such as virtual reality and artificial intelligence present unique business needs and challenges. One of the most demanding is the requirements on companies and governments to protect user data and privacy in an ever-changing technological environment. [A 2020 global survey](https://legaljobs.io/blog/privacy-statistics/#:~:text=Privacy%20Statistics%20%5BEditor's%20Choice%5D,users%20change%20their%20passwords%20regularly.)found that two-thirds are more concerned with online privacy than ever, and over 80% believe that their personal information is vulnerable to hackers. These concerns have caught the attention of state legislatures around the country. Many states are passing laws governing how corporations collect and use the customer information gathered in connection with the offering of goods and services on the internet. From state to state, the laws have meaningful variations and inconsistencies, creating a patchwork of regulations that can be challenging for corporations to navigate. In response, companies must develop programs to bulk up security and controls related to maintaining the privacy of customer information, and in-house legal teams must prioritize addressing the challenges that the inconsistent regular landscape creates. Companies are proactively establishing data privacy programs, and general counsels (GCs) and legal leaders are playing a prominent role. Legal teams are critical inputs in the battle to protect data and ensure companies can respond to regulatory changes. Legal professionals must drive successful cybersecurity initiatives and help provide peace of mind to customers regarding the company’s protection of customer data and privacy. For GCs and in-house legal teams operationalizing data privacy efforts, there are four essential best practices to follow. ## Understand and Organize Your Data Step one is to understand what kind of data you collect and categorize it by sensitivity and severity levels in the event of a data breach. Knowing what information is in the company’s possession allows the legal team to understand the scope of risk in case of a breach or a data leak. This also will help the company understand how any laws and regulations regarding data storage and breach notification may impact the company’s responsibilities. For example, companies that collect contact information, such as a user handle and an email address, face a different risk profile from those collecting Social Security numbers and banking information (think of the difference between the local newspaper that makes you create an account using your email address to read an article versus the online portal you use to submit documentation in connection with obtaining a mortgage). The risk profile and the regulatory responsibilities differ depending on the jurisdiction in which the customer/user is located, the type of information collected, and the way the company uses that information. Once the legal team has a clear understanding of the scope and methods of collection of user data collected by the company, the legal team can plan the appropriate to protect against, and if necessary, respond to, any breach or leak of that user data. ## Find Your Allies The next step is identifying other leaders within the organization who can help execute the vision for building/enhancing your data privacy program. An excellent place to start is with the IT team and software engineers, as these teammates are absolutely necessary (and really, the true heroes) to any successful data privacy initiatives. Work together to establish response protocols for various scenarios, including protection against outside hackers, internal leaks, inadvertent disclosure, etc. Outline potential security scenarios and determine whether your organization is vulnerable, both from an infrastructure level and from a platform level. What are the employee touchpoints with your systems? Who has access to data? What controls do you have in place for the tracking and use of sensitive information? What are any other areas of technical risk? [![elevate your legal brand ](https://no-cache.hubspot.com/cta/default/6934676/bbc01c2d-e446-4d89-8060-65b25e867c2b.png)](https://cta-redirect.hubspot.com/cta/redirect/6934676/bbc01c2d-e446-4d89-8060-65b25e867c2b) ## Establish a Hierarchy Once the core team is in place, appropriate lines of accountability for the deployment and success of your privacy and security program must be established. Compliance issues and data breaches are inevitable, but setting clear accountability will provide a driver who will direct and facilitate a swift, appropriate response to limit the scope and scale of any breach and remediate any issues resulting from the breach. Once a leader is identified, the team should understand any gaps between what precautions and controls are currently in place regarding data security and what those precautions and controls should look like as the program reaches maturity. From there, the team should meet regularly to assess the progress of privacy initiatives and identify new opportunities for improvement. ## Keep the Pressure on Finally, it goes without saying that the privacy program should continue to be a priority for the organization. The senior leadership in the organization should be regularly reminded of the program’s progress, and the key executives should consistently reiterate the importance of prioritizing the continued development and maturation of any privacy program. Conduct regular tabletop exercises several times a year using real-life scenarios to measure the company’s readiness and provide the response team with the opportunity to evaluate what worked well and what can/should be improved. These should feel like a fire drill, run with little to no notice. Simulating a real-world incident to the maximum extent of safety possible will expose any weaknesses in processes, controls, staffing execution and expertise. Remember: Data privacy programs are ongoing efforts. Taking a set-and-forget approach will expose the company on many levels, from incurring regulatory fines to irreparably damaging the company’s relationship with customers. ## Planning for the Inevitable When it comes to managing a data breach, it’s similar to most other problems you’ll face as an in-house attorney. Rarely is it the first mistake that kills you; it’s the tenth. Not only will incidents happen, but some organizations may not realize a breach is occurring until the violation has already occurred. Knowing how to respond at each point in the incident to direct a positive outcome is just as crucial as taking appropriate precautions to prevent an incident from occurring in the first place. For the lawyers out there, always be aware of your contractual obligations in the event of a data breach. What constitutes a “data breach”? What are the company’s notice requirements to vendors and customers? Managing your executed contracts in an organized and easily searchable way is critical to your speed in response, and cutting-edge post-signature solutions may just be the difference between facing a lawsuit and maintaining a positive customer/vendor relationship. The regulatory environment will continue to change, and the agreements with the company’s customers and vendors will reflect those changes over time. Be prepared for the data breach, know your contractual obligations, and focus on proactively managing your relationships with critical customers and suppliers. Data breaches will inevitably happen at some level or the next, and successful responses and remediations will be greatly advanced by maintaining a healthy relationship with those most likely to be affected by a data breach. The bottom line when establishing a data privacy program is: to contain, remediate, focus on relationships, and understand your legal obligations to your customers. This article was originally published on [law.com](https://www.law.com/corpcounsel/2022/08/16/four-steps-to-building-a-data-privacy-program/).  ![avatar](https://blog.linksquares.com/hs-fs/hubfs/tim%20circle.png?width=290&name=tim%20circle.png) #### [Tim Parilla](https://blog.linksquares.com/author/tim-parilla) Tim Parilla is the Chief Legal Officer at LinkSquares. ## Subscribe to the LinkSquares Blog Stay up to date on best practices for GCs and legal teams, current events, legal tech, and more. ## Related Articles ### [Alyssa Verzino Sep 28, 2022 8 min read The Modern GC: A Business Leader with a Legal Background The General Counsel (GC) role is evolving, serving as an opportunity for organizational growth. On a recent episode of Cockpit ... Start Reading](https://blog.linksquares.com/the-modern-gc-business-leader) ### [Christina Sullivan Oct 12, 2022 3 min read How to Create a Data Privacy Program Cyber attacks have doubled over the past two years, and they continue to be on the rise. This has caused an interesting ... Start Reading](https://blog.linksquares.com/how-to-create-a-data-privacy-program) ### [LinkSquares Team Sep 15, 2022 6 min read CLM for Cybersecurity: How Contract Management Helps Protect Your Business Every business is at risk of a cybersecurity attack, even yours. Start Reading](https://blog.linksquares.com/clm-for-cybersecurity) - [Products](https://linksquares.com/products) - [LinkSquares Cloud](https://linksquares.com/products/linksquares-cloud/) - [Prioritize](https://linksquares.com/products/prioritize/) - [Finalize](https://linksquares.com/products/finalize) - [Sign](https://linksquares.com/products/sign) - [Analyze](https://linksquares.com/products/analyze) - [Full Suite](https://linksquares.com/products) - [Integrations](https://linksquares.com/integrations) - [Reporting](https://linksquares.com/products/analyze/features/dashboard/) - [API](https://linksquares.com/integrations/linksquares-api/) - [LinkAI](https://linksquares.com/ai/) - [Agentic AI](https://linksquares.com/agentic-ai/) - [Services](https://linksquares.com/services/) - [Solutions](https://linksquares.com/solutions) - [Crisis Management](https://linksquares.com/solutions/crisis-management/) - [Contract Review](https://linksquares.com/solutions/contract-review/) - [Contract Storage](https://linksquares.com/solutions/contract-storage/) - [Data Privacy & Compliance](https://linksquares.com/solutions/data-privacy-compliance/) - [Deal Acceleration](https://linksquares.com/solutions/deal-acceleration/) - [Mergers & Acquisitions](https://linksquares.com/solutions/fundraising-and-ma/) - [Vendor Management](https://linksquares.com/solutions/vendor-management/) - Departments - [Legal](https://linksquares.com/solutions/linksquares-for-legal/) - [Procurement](https://linksquares.com/solutions/linksquares-for-procurement/) - [Sales](https://linksquares.com/solutions/linksquares-for-sales/) - [Resources](https://linksquares.com/library) - [LinkSquares+](https://linksquares.com/plus) - [Blog](https://blog.linksquares.com/) - [Cockpit Counsel](https://linksquares.com/cockpit-counsel-series) - [Customer Stories](https://linksquares.com/customers) - [Demo Library](https://linksquares.com/demo-library) - [Events & Webinars](https://linksquares.com/events) - [In-House Insights](https://linksquares.com/inhouse-insights/) - [Knowledge Base](https://help.linksquares.com/) - [The Library](https://linksquares.com/resources) - Company - [About Us](https://linksquares.com/about-us) - [Careers](https://linksquares.com/careers) - [Contact Us](https://linksquares.com/contact-us/) - [Onboarding](https://linksquares.com/onboarding-services/) - [Partner Program](https://linksquares.com/partners) - [Pricing](https://linksquares.com/pricing/) - [Press](https://blog.linksquares.com/tag/linksquares-news-events) - [Recognition](https://linksquares.com/recognition/) - [Support](mailto:support@linksquares.com) - [Why LinkSquares](https://linksquares.com/why-linksquares/) #### LINKSQUARES, INC. 60 State St. Suite 1200 Boston, MA 02109 [617-681-8552](tel:617-681-8552) [salesinfo@linksquares.com](mailto:salesinfo@linksquares.com) © 2026 LinkSquares, Inc. - [SaaS Terms of Service](https://linksquares.com/saas-terms-of-service/) - [Privacy](https://linksquares.com/privacy-policy/) - [Security](https://linksquares.com/security/) - [Status](https://linksquares.statuspage.io/) - [Your Privacy Choices](https://go.linksquares.com/linksquares-do-not-sell-or-share-personal-data) - ![aicpa soc 2](https://blog.linksquares.com/hs-fs/hubfs/soc2_66933e61%20copy.png?width=100&height=100&name=soc2_66933e61%20copy.png) - ![barr certification](https://blog.linksquares.com/hs-fs/hubfs/Frame%201921.png?width=129&height=57&name=Frame%201921.png) ```json { "@context" : "http://schema.org", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "United States", "addressLocality" : "Boston", "addressRegion" : "MA", "postalCode" : "02109", "streetAddress" : "60 State Street" }, "knowsLanguage" : "en", "logo" : { "@type" : "ImageObject", "url" : "https://6934676.fs1.hubspotusercontent-na1.net/hubfs/6934676/Navigation/logo_643dd1b1.svg" }, "name" : "LinkSquares", "url" : "https://blog.linksquares.com/building-a-data-privacy-program" } ``` ```json { "@context" : "http://schema.org", "@type" : "BlogPosting", "abstract" : "Companies must develop programs to bulk up security related to maintaining the privacy of customer information. Data privacy programs are essential.", "author" : { "@type" : "Person", "name" : "Tim Parilla" }, "dateModified" : "2022-09-02T13:00:01Z", "datePublished" : "2022-09-02T13:00:00Z", "headline" : "Four Steps to Building a Data Privacy Program", "image" : "https://6934676.fs1.hubspotusercontent-na1.net/hubfs/6934676/Copy%20of%20General_Thumbnail%20copy.png", "inLanguage" : "en", "keywords" : "[Security & Data Privacy]", "mainEntityOfPage" : { "@type" : "WebPage" }, "name" : "Four Steps to Building a Data Privacy Program", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://6934676.fs1.hubspotusercontent-na1.net/hubfs/6934676/Navigation/logo_643dd1b1.svg" }, "name" : "LinkSquares" }, "text" : "Digital transformation has come for all organizations; it doesn’t discern between industries, and it doesn’t care if your organization is a fledgling startup or an established multinational corporation. Emerging technologies such as virtual reality and artificial intelligence present unique business needs and challenges. One of the most demanding is the requirements on companies and governments to protect user data and privacy in an ever-changing technological environment. A 2020 global survey found that two-thirds are more concerned with online privacy than ever, and over 80% believe that their personal information is vulnerable to hackers. These concerns have caught the attention of state legislatures around the country. Many states are passing laws governing how corporations collect and use the customer information gathered in connection with the offering of goods and services on the internet. From state to state, the laws have meaningful variations and inconsistencies, creating a patchwork of regulations that can be challenging for corporations to navigate. In response, companies must develop programs to bulk up security and controls related to maintaining the privacy of customer information, and in-house legal teams must prioritize addressing the challenges that the inconsistent regular landscape creates. Companies are proactively establishing data privacy programs, and general counsels (GCs) and legal leaders are playing a prominent role. Legal teams are critical inputs in the battle to protect data and ensure companies can respond to regulatory changes. Legal professionals must drive successful cybersecurity initiatives and help provide peace of mind to customers regarding the company’s protection of customer data and privacy. For GCs and in-house legal teams operationalizing data privacy efforts, there are four essential best practices to follow. Understand and Organize Your Data Step one is to understand what kind of data you collect and categorize it by sensitivity and severity levels in the event of a data breach. Knowing what information is in the company’s possession allows the legal team to understand the scope of risk in case of a breach or a data leak. This also will help the company understand how any laws and regulations regarding data storage and breach notification may impact the company’s responsibilities. For example, companies that collect contact information, such as a user handle and an email address, face a different risk profile from those collecting Social Security numbers and banking information (think of the difference between the local newspaper that makes you create an account using your email address to read an article versus the online portal you use to submit documentation in connection with obtaining a mortgage). The risk profile and the regulatory responsibilities differ depending on the jurisdiction in which the customer/user is located, the type of information collected, and the way the company uses that information. Once the legal team has a clear understanding of the scope and methods of collection of user data collected by the company, the legal team can plan the appropriate to protect against, and if necessary, respond to, any breach or leak of that user data. Find Your Allies The next step is identifying other leaders within the organization who can help execute the vision for building/enhancing your data privacy program. An excellent place to start is with the IT team and software engineers, as these teammates are absolutely necessary (and really, the true heroes) to any successful data privacy initiatives. Work together to establish response protocols for various scenarios, including protection against outside hackers, internal leaks, inadvertent disclosure, etc. Outline potential security scenarios and determine whether your organization is vulnerable, both from an infrastructure level and from a platform level. What are the employee touchpoints with your systems? Who has access to data? What controls do you have in place for the tracking and use of sensitive information? What are any other areas of technical risk? Establish a Hierarchy Once the core team is in place, appropriate lines of accountability for the deployment and success of your privacy and security program must be established. Compliance issues and data breaches are inevitable, but setting clear accountability will provide a driver who will direct and facilitate a swift, appropriate response to limit the scope and scale of any breach and remediate any issues resulting from the breach. Once a leader is identified, the team should understand any gaps between what precautions and controls are currently in place regarding data security and what those precautions and controls should look like as the program reaches maturity. From there, the team should meet regularly to assess the progress of privacy initiatives and identify new opportunities for improvement. Keep the Pressure on Finally, it goes without saying that the privacy program should continue to be a priority for the organization. The senior leadership in the organization should be regularly reminded of the program’s progress, and the key executives should consistently reiterate the importance of prioritizing the continued development and maturation of any privacy program. Conduct regular tabletop exercises several times a year using real-life scenarios to measure the company’s readiness and provide the response team with the opportunity to evaluate what worked well and what can/should be improved. These should feel like a fire drill, run with little to no notice. Simulating a real-world incident to the maximum extent of safety possible will expose any weaknesses in processes, controls, staffing execution and expertise. Remember: Data privacy programs are ongoing efforts. Taking a set-and-forget approach will expose the company on many levels, from incurring regulatory fines to irreparably damaging the company’s relationship with customers. Planning for the Inevitable When it comes to managing a data breach, it’s similar to most other problems you’ll face as an in-house attorney. Rarely is it the first mistake that kills you; it’s the tenth. Not only will incidents happen, but some organizations may not realize a breach is occurring until the violation has already occurred. Knowing how to respond at each point in the incident to direct a positive outcome is just as crucial as taking appropriate precautions to prevent an incident from occurring in the first place. For the lawyers out there, always be aware of your contractual obligations in the event of a data breach. What constitutes a “data breach”? What are the company’s notice requirements to vendors and customers? Managing your executed contracts in an organized and easily searchable way is critical to your speed in response, and cutting-edge post-signature solutions may just be the difference between facing a lawsuit and maintaining a positive customer/vendor relationship. The regulatory environment will continue to change, and the agreements with the company’s customers and vendors will reflect those changes over time. Be prepared for the data breach, know your contractual obligations, and focus on proactively managing your relationships with critical customers and suppliers. Data breaches will inevitably happen at some level or the next, and successful responses and remediations will be greatly advanced by maintaining a healthy relationship with those most likely to be affected by a data breach. The bottom line when establishing a data privacy program is: to contain, remediate, focus on relationships, and understand your legal obligations to your customers. This article was originally published on law.com.", "url" : "https://blog.linksquares.com/building-a-data-privacy-program", "wordCount" : "1378" } ```