The article
A privacy notice is a promise, and your software either keeps it or breaks it. The Federal Trade Commission (FTC) takes law enforcement action, under Section 5 of the FTC Act, when companies promise consumers to safeguard their personal information and do not live up to it. That is why data privacy compliance services that stop at the notice do half the job.
I have spent 18 years building software, and since 2017 my company of 70+ specialists has delivered 150+ projects. We work on both halves: the facts that decide which laws apply, and the forms, databases, logs and scripts that have to match your notice. Which laws apply and what your notice says are your counsel's decisions; making the system match them is ours.
Data privacy compliance services: the short version
| What | How it works |
|---|---|
| For | Companies under the GDPR, California's privacy law, other state privacy laws or industry rules such as HIPAA |
| We do | The data map, notices checked against the code, consent and opt-outs, rights requests, the technical side of vendor contracts, privacy reviews of new features |
| Your counsel decides | Which laws apply, and what your notices say |
| Price | Set by an estimate before any work; the first call and the rough estimate are free |
| Response time | Within 30 minutes on weekdays, 9-18 Miami time, for a new request |
Which laws apply, and who decides
Which laws apply is a legal question, but the answer is built from facts about your business, and the facts are where we start:
- Where your users are. Users in the EU can bring in the GDPR; our GDPR compliance page has a self-check.
- California. The state Attorney General says its privacy law applies to for-profit businesses that do business in California and meet one of three thresholds: a gross annual revenue above the law's line; buying, selling or sharing personal information about 100,000 or more California residents or households; or earning half or more of their annual revenue from selling it.
- Other states. New state privacy laws keep arriving; your counsel tracks which ones reach you.
- Your industry. Patient data can bring in HIPAA: see HIPAA compliance.
Compliance solutions for data privacy laws start from the same facts, whichever law it is: who your users are, how many, what you collect and whether you sell or share it.
Google showed me five pages for this search in October 2026, two of them from law firms. None mentions the Global Privacy Control, none mentions a data map, and none publishes a price for its own work. Five pages are a small sample, but the signal and the map are the first two things I would check on any site.
The data map: copy these columns
You cannot keep a notice true without knowing what you hold. A data map is that knowledge on one page, a row for each piece of personal data. Copy the columns; the rows are examples:
| Data | Why you collect it | Where it lives | Who can see it | Which vendors get it | How long you keep it |
|---|---|---|---|---|---|
| Email address | Sign-in and receipts | Accounts table, backups | Support | Email delivery service | While the account is open |
| IP address | Security and analytics | Server logs, analytics | Engineers | Analytics provider | As long as the logs |
| Chat messages | Answering customers | Help desk | Support | Help desk vendor | Not decided yet |
Every empty or "not decided" cell is a task. The map also tells you what your notice must mention and where a deletion has to reach.
Privacy built into your software
Collect less, keep it for a shorter time, show it to fewer people: our engineers build those three rules into your forms, databases and logs, so privacy holds when nobody is checking.
- Collect less. A form field with no row in the map goes.
- Keep it shorter. Deletion jobs run on the schedule in the map, and backups expire on a schedule too.
- Show it to fewer people. Access by role, and a short list of admin accounts. Tools for privileged access management, or PAM, help here. PAM solutions support compliance with data privacy regulations only when the list of admin accounts behind them is short and reviewed.
- Logs without personal data where you can, and a short life for the logs that need it.
- Opt-outs the system honors. California's Attorney General says a privacy signal the user turns on in the browser, such as the Global Privacy Control setting, must be honored as a valid opt-out from the selling or sharing of a person's data. If the law covers you, your site has to read that signal.
The best data privacy compliance solutions are the ones your system enforces by itself.
Rights requests: the deadline shapes the design
California gives a business 45 calendar days to answer someone who asks to see, delete or correct their data, and 45 more if it tells the consumer. A request under the GDPR has one month. Both deadlines are easy to miss when an answer needs someone to search five systems by hand. So we build the request into the product: verify the person, find their data in every system on the map, export or delete it, and record what was done.
Four checks before you call anyone
You can see the gap between your notice and your code yourself. Run these on your own site:
- Open it in a private window and, before you click anything, look at the cookies your browser's developer tools show. Anything set before a choice deserves a question.
- Turn on the Global Privacy Control in a browser that offers it, visit your site again and see whether anything about sale or sharing changes.
- Read the list of partners in your notice, then compare it with the third-party requests your pages send in the same developer tools.
- Send your company a deletion request from a test account, and write down how many people and systems it took to answer.
If any answer surprises you, that is where the work starts.
Our work
Privacy laws change often, and the habit that keeps up with change is one we know from PBM Source, compliance software for pharmacy benefit managers. There each new law or regulation arrives on a dashboard as a task with a summary, a jurisdiction and a date, and the team assigns and documents it. A new state privacy law becomes the same kind of task list: changes to notices, forms and request flows.
When someone asks who saw a record, a log should answer. We worked on the backend, the web front end and the mobile API of RxPhoto, a clinical photo platform whose audit log lets administrators show who opened which record and when.
How it goes
- Scope: your users, your data, your vendors and the laws in question, together with your counsel.
- Map: the data map, row by row.
- Gaps: what the notice says, what the code does and what the law asks, side by side.
- Fixes and proof: the code changed, tests that show it holds, and a privacy review before each new feature ships.
Treat data privacy services as regulatory compliance work with deliverables you can check: the map, the fixes, the test results. The estimate depends on how many products, data stores and vendors you have, and on how much of your code has to change to match the map. You have it before work starts. The first call and the rough estimate are free.
Neighboring services
Data management compliance classifies records and deletes them on schedule. Compliance automation collects the evidence by software, and AI consulting helps decide what may go to a hosted AI model and what stays on a model of your own. The full set of compliance services is on our compliance page.
Tell us what data you collect and where your users are. We reply with the laws worth checking with your counsel and a rough estimate, free. Clients rate us 5.0 on Clutch across 26 verified reviews as of September 2026, and not one review is negative.
