Privacy & data security
Privacy and security compliance across the board: state privacy laws, GDPR, COPPA, biometrics, cookies and tracking tech, privacy policies and DPAs, incident response, and ISO 27001 and SOC 2 programs.
Talk with MikeHow MB Legal helps
Privacy compliance and cybersecurity law for technology companies requires someone who understands both the legal framework and the technical reality. MB Legal advises software companies, cybersecurity firms, and tech-service providers on data privacy compliance: COPPA, CCPA and the broader set of U.S. state privacy laws, biometric data regulations, children’s privacy beyond age gates, and the growing set of state AI statutes that touch data privacy directly, including wiretapping and CIPA exposure from cookies, website tracking pixels, AI transcription, and chatbot tools, state chatbot-disclosure laws, and Florida’s developing AI framework as it takes shape. For companies with users or operations abroad, that work extends to GDPR and UK GDPR compliance and the mechanics of lawful cross-border data transfer — Standard Contractual Clauses and the EU-U.S. Data Privacy Framework. Cookie consent and tracking-technology compliance, from the banner and consent-management configuration to the litigation exposure that comes with getting it wrong, is part of the same picture. Michael Bittner holds the CIPP/US credential through the IAPP, which is the practical certification standard for U.S. privacy practitioners.
AI adoption inside a technology company creates a privacy question before it creates anything else: what personal data is actually flowing to the AI vendor, whether that vendor’s terms require a DPA, and whether biometric consent obligations attach to AI-powered features like voice, facial, or behavioral recognition. MB Legal runs that assessment as part of vendor risk review, reading the AI vendor’s actual terms, data processing addendum, and sub-processor list rather than taking a sales deck’s word for it. (The firm’s broader AI governance work, AI use policies, agentic AI vendor contracting, and AI compliance monitoring, is covered in depth on a dedicated AI Governance page.)
On the cybersecurity side, MB Legal works directly with cybersecurity companies and their clients on legal-layer compliance: vendor risk management, security program documentation, and full-program counsel for ISO 27001 certification and SOC 2 readiness. That work goes beyond reviewing paperwork. It means building the ISMS, developing the policy library, and structuring the audit evidence program alongside the technical security team. When a cybersecurity incident occurs, legal obligations run parallel to the technical response: breach notification timelines, regulatory reporting, evidence preservation, and coordinating what gets said and to whom while the investigation is still open. MB Legal handles that legal-layer response from first detection through notification and regulatory follow-up.
Ongoing privacy support, including privacy policy drafting, vendor and AI-tool DPA review, compliance calendar management, and response to data subject requests, is available through the Fractional General Counsel program.
Why MB Legal
MB Legal serves cybersecurity companies as clients, not just as subjects of regulation. That context matters: the firm has negotiated cybersecurity services agreements, reviewed penetration testing scopes, taken a client through ISO 27001 certification end-to-end, and advised on the legal treatment of vulnerability data. Privacy and cybersecurity counsel that works inside the industry understands the product, the risk, and the language.
The CIPP/US credential and IAPP membership reflect ongoing engagement with developments in privacy law and practice. Flat-fee privacy policy drafting and DPA review are available for standard engagements.
Common questions
Does my SaaS product need a privacy policy, and what should it include?
A privacy policy is required under multiple state and federal laws for any product that collects personal data. What it needs to say depends on your data practices, the types of users you serve, and which state laws apply to your customer base. MB Legal drafts privacy policies that reflect your actual data flows rather than copying generic templates that may not match what your product does.
Does COPPA apply to my app, and what does it require?
COPPA applies to any online service that collects personal information from children under 13, or that has actual knowledge it is doing so. Requirements include verifiable parental consent, a compliant privacy policy, and limits on how collected data can be used. MB Legal advises technology companies on COPPA applicability and compliance obligations.
Does children's privacy compliance stop at COPPA?
No. COPPA covers data collection from children under 13, but state age-appropriate design laws, biometric privacy statutes, and platform-specific rules for AI-powered features (chatbots, personalization, voice or facial recognition) create additional obligations, including age verification requirements and separate consent standards for biometric identifiers. MB Legal advises technology companies on the fuller compliance picture beyond COPPA, including how biometric consent requirements apply to AI-enabled product features.
What is a Data Processing Agreement (DPA), and when do I need one, including for AI vendors?
A DPA is a contract between a data controller and a data processor that governs how personal data is handled, secured, and returned or deleted. If your SaaS product processes personal data on behalf of business customers, or you send personal data to a third-party AI vendor (a chatbot, a transcription tool, an AI feature built on a model provider's API), a DPA is usually necessary, and the analysis has to account for whether that vendor's own subprocessors create cross-border transfer obligations under GDPR, UK GDPR, or state law. MB Legal reviews and negotiates DPAs for technology companies, including the privacy diligence question of what personal data actually flows to an AI vendor and what happens to it downstream.
What does breach response and incident counsel actually involve?
Notification timelines are the most visible piece: most state laws require notice within 30 to 90 days of discovering a breach, with some states, including Florida, requiring notice within 30 days. The fuller engagement covers regulatory reporting obligations, coordinating legal privilege alongside the technical incident response, preserving evidence in a way that holds up if regulators or plaintiffs' counsel ask questions later, and advising on what can be said publicly before the investigation is complete. MB Legal advises on incident response from first detection through notification and regulatory follow-up, working alongside the technical response team rather than after it.
What does ISO 27001 program counsel from a lawyer actually cover?
More than the contract review most firms mean by ISO 27001 support. Michael Bittner has taken a client, a youth-sports SaaS platform, through ISO 27001 certification end-to-end: building the ISMS documentation, developing the policy library, and structuring the audit evidence program alongside the technical security work. That means counsel who understands what an auditor is actually looking for, not someone reviewing paperwork after the fact. MB Legal advises technology and cybersecurity companies on ISO 27001 readiness and the ongoing compliance program that keeps certification current.
Ready to protect your business?
Talk with Mike