Data Processing Agreements in the Age of AI: Negotiating, Drafting, Compliance Considerations, Risk Mitigation

Mr. Curtis provides AI, privacy, and security guidance to technology-led companies, from start-ups to multinationals. His practice focuses on negotiating data licenses and other commercial contracts, drafting privacy notices, and providing practical product counseling. With experience managing hundreds of strategic transactions each year, Mr. Curtis helps clients streamline compliance efforts and navigate complex regulatory and business challenges. His work spans a range of technology industries, including PropTech, HealthTech, and EdTech among others. He regularly advises clients on privacy policies, terms of service, and data processing agreements, with a particular focus on compliance with the California Consumer Privacy Act (CCPA) and other state privacy laws, state data broker laws, AI regulations, the Children’s Online Privacy Protection Act (COPPA), and cross-border data transfer requirements under the EU and UK General Data Protection Regulation (GDPR). David also counsels clients on AI-powered products, on digital advertising, Internet law, and consumer protection, helping clients anticipate and address evolving legal risks.

Mr. Hobaugh combines his global software, database and network engineering experience with his legal practice to focus on artificial intelligence governance and law, cybersecurity law and privacy law. A certified iapp artificial intelligence governance professional (AIGP) and information privacy professional (FIP/CIPT/CIPP/US/E) plus ISC2 Certified Information System Security Professional (CISSP), he uses his extensive inhouse experience as a data protection officer, incident response counsel, and global privacy program compliance counsel to provide legal and cybersecurity guidance to his clients. Mr. Hobaugh’s work includes GDPR, EU AI ACT, HIPAA, GLBA, FERPA, COPPA, PIPEDA, FTC, and state compliance including data protection agreements, business associate agreements and data protection impact assessments. He specializes in guiding start up companies through the AI, privacy, and security compliance maze. A guest lecturer and author of four books on cybersecurity law, Mr. Hobaugh is sought out counsel for startups, and mergers and acquisitions. Prior to his legal career, Mr. Hobaugh was a software engineer with a focus on international IT consulting and telecom (Europe / Middle East / North West Africa / Brazil), writing his first artificial intelligence program in 1989. 

Ms. Krasnow advises companies on privacy, data security, technology matters, and cyber governance, including data breaches/incidents/other events (ransomware, account takeover, business email compromise, phishing, and vulnerabilities), preparing written information security programs (organizational and employee), devising incident response plans, and facilitating and participating in tabletop exercises. She counsels boards of directors and officers on privacy, data security, and technology risk oversight and developments, and reviews cyber liability insurance policies. Ms. Krasnow advises companies on regulatory inquiries and complying with state, federal, and international privacy and data security, advertising and marketing, governance and compliance, and regulated industry laws. She prepares website and mobile application privacy policies and terms (including regarding the GDPR, CPRA and other state privacy laws, geolocation, big data, and artificial intelligence/chatbots), and technology policies. Ms. Krasnow works with companies on negotiating (and renegotiating in the wake of data breaches/incidents/other events) and documenting technology and commercial transactions, including master services agreements, non-disclosure agreements, data security addenda, business associate agreements, data license agreements, GDPR and other data processing agreements, and CPRA and other state privacy law agreements.