Privacy Lawyers for New York
Looking for a privacy lawyer in New York?
ContractsCounsel helps businesses across New York hire vetted privacy lawyers, offering fixed-fee quotes with the first proposal typically arriving in just a few hours.
Hire a Lawyer for 60% Less than Traditional Law Firms
Meet some of our New York Privacy Lawyers
Joshua S.
Joshua is an experienced attorney with deep expertise in finance, corporate, and business law. He offers practical legal solutions and personal service. As Managing Partner of Soloway Group PC, he advises startups, growing companies and investment funds on key issues, from formation to fundraising, stock issuances, trademarks and general business. He started out structuring funds and transactions at PwC before launching his own firm in 2009. He has been a partner in several New York law firms and has founded several companies including a banking firm, a real estate business, and a Cleantech company. Joshua has also served as Chief Legal Officer and Chief Strategy Officer of several companies in the tech, real estate, consulting, and sustainability industries. Prior to law school he was an early employee at a SoftBank-backed startup until it’s acquisition. Over the years, Joshua has helped many clients to launch, finance and grow successfully.
"Very competent attorney who gets to the point quickly and cheerfully."
Joshua B.
Josh Bernstein has been serving real estate and corporate transactional clients since 2002. His experience is varied, and he enjoys working on and puzzling out novel and complex corporate and real estate matters. Josh’s experience includes, among other things, the following: representation of public companies in connection with SEC reporting and compliance work (proxies, 10-K’s; 10-Q’s; 8-K’s, etc.); representation of public and private company securities issuances (including private placements, and other similar offerings); assistance in structuring and drafting joint ventures, both for investors and operating partners, and including both real estate and corporate ventures; handling public and private company mergers and acquisitions; and asset sales and dispositions; assisting clients, big and small, with real estate acquisitions, sales and financings; managing large-scale and multi-state real estate portfolio acquisitions, dispositions and financings; complex condominium creation, structuring and governance work, including: commercial condominiums, use of condominiums as a land planning tool, wholesale condominium property acquisitions and dispositions, and rehabilitating failed or faulty condominium legal structures to make ready for sale; development of restrictive covenants and owners’ association documents for master-planned communities; compliance with federal statutes governing real estate sale and development (including, without limitation, the Interstate Land Sales Full Disclosure Act, the Housing for Older Persons Act, and the Americans with Disabilities Act); representation of real estate lenders, for both improved and unimproved property, and including numerous construction financings secured by real estate; assistance with commercial leasing; from both the landlord and tenant side, and including condominium leasing; training residential home and condominium sales staff for compliance with applicable local and federal law; and workouts of all kinds. When he’s not busy lawyering, Josh may be found watching 80’s commercials, flying a single-engine plane, playing poker, or trying to be a good dad.
"Josh has been extremely helpful sorting through issues with a tenant."
Muhammad Yar L.
I am Muhammad Yar Lak, a New York-licensed technology attorney with extensive experience advising startups, founders, growing businesses, established companies (including Fortune 100 clients), and individuals on the legal matters that shape how they operate, grow, and protect what they have built. My practice covers business relationships, operational and contractual risk, corporate structure, and personal legal planning, including forming and structuring LLCs and corporations, and matters such as prenuptial agreements. I hold a law degree from Georgetown University Law Center and am admitted to practice in New York. I am also CIPP/US certified, reflecting my commitment to privacy and data as core concerns in modern business and technology law. I practice as a Senior Associate with Gogo & Moore, a technology-focused law firm with offices in Aspen, Atlanta, and New York. I have built my practice around the industries defining the next decade, including technology, fintech, artificial intelligence, blockchain and digital assets, and e-commerce, while also serving clients in healthcare, manufacturing, real estate, and entertainment. Wherever my clients are building, I am there. My approach is simple: good legal counsel should empower people, not slow them down. I work hard to understand what my clients are actually trying to accomplish and help them get there. If that sounds like the kind of lawyer you are looking for, I would be glad to connect.
"Muhammad did great work very quickly and was responsive to my time needs at his own expense. I am grateful."
Artem V.
Attorney licensed in New York and Texas, with experience in real estate, corporate and finance transactions, contracts, intellectual property, and privacy matters. Artem provides practical, business-focused legal support to startups and small to mid-sized companies, delivering solutions across corporate, commercial, and general business needs.
"Working with Artem was a great experience from start to finish. He was professional, approachable, and incredibly helpful, always making sure my questions were answered and that I fully understood each step of the process. I truly appreciated his time, patience, and expertise. It was a pleasure working with him, and I would not hesitate to recommend him to others or work with him again in the future."
September 15, 2023
Christopher X.
Recent law school graduate with an undergraduate degree in biomedical engineering degree passionate about the intersectionality of law and life sciences. Admitted to New York and New Jersey Bar. Ability to add value in a pharmaceutical or biotechnology entity and provide a unique perspective to multiple disciplines.
Ian L.
I am an attorney admitted in New York and New Jersey with 21 years of law firm and in-house, complex litigation, appellate, and counseling experience. I am admitted in the New York U.S. District Courts and several U.S. Courts of Appeals. I have handled white collar litigation and other complex litigation matters. I have extensive insurance coverage, antitrust, contract, and internal investigations experience, and securities law and financial-services litigation experience. I was a candidate for the U.S. Senate in New Jersey 2011.
November 11, 2025
Alyssa R.
Alyssa M. Reid is a New York–based transactional attorney advising founders, creatives, and companies on commercial agreements, intellectual property, and strategic business matters. Her practice focuses on drafting, reviewing, and negotiating a wide range of contracts, including service agreements, licensing and IP deals, publishing agreements, and talent/influencer contracts. Alyssa is known for combining strong legal analysis with a practical, business-minded approach. She helps clients understand what they’re signing, identify risks, and negotiate terms that protect their long-term interests, particularly around ownership, revenue, and control. She represents clients across media, entertainment, technology, sports, and consumer industries, serving as a trusted advisor from early-stage growth through more complex transactions. Prior to founding AMR Law, PLLC, Alyssa practiced at Sidley Austin LLP and later served as outside general counsel to startups and entrepreneurs. She is licensed to practice in New York and holds a J.D. from New York Law School and a B.A. from New York University.
October 4, 2023
Angela P.
I am an experienced New York Real Estate Attorney and Florida Licensed Title Agent with extensive knowledge in the Real Estate industry. With more than 20 + years and over 2500 closed transactions, I have become an expert at accurately assessing realtors', lenders' & investors' needs and proposing/implementing viable solutions that bring value to them. I focus on real estate settlement services, education, and training of real estate professionals. I am also skilled working with high-end clients, managing large and complex projects, building solid relationships, effectively and creatively solving complex issues, producing results under stress all with impeccable customer service.
November 15, 2023
Francine L.
I am a multi-degreed attorney with more than 17 years of criminal trial experience and more than 15 as a general legal consultant. I'm licensed to practice in New York State.
November 28, 2023
Andrew R.
I'm a tenants rights attorney based (and licensed) in New York. My expertise includes filing complaints and responsive pleadings as well as reviewing leases and contracts and motion practice.
December 4, 2023
McCoy S.
P. McCoy Smith is the Founding Attorney at Lex Pan Law LLC, a full-service technology and intellectual property law firm based in Portland, Oregon, U.S.A and Opsequio LLC, an open source compliance consultancy. Prior to his current position, he spent 20 years in the legal department of a Fortune 50 multinational technology company as a business unit intellectual property specialist; among his duties was setting up the free & open source legal function and policies for that company. He preceded his in-house experience with 8 years in private practice in a large New York City-based boutique intellectual property law firm, working simultaneously as a U.S. patent litigator and U.S. patent prosecutor. He was also a patent examiner at the U.S. Patent & Trademark Office prior to attending law school. He is licensed to practice law in Oregon, California & New York and to prosecute patent applications in the U.S. Patent & Trademark Office; he is also a registered Trademark and Patent Agent with the Canadian Intellectual Property Office. He has degrees from Colorado State University (Bachelor of Science, Mechanical Engineering, with honors), Johns Hopkins University (Masters of Liberal Arts) and the University of Virginia (Juris Doctor). While in private practice, and continuing into his in-house career, he taught portions of the U.S. patent bar exam for a long-standing and well-known patent bar exam preparation course, and from 2014-2020 was on the editorial board of the Journal of Open Law, Technology & Society (JOLTS), and starting in 2023 will be on the editorial board of the American Intellectual Property Law Quarterly Journal (AIPLAQJ). He is the author or co-author of chapters on open source and copyright and patents in “Open Source Law, Policy & Practice” (2022, Oxford University Press). He lectures frequently around the world on free and open source issues as well as other intellectual property topics.
Adam T.
Legal professional with 10+ years of Fortune 500 in-house and AmLaw 50 law firm experience in crafting multi-pronged litigation, regulatory, and public policy strategies and negotiating pioneering, high-stakes global cloud services and digital content distribution deals.
Find the best lawyer for your project
Browse Lawyers NowPrivacy Legal Questions and Answers
Privacy
Privacy Policy
California
What laws and regulations govern privacy policies?
I am the owner of an online business and have recently implemented a privacy policy for our customers. I want to ensure that our privacy policy is in compliance with all applicable laws and regulations. I am looking for an understanding of what those laws and regulations are, so that I can make sure we are following them correctly.
Russell M.
There are myriad laws that govern privacy. In the U.S. there are the U.S. Privacy Act, HIPPA for health info, GLBA for financial, COPPA protecting children, and now more States are adding privacy laws. In 2023 alone, new consumer privacy laws will be effective in California, Colorado, Connecticut, Utah, and Virginia. Doing business internationally? The GDPR in the EU is recognized as something of a gold standard for individual privacy. The GDPR created ongoing obligations for maintains and updating privacy implementation. Companies located anywhere, not just the EU, must appoint a Data Protection Officer (“DPO”) if they have to carry out large scale, regular and systematic monitoring of people, for example online behavior tracking or large scale processing of sensitive (special category) data or data relating to crimes and criminal convictions.
Privacy
GDPR Compliance
Texas
Is my website required to comply with GDPR regulations?
I recently launched a small e-commerce website that sells products to customers in the European Union. While I am based in the United States, I have noticed that a significant portion of my customers are from EU countries. I have heard about the General Data Protection Regulation (GDPR) and its requirements for businesses handling personal data of EU citizens, but I'm not sure if my website needs to comply with these regulations. Can you clarify if my website falls under the scope of GDPR and what steps I need to take to ensure compliance?
Randy M.
Yes. If you sell to people in the European Union, the GDPR applies to you. It doesn’t matter where your business is based. Under Article 3, the law extends beyond Europe to cover any company that offers products or services to EU residents or tracks their behavior online. So if you accept orders from the EU, you're legally required to follow GDPR rules. The GDPR lays out key principles in Article 5. In simple terms: • You must have a lawful basis before collecting personal data (lawfulness). • Data must be collected and used fairly and transparently (fairness and transparency). • Only gather the minimum data necessary and for clear, legitimate purposes (purpose limitation and data minimisation). • Keep personal data accurate and update or correct it when needed (accuracy). • Don’t keep data longer than required for the stated purpose (storage limitation). • Protect data with appropriate technical and organizational safeguards (integrity and confidentiality). • Be able to show regulators that you comply with all of these rules (accountability). You also need to be able to prove you're doing all this if a regulator asks. When Are You Allowed to Use Customer Data? For things like shipping an order or taking payment, you’re covered by what's called the “contract” basis under Article 6(1)(b). You need info like names, addresses, and payment details to complete a sale. That’s allowed. For email marketing, things are stricter. Consent is usually required. That means a clear opt-in, like an unchecked box the customer has to actively click. Some EU countries allow limited “soft opt-in” for existing customers, but the rules vary by country. If you’re unsure, it’s safest to get clear consent before emailing EU customers with promotions. What Rights Do Customers Have Over Their Data? Articles 15–21 give EU customers a lot of control. They can: • Ask what data you have on them • Correct wrong info • Ask you to delete their data (in certain cases) • Tell you to stop using it • Opt out of marketing • Ask you to send their data to another company You need systems in place to respond to these requests quickly and efficiently. What About Cookies? The EU’s top court (in the Planet49 case) made it clear: you can’t assume consent for tracking cookies. That means: • No pre-checked boxes • No vague “we use cookies” banners • You must let users actively choose which types of cookies to allow • You need to record and prove that consent was given Your cookie banner should be easy to use and offer equal choices for accepting or rejecting cookies. How to Keep Customer Data Secure You’re expected to take technical and organizational steps to protect people’s personal data. That includes things like: • Using SSL/TLS encryption • Restricting access to databases • Having solid contracts with vendors who handle customer data If there’s a data breach, Article 33 says you must tell the relevant EU authority within 72 hours if the breach could put someone’s rights at risk. If it’s a serious risk to individuals, Article 34 says you also need to inform the affected customers. What If You Use Outside Vendors? If you work with third parties such as payment processors, email services, or cloud providers, you’re responsible for what they do with customer data. The GDPR requires you to sign Data Processing Agreements (DPAs) with them. These agreements must cover: • How they protect the data • Their legal obligations • How they’ll help you stay compliant You can’t skip this part. It’s not optional. Do You Need an EU Representative? If you regularly sell to EU customers, the answer is yes. Article 27 requires most non-EU businesses to appoint an official representative inside the EU. This rep acts as your point of contact for EU regulators and customers. You only get an exemption if: • You rarely process EU data • It’s low-risk • It doesn’t involve sensitive data But if you're actively targeting or shipping to EU customers, that exemption likely won’t apply. What Happens If You Don’t Comply? Regulators can fine you up to €20 million or 4% of your global annual revenue, whichever is higher. That said, small businesses aren’t usually hit with huge fines right away. Most EU regulators aim to help companies comply, especially if you’re clearly making an effort. But ignoring GDPR isn’t a good strategy. Being able to show you’ve taken real steps toward compliance is your best protection. Attorneys on Contracts Counsel are ready to help with GDPR compliance, including privacy policies, vendor contracts, and other legal obligations tailored to your business needs.
Privacy
Website Terms of Service and Privacy Policy
Texas
Can a company change its Terms of Service and Privacy Policy without notifying its users?
I recently discovered that a popular online platform I use has made significant changes to its Terms of Service and Privacy Policy, which I was not notified about. These changes seem to give the company more access to my personal data and reduce my rights as a user. I'm concerned about the implications of these changes and whether the company is allowed to make such modifications without informing its users in advance.
Jennifer B.
Online platforms can modify their terms of service and privacy policies without advance notice if: (1) Their terms explicitly allow such changes, and (2) Users continue using the platform after changes are made. However, modifications may still be challenged if they are unconscionable or violate privacy laws, particularly if they significantly impact user rights or data protection. While platforms may have the right to make unannounced changes, the enforceability depends on the specific modifications and their compliance with applicable regulations.
Privacy
Software Agreement
North Carolina
Software agreement and GDPR compliance?
I am the founder of a software company that is looking to enter into a software agreement with a new client. We are in the process of finalizing the agreement but I am concerned that it may not be compliant with the General Data Protection Regulation (GDPR). I want to make sure that the agreement is compliant with GDPR so that our company is not at risk of any legal action or penalties.
Nicholas M.
You are smart to consider GDPR, but also should consider US Privacy Policies in connection with the agreement. There are several states the already have GDPR level of privacy policies and over 20 states with bills introduced as well. A well formed policy will consider the data collected, where it is stored and how it is transferred, who has access to the data, the purpose of the data for use in the app, the ability to sell or reuse the data for additional purposes, and when the data should be deleted. This process should be contemplated and consistent within employee manuals, data access procedures, and implemented in master services agreements across all vendors, subcontractors, and suppliers. One final note is that you need to practice what you write, because a published privacy policy that is not followed may be considered a deceptive trade practice by the FTC resulting in fines on top of the costs of a breach.
Privacy
Data Processing Agreement
Texas
What are the key provisions that should be included in a Data Processing Agreement?
I am a business owner and I recently entered into a partnership with another company to provide data processing services. As part of this partnership, we need to draft a Data Processing Agreement to outline the responsibilities and obligations of both parties in relation to data protection and processing. I want to ensure that the agreement covers all the necessary provisions to protect both our companies and the personal data we handle, so I am seeking guidance on the key provisions that should be included in such an agreement.
Ricardo A.
A Data Processing Agreement (DPA) is a legally binding document that governs the relationship between the data controller and data processor in compliance with data protection laws such as the General Data Protection Regulation (GDPR). Here are the key provisions that should be included: 1. Scope and Purpose • Clearly define the purpose of the data processing and the nature of the data being processed. • Specify the categories of data subjects (customers, employees). • Outline the types of personal data involved. 2. Roles and Responsibilities • Define the roles of the parties (controller vs. processor). • State that the processor will act only on the documented instructions of the controller. 3. Compliance with Laws • A commitment to comply with applicable data protection laws and regulations, such as the GDPR or CCPA. 4. Confidentiality • Ensure that the processor’s personnel are subject to confidentiality obligations. • Prohibit unauthorized access or sharing of data. 5. Security Measures • Require the processor to implement appropriate technical and organizational measures to protect personal data (encryption, access controls). • Include procedures for detecting and responding to data breaches. 6. Sub-processors • Outline conditions for engaging sub-processors ( prior authorization or notification). • Ensure sub-processors comply with the same data protection obligations. 7. Data Subject Rights • Require the processor to assist the controller in responding to data subject requests (access, correction, deletion). 8. Data Transfers • Specify the conditions for transferring personal data outside the European Economic Area (EEA) or other restricted jurisdictions. • Include safeguards such as Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs). 9. Data Breach Notification • Oblige the processor to notify the controller promptly in the event of a personal data breach. • Provide details on how incidents will be managed. 10. Audit Rights • Grant the controller or its appointed auditor the right to inspect and audit the processor’s compliance. 11. Retention and Deletion of Data • Specify the duration of processing. • Require the processor to delete or return personal data after the end of the contract or processing period. 12. Liability and Indemnification • Allocate liability for breaches or non-compliance. • Include indemnification provisions if appropriate. 13. Termination and Consequences • Address the conditions for terminating the DPA. • Define the post-termination obligations (data return or deletion). 14. Jurisdiction and Governing Law • Specify the governing law and jurisdiction for resolving disputes. 15. Annexes or Schedules • Include detailed annexes to provide additional information, such as: • A list of sub-processors. • A description of technical and organizational measures. • A record of processing activities. Legal Review Always consult a legal expert to ensure that the DPA aligns with the applicable laws and the specific needs of the parties involved.
Quick, user friendly and one of the better ways I've come across to get ahold of lawyers willing to take new clients.
View Trustpilot ReviewHow It Works
Post Your Project
Get Free Bids to Compare
Hire Your Lawyer
Privacy lawyers by top cities
- Austin Privacy Lawyers
- Boston Privacy Lawyers
- Chicago Privacy Lawyers
- Dallas Privacy Lawyers
- Denver Privacy Lawyers
- Houston Privacy Lawyers
- Los Angeles Privacy Lawyers
- New York Privacy Lawyers
- Phoenix Privacy Lawyers
- San Diego Privacy Lawyers
- Tampa Privacy Lawyers
Privacy lawyers by nearby cities
- Albany Privacy Lawyers
- Buffalo Privacy Lawyers
- New York Privacy Lawyers
- Rochester Privacy Lawyers
- Syracuse Privacy Lawyers
- Yonkers Privacy Lawyers
Contracts Counsel was incredibly helpful and easy to use. I submitted a project for a lawyer's help within a day I had received over 6 proposals from qualified lawyers. I submitted a bid that works best for my business and we went forward with the project.
View Trustpilot Review
I never knew how difficult it was to obtain representation or a lawyer, and ContractsCounsel was EXACTLY the type of service I was hoping for when I was in a pinch. Working with their service was efficient, effective and made me feel in control. Thank you so much and should I ever need attorney services down the road, I'll certainly be a repeat customer.
View Trustpilot Review
I got 5 bids within 24h of posting my project. I choose the person who provided the most detailed and relevant intro letter, highlighting their experience relevant to my project. I am very satisfied with the outcome and quality of the two agreements that were produced, they actually far exceed my expectations.
View Trustpilot ReviewHow It Works
Post Your Project
Get Free Bids to Compare
Hire Your Lawyer