PRIVACY & AI BOUTIQUE LAW FIRM

Privacy counsel at the speed of business.

Senior counsel embedded inside your team—standing by for the matters where judgment, speed, and continuity count.

THE FRACTIONAL MODEL, BRIEFLY

Senior privacy and AI counsel, embedded in your team.

The depth of a specialist. The continuity of an in-house hire. Neither the overhead nor the wait.

Founded by Hilton's former Global Data Protection Officer. The lawyer you meet is the lawyer who does the work.

The Fractional Model

A standing seat on your team, a defined project, or counsel on call. Hours and response times are set out in the engagement letter.

MODEL A — RETAINER

Embedded Counsel

A standing allocation of senior counsel's week. We hold the privacy and AI counsel seat: intake reviews, vendor questions, regulator correspondence, board reporting.

4–8 hrs

PER WEEK

Same day

BUSINESS-DAY RESPONSE

90-day

TERMS · MONTHLY RETAINER

MODEL B — FIXED SCOPE

Defined Project

A bounded matter with a written scope: a BAA repapering, a DPIA program, an AI-governance framework, state-law readiness.

SCOPED IN WRITING · MILESTONE BILLING · HANDOFF MEMO

MODEL C — AS NEEDED

On-Call Counsel

For legal teams that need a specialist bench: second opinions, incident support, deal-cycle DPA review.

NO MINIMUM · 1-BUSINESS-DAY RESPONSE · HOURLY

Rates are stated in the engagement letter. No engagement is formed by this page.

THE CASE FOR FRACTIONAL

The judgment of senior counsel, without the machinery of Big Law.

BIG LAW

FRACTIONAL COUNSEL

WHO DOES THE WORK

A partner supervises; associates bill the hours.

The senior attorney you meet does the work — no leverage pyramid.

COST STRUCTURE

Hourly rates that carry the overhead of a full-service firm.

A standing retainer scoped to the hours you actually need.

RELATIONSHIP

Matter by matter, re-explained each time.

Embedded in your team — context carries from one quarter to the next.

RESPONSE

New-matter intake before advice.

Same-business-day response under a standing engagement.

SCOPE

Every practice under one roof.

Privacy and AI only — a specialist bench, not a generalist one.

When a matter calls for litigation or a full deal team, we say so — and work alongside the firm you retain for it.

Practice Areas

Deep in privacy and AI — and only privacy and AI. A specialist bench, not a generalist one.

HIPAA & BAAs

Business associate agreements drafted, negotiated, and actually tracked.

45 CFR 164.504(e)

Data Processing Agreements

Processor terms that survive counterparty redlines.

GDPR ART. 28

PIAs & DPIAs

Impact assessments written to be read by a regulator, not filed.

GDPR ART. 35

AI Governance

Advice on model intake, risk classification, and governance documentation.

EU AI ACT · NIST AI RMF

US State Privacy Laws

One obligation register across California, Colorado, and the rest.

CAL. CIV. CODE §1798.100

Cross-Border Data Transfers

SCC remediation programs and transfer risk assessments, run at enterprise scale.

EU · UK · SWISS SCCs

Incident Response & Breach Notification

Breach counsel from first report through multi-state notification analysis.

45 CFR 164.400 · STATE BREACH LAWS

Privacy Program Design & Operations

Notices, consent, DSAR playbooks, ROPAs — and the training that makes them stick.

GDPR ART. 30 · ART. 37–39

INDUSTRIES · WHERE THE ATTORNEYS HAVE DONE THE WORK

Pharmaceuticals

Clinical trial and research data, consent frameworks, cross-border transfers, and the privacy questions that follow the pipeline from study to market.

CLINICAL DATA · CONSENT · TRANSFERS

Medical Device Manufacturers

Connected devices and the patient data they generate: telemetry, software-driven products, AI-enabled functions, and vendor ecosystems.

CONNECTED DEVICES · PATIENT DATA · AI

Hospitality

Guest data at global scale — loyalty programs, reservations, payments, and marketing across jurisdictions. The sector where this practice began.

GUEST DATA · LOYALTY · GLOBAL OPERATIONS

REPRESENTATIVE MATTER

Counsel with continuity.

A clinical-AI startup needed the privacy counsel seat filled ahead of a payer contract. One attorney stood up the model intake process and DPIA program, then carried the same matters through processor negotiations — the same counsel, quarter after quarter.

Our attorneys advise clients on US, EU, and UK privacy laws and matters: counsel's analysis of your obligations, advice you can act on, and the same attorney across your matters from one quarter to the next.

6 hrs/week · Named counsel

SCOPE, IN SEQUENCE

Model intake

A review process for every model the business proposes to deploy.

DPIA program

Impact assessments written to be read by a regulator, not filed.

Processor terms

Negotiated opposite enterprise counterparties, on the client's paper.

Recent Engagements

ANONYMIZED · REPRESENTATIVE OF THE PRACTICE

HIPAA · M&A

Repapered 40+ business associate agreements for a telehealth platform following an acquisition.

EMBEDDED COUNSEL

Embedded privacy counsel for a clinical-AI startup: model intake process and DPIA program stood up ahead of a payer contract.

INCIDENT

Incident counsel: 72-hour notification analysis across four states for a diagnostics company.

AI GOVERNANCE

EU AI Act applicability assessment and governance charter for a US company deploying foundation models.

DPAs

Negotiated processor terms opposite three enterprise counterparties for a health-data platform.