Data Privacy Law

Privacy Law is one of our largest tracks because privacy regulation has become the single most important legal constraint on AI. The EU's GDPR, the US state privacy laws (CCPA/CPRA, Colorado, Virginia, Connecticut, and the growing list that follows the Washington MHMDA model), China's PIPL, India's DPDPA, Brazil's LGPD, and the sectoral rules (HIPAA, GLBA, FERPA, COPPA, BIPA) together form a compliance surface that almost every AI product has to navigate.

We wrote this track to be useful to three audiences simultaneously: the engineer building the system, the privacy professional reviewing it, and the operator making deployment decisions across jurisdictions. The lessons cover the statutes in detail but also the practical engineering patterns (data subject access request handling, consent flows, DPIAs for AI, cross-border transfers, retention, and the PETs that reduce legal risk). A system designed with these patterns in mind is much easier to defend under any of the regimes covered here.