Drafting and Negotiating Data Processing Agreements Amid Expanding Privacy, Security, and AI Laws

This session explores the foundational requirements of GDPR Article 28, covering the eight mandatory components for data processing agreements between controllers and processors. Participants will learn about documented instructions, confidentiality obligations, cybersecurity safeguards, subprocessor requirements, data subject rights, breach notification, retention protocols, and auditing obligations.

This session examines Canada’s federal privacy statute governing commercial activities, including its ten fair information principles that closely track GDPR requirements. Topics include accountability, consent requirements, data minimization, safeguards, and why Canada achieved EU adequacy status.

This session focuses on the CCPA/CPRA framework, covering definitions of businesses, selling and sharing data, and required contract provisions with service providers. Participants will review recent enforcement actions and prepare for new requirements taking effect January 1, 2026.

This session addresses California’s data security procedures law and its broader application beyond for-profit entities. Attendees will learn about reasonable security standards based on the CIS critical security controls and required contract language for third-party relationships.

This session provides an overview of AI laws taking effect in 2026 from California, Texas, and Colorado. Participants will explore key distinctions between frontier developers, deployers, and high-risk AI systems, along with compliance considerations for each framework.