Data Privacy Compliance

Overview

Privacy compliance went from "nice to have" to "existential requirement." GDPR fines reach 4% of global annual revenue or €20M (whichever is higher). CCPA allows private lawsuits. Enterprise customers won't sign without a DPA and SCCs. The mistake: treating privacy as a legal checkbox instead of an operational program. This skill covers the complete privacy compliance roadmap for B2B SaaS: GDPR, CCPA, cookie consent, DPAs, SCCs, and building a privacy program that passes enterprise security reviews.

Authoritative Foundations

• GDPR (EU General Data Protection Regulation 2016/679) — Lawful basis, data minimization, DPA requirements for EU buyers.
• CCPA/CPRA — Honor rights to know, delete, and opt out of sale or sharing; the B2B contact exemption ended January 1, 2023.
• ePrivacy Directive — Get prior consent for non-essential cookies; several EU member states also restrict unsolicited email to individuals.
• NIST Privacy Framework — Structure the privacy program around its Identify, Govern, Control, Communicate, and Protect functions.
• IAPP — Use IAPP resources and certifications (CIPP/E, CIPP/US) to staff the program and to evaluate vendors and counsel.