Advisory and regulatory
Technology, data protection and POPIA
We advise businesses on the agreements, policies and governance through which they acquire, develop and use technology and data.
Overview
Technology and data now sit at the centre of almost every business, and the legal frameworks around them continue to develop. In technology and data, we advise on the commercial agreements through which technology is acquired and licensed, on compliance with the Protection of Personal Information Act, and on the governance of information security and emerging technologies such as artificial intelligence.
We help clients understand what they may do with the data they hold, what their technology suppliers may do with it, and what happens when something goes wrong. Our advice is designed to be applied day to day by the people who manage systems, data and supplier relationships.
This work draws on our commercial contracts, intellectual property and governance work, and on our experience of preparing information security, technology governance and acceptable use frameworks for organisations.
Services
What the work involves
Technology and software agreements
We draft and negotiate software licences, software-as-a-service agreements, development agreements, end user licence agreements, hosting and cloud arrangements, and IT outsourcing agreements, with careful attention to service levels, data, intellectual property and exit. We make sure clients understand what they may and may not do, and what happens to their data and systems when the agreement ends.
POPIA compliance
We advise on compliance with the Protection of Personal Information Act, including the conditions for lawful processing, the role and registration of the information officer, privacy notices, data subject requests and cross-border transfers of personal information. We design compliance measures that operational teams can apply consistently.
Data processing and sharing agreements
We prepare operator agreements, data sharing agreements and the data protection provisions of commercial contracts, so that responsibilities for personal information are clearly allocated. Clear allocation of responsibility reduces risk for both parties and supports regulatory compliance.
Information security and technology governance
We prepare information security, technology governance and acceptable use policies, and advise boards on their oversight of technology and cyber risk. Our frameworks are designed to suit the organisation's size and risk, and to be followed day to day.
Security compromises
We help businesses prepare for security compromises, including response plans and notification procedures, and advise on their obligations when a compromise occurs. Prompt, well-prepared responses limit harm to the business and to the people whose information is affected.
Artificial intelligence use
We advise on the governance of artificial intelligence within organisations, including acceptable use policies, data and confidentiality considerations, and the contractual terms on which AI tools are procured. We help organisations adopt these tools with confidence while managing the associated risks.
Technology transactions
We conduct technology and data due diligence in acquisitions and investments, and advise on the transfer of technology assets and data in transactions. We identify ownership, licensing and data issues early so that they can be addressed in the transaction documents.
Who we work with
Technology companies and platforms; businesses procuring technology and outsourcing services; organisations processing significant volumes of personal information; boards overseeing technology risk; and investors in technology businesses.
How we work
Workable compliance
Policies and procedures are designed to be used by operational teams.
Contract and policy together
We align supplier contracts with internal data protection obligations.
Forward-looking
We keep advice current as technology and regulation develop.
Common questions
Do we need an information officer?
Every responsible party under POPIA has an information officer, who is by default the head of the organisation. We advise on the role, its registration and the appointment of deputy information officers.
Technically sound. Commercially minded.
Advice that begins with technical precision and extends to the commercial and strategic judgement that founders, owners and executives rely on.