Privacy, Data Protection & Commercial Technology Attorney (SaaS, DPAs, AI & Data Agreements)

Overview

This role is for a Privacy, Data Protection & Commercial Technology Attorney focused on SaaS, DPAs, AI, and data agreements. Work centers on how personal data, sensitive data, and AI training data are collected, processed, shared, and protected across the contract lifecycle.

The attorney will support both day-to-day contracting and the development of scalable legal workflows, collaborating closely with product and engineering teams.

Responsibilities

• Draft, review, and negotiate technology agreements, including:
  • SaaS and software licensing agreements
  • Data Processing Agreements (DPAs)
  • API and data-sharing agreements
  • Technology services agreements (cloud, hosting, managed services)
  • Vendor and procurement agreements involving technology platforms
  • Product integration, partnership, and platform agreements
• Advise on legal and business issues related to:
  • Data use rights, ownership, and licensing structures
  • Data flows, integrations, and third-party processing arrangements
  • Security, breach, and incident response provisions
  • IP ownership and usage rights in technology contexts
• Negotiate and advise on AI/ML-related contractual terms, including:
  • Use of data for model training and improvement
  • Input/output ownership and licensing
  • Confidentiality and prompt/data handling
  • Restrictions on use of generative AI tools
  • Allocation of risk related to AI-generated outputs
• Provide practical, business-oriented privacy and data protection guidance in commercial agreements, including:
  • Personal data handling and sensitive data categories
  • Consent and notice requirements
  • Data subject rights
  • Retention and deletion obligations
  • Vendor data practices
• Support alignment with privacy and data protection frameworks, including:
  • GDPR, UK GDPR, CCPA/CPRA and other US state privacy laws
  • HIPAA where applicable
  • Emerging AI and data protection regimes
• Contribute to scalable legal delivery by:
  • Building and refining playbooks, templates, and structured guidance
  • Supporting AI-enabled contract review and data extraction workflows
  • Collaborating with product and engineering to improve system outputs

Requirements

• J.D. barred in Arizona (required)
• 7+ years of experience in:
  • Privacy and data protection commercial contracting
  • Technology transactions
• Demonstrated experience negotiating:
  • SaaS agreements
  • DPAs, SCCs, BAAs, and substantive privacy and data protection terms
  • Broader technology agreements (services, licensing, integrations, etc.)
• Familiarity with AI-related contract terms, including model training rights, data usage restrictions, and output ownership
• Familiarity with emerging issues in generative AI within commercial agreements
• Strong understanding of privacy and data protection concepts, including:
  • Controller/processor and joint controller relationships
  • Subprocessor management
  • Cross-border transfer mechanisms (SCCs, adequacy decisions, transfer impact assessments)
  • Data subject rights
  • Breach notification obligations
• Strong understanding of IP and licensing structures in technology agreements
• Strong understanding of standard security, privacy, and data handling provisions, including:
  • Audit rights
  • Incident response
  • Data localization
  • Retention and deletion requirements
• Ability to balance legal risk with business objectives in fast-paced environments

Preferred Qualifications

• Experience negotiating or advising on AI/ML and generative AI terms in commercial agreements
• Deep familiarity with global privacy frameworks, including GDPR, UK GDPR, CCPA/CPRA and other US state privacy laws, sector-specific regimes (HIPAA, GLBA), and emerging AI and data protection legislation
• Experience supporting product, engineering, or procurement teams
• Background in high-volume contracting or ALSP environments
• Comfort working with AI-enabled contract review tools and structured playbooks
• Privacy certifications (CIPP/US, CIPP/E, CIPM, or equivalent) a plus

Compensation & Benefits

Not specified in the provided job description.

Location

Not specified in the provided job description.