Resources

Data Protection & Cybersecurity Insights

Articles and legal commentary on Data Protection & Cybersecurity from Sarhan Data Law.

Latest thinking

Articles and Insights

Browse legal analysis on privacy, AI governance, technology transactions, and product counsel.

Product Counsel • August 13, 2026

Does SOC 2 Cover Your AI Model?

Your SOC 2 report says nothing about your model. What the Trust Services Criteria actually cover, the AI-specific gaps buyers now probe, and where ISO 42001 fits.

Business Transactions • August 5, 2026

Acquiring an AI Company? The Training-Data Diligence That Determines What You Actually Own

Standard tech diligence assumes the target's core asset is code. With an AI company, you're buying data rights — and most of them are undocumented. The five workstreams that surface what you actually own.

Business Transactions • August 5, 2026

Business Acquisitions and PIPEDA: The Data Diligence That Deals Miss

PIPEDA's s. 7.2 business-transaction exception lets customer data move with a deal — but its conditions are more constrained than most deal teams assume. The diligence that protects value.

Data Protection & Cybersecurity • July 30, 2026

Reviewing AI Model Training Data Rights: The Chain-of-Title Problem

Before you can rely on an AI model's outputs, you need to know where its training data came from. Here's how to review chain-of-title across licensed, scraped, customer, and synthetic data.

Product Counsel • July 28, 2026

Do Enterprise Buyers Actually Care About Your AI Governance Policy?

Enterprise buyers don't read your AI governance policy document. They care about five specific artifacts it produces. Here's the difference, and why it matters for how you build it.

Data Protection & Cybersecurity • July 6, 2026

Canada's CDBA Draft Regulations Are Here: What Fintechs Need to Prepare For

The draft Consumer-Driven Banking Regulations published June 27, 2026 fill in the operational details — four accreditation pathways, security requirements, consent architecture, record keeping, and liability rules. Here's what fintechs need to know before the August 26 consultation deadline.

Healthcare • June 30, 2026

Navigating the PIPEDA-PHIPA Intersection: What Healthtech Companies Need to Know

PIPEDA vs PHIPA: which regime applies to your healthtech company, when both apply simultaneously, and how to navigate the grey zones that stall hospital deals.

Product Counsel • January 19, 2026

Party Roles in Data Processing Agreements: When Controller-to-Controller Makes Sense

Many important data flows operate on a controller-to-controller basis. Mischaracterizing these relationships creates legal risk and operational confusion.

Data Protection & Cybersecurity • April 8, 2025

Decoding Your Cyber Policy: 6 Critical Things to Review

Don't just buy cyber insurance, understand it! Review 6 critical areas: data exclusions, security minimums, coverage definitions/limits, incident response rules, timelines (retroactive date, BI), and modern threat coverage. Ensure it aligns with your risk. Read more...