Resources

Data Protection & Cybersecurity Insights

Articles and legal commentary on Data Protection & Cybersecurity from Sarhan Data Law.

Latest thinking

Articles and Insights

Browse legal analysis on privacy, AI governance, technology transactions, and product counsel.

Data Protection & Cybersecurity • August 25, 2026

Automated Decision-Making in Canada: What Uber's €825M Fine Means for Your Business

The Dutch DPA's €825M Uber fine makes GDPR Article 22 the most expensive automated-decision rule ever enforced. Here's what applies in Canada today — Quebec Law 25 s. 12.1, Bill C-36's PPCDA, Ontario hiring disclosure — and what's coming from Europe next.

Data Protection & Cybersecurity • August 21, 2026

Client AI Use and the Waiver of Privilege: What Canadian Litigators Need to Know

Can a client waive solicitor-client privilege by using ChatGPT? Heppner, Warner, and the Canadian doctrine every litigator needs to know—plus a five-step protocol.

Data Protection & Cybersecurity • August 20, 2026

Quebec Law 25 for SaaS: The Privacy Law Startups Ignore Until Procurement Asks

Law 25 is fully in force and applies to any SaaS company handling Quebec residents' data — no thresholds. Privacy officer, PIAs, consent, breach rules, and penalties up to 4% of global turnover.

Product Counsel • August 13, 2026

Does SOC 2 Cover Your AI Model?

Your SOC 2 report says nothing about your model. What the Trust Services Criteria actually cover, the AI-specific gaps buyers now probe, and where ISO 42001 fits.

Business Transactions • August 5, 2026

Acquiring an AI Company? The Training-Data Diligence That Determines What You Actually Own

Standard tech diligence assumes the target's core asset is code. With an AI company, you're buying data rights — and most of them are undocumented. The five workstreams that surface what you actually own.

Business Transactions • August 5, 2026

Business Acquisitions and PIPEDA: The Data Diligence That Deals Miss

PIPEDA's s. 7.2 business-transaction exception lets customer data move with a deal — but its conditions are more constrained than most deal teams assume. The diligence that protects value.

Data Protection & Cybersecurity • July 30, 2026

Reviewing AI Model Training Data Rights: The Chain-of-Title Problem

Before you can rely on an AI model's outputs, you need to know where its training data came from. Here's how to review chain-of-title across licensed, scraped, customer, and synthetic data.

Product Counsel • July 28, 2026

Do Enterprise Buyers Actually Care About Your AI Governance Policy?

Enterprise buyers don't read your AI governance policy document. They care about five specific artifacts it produces. Here's the difference, and why it matters for how you build it.

Data Protection & Cybersecurity • July 6, 2026

Canada's CDBA Draft Regulations Are Here: What Fintechs Need to Prepare For

The draft Consumer-Driven Banking Regulations published June 27, 2026 fill in the operational details — four accreditation pathways, security requirements, consent architecture, record keeping, and liability rules. Here's what fintechs need to know before the August 26 consultation deadline.