Short answer: if you sell SaaS or software and an enterprise customer just handed you a data processing agreement or a security questionnaire, you need a data privacy lawyer who works the vendor side. Aber Law Firm represents SaaS and software vendors, never the buy side, on the privacy documents that actually close deals: data processing agreements, privacy policies, data retention policies, and the security terms buyers push during diligence.
I am Jeremy Aber. I have spent years representing software and SaaS vendors, literally 100s and 100s of them, on their commercial and privacy terms. More about me here.
What a Data Privacy Lawyer Handles for Vendors
- Data processing agreements (DPAs). The addendum your enterprise customers attach to every deal. We draft your vendor-favorable form and review the ones buyers send you.
- Privacy policies. A plain English policy that matches what your product actually does, not boilerplate that invites an enforcement action.
- Data retention policies. A stated retention period, automated deletion, and access controls you can prove. See our guide to a defensible data retention policy.
- Security and diligence reviews. The DPA, subprocessor list, and security exhibit that ride along with the master agreement.
- State privacy law compliance. Mapping your data flows to the CCPA and the newer state laws so your contracts and your notices line up.
- Incident and breach terms. Notification timelines and responsibility splits that are workable for a vendor, not open-ended promises you cannot keep.
- Trust pages and privacy data sheets. The public page that answers a buyer’s security questions before they ask, so your sales cycle does not stall in diligence.
US First, GDPR Aware
Most of our vendors sell into the US market, so we start there. That means the CCPA and CPRA (enforced by the California Privacy Protection Agency), plus the wave of newer laws like the Virginia VCDPA, the Colorado CPA, and the Texas Data Privacy and Security Act. When you take on customers in the EU, GDPR becomes the second layer, and we flag that before it changes the shape of your DPA. Either way, the certifications buyers ask about, SOC 2 and ISO 27001, sit alongside the paper.
Why Vendor Only Representation Matters
We only represent vendors. That is the whole practice. When a buyer’s DPA lands on your desk with broad audit rights, uncapped data-breach liability, and a subprocessor approval veto, we know which terms are market and which ones to push back on, because we see them from your side every week. For the rest of your commercial paper, see our software attorney practice.
Related Privacy Reading
A few of our posts that go deeper: the data retention policy guide, what belongs on your trust site, privacy issues for app developers, and why a plain English privacy policy beats boilerplate.
Common Questions
Do I need a DPA if I only have US customers? Often yes. Enterprise buyers require one regardless of GDPR, and the CCPA and several state laws expect service-provider or processor terms in your contract. A short, vendor-side DPA usually satisfies both.
What is the difference between a privacy policy and a DPA? A privacy policy is a public statement of what you do with data. A DPA is a contract between you and a customer that governs how you handle their data as a processor. You generally need both, and they should not contradict each other.
How long should a SaaS company keep customer data? Only as long as the stated purpose needs, then delete it on an automated clock. Our data retention policy guide walks through how to set the period and prove the deletion.
Ready to talk through your privacy terms? Contact us to discuss your DPAs, your privacy policy, or an incoming security review.