Privacy counsel for a connected business.

Map one product journey before a change

Start with something a person does in your product: book a workshop, invite a teammate or delete an account. Follow the data through that action. You can use Lawtrades Agent to organize the description into a working map, then ask the people who run those systems to check it.

Try a filled-in example

Open the product data-map starter in Lawtrades Agent, then send this practice request as your next message:

Use this fictional workshop-booking app as a practice exercise. A visitor enters an email address and workshop choice. Our backend stores both in a registration database and sends them to an email provider for a confirmation. Organizers can view registrations. We propose adding an analytics service to measure completed bookings, but have not decided which fields to send. Deleting a registration removes the live database row; provider copies, logs and backups have not been checked. User locations, hosting locations and retention periods are still unknown. Turn this into a data-flow map. Separate stated facts, proposals and unknowns; give each unknown a question and a suggested owner. Do not invent vendor behavior or retention periods. Finish with a short packet to discuss with privacy counsel before deciding whether to enable analytics.

For your own product, use its existing conversation or start fresh from the same starter, keeping the practice facts separate. Describe categories and systems rather than customer records. Leave out credentials, security weaknesses and anything your company’s policies keep out of AI tools.

What a useful working map captures

An Agent response is a draft to check; it does not establish what your systems or vendors actually do.

Prepare the analytics decision packet

Bring counsel each proposed analytics field with its business reason, the current privacy notice, the proposed analytics service’s terms, and the checked map with its open questions. Ask what needs to change in the notice, user choices or vendor terms before those fields are sent.

Product owns the measurement goal; engineering verifies the implementation; counsel assesses applicable obligations and legal options before the team chooses a path.

Keep the resulting decisions beside the map: chosen fields, required changes, responsible person and what must be checked before release. Revisit them when the journey or vendor changes.

Give privacy counsel a decision to help you make

“Review our privacy” is difficult to scope. “Review the data-sharing terms for a new vendor before we sign” gives counsel a starting point.

Describe the decision, the deadline and the information available. Then identify who can confirm how the product or service actually handles data.

Match the brief to the work

Common starting points. The right scope depends on your matter.

Separate confirmed facts from open questions

A useful brief names the product, people and systems involved. It explains what information is collected or shared, why, where it goes, and what you know about access and retention. Include relevant locations and distinguish current practices from proposed changes.

You do not need to fill every gap before speaking with counsel. Mark unknowns and name the person who can help resolve them. For example: “Engineering needs to confirm how long the vendor retains these records.” That is more useful than copying a retention period from a policy that may describe a different system.

Describe categories of information in the initial brief rather than pasting customer records. Agree on an appropriate way to share supporting material. If this concerns an active security incident, say so at the start.

Agree who does what after the review

Discuss who will obtain missing facts, choose between options and carry out the changes, especially if counsel's role ends at legal review. Agree scope and fees with the professional, including how new questions will be handled.

For help documenting the underlying data flow, see the Legal Playbook for Data Mapping + Usage.