The Schellman Blog

The CCPA cybersecurity audit requirement, part of California’s 2025 privacy regulations, is now in effect for many organizations. In this video, Chris Lippert, director of Schellman’s privacy practice, explains who must comply, when reports are due, and how to scope the audit.

If you’re a vendor looking to do business with Microsoft, you may be required to complete the Supplier Security and Privacy Assurance (SSPA) program as part of the procurement process. The SSPA program is Microsoft’s mechanism for evaluating whether suppliers meet its baseline security, privacy, and AI governance expectations outlined in the Microsoft Data Protection Requirements (DPR).

As data privacy expectations continue to rise, organizations operating in the cloud are facing growing pressure to prove compliance with the EU’s General Data Protection Regulation (GDPR). For cloud service providers (CSPs), one of the most relevant and practical ways to demonstrate that compliance is through the EU Cloud Code of Conduct—a voluntary, sector-specific framework designed specifically for the cloud industry.

Chris Lippert, Director of Schellman's Privacy Practice, is here to answer the most frequently asked questions surrounding Global CBPR and PRP Certification, including what it is, why it's important, who should adopt it, and how closely CBPR and PRP align with other privacy initiatives.

Chris Lippert, Director of the Privacy Practice at Schellman, is here to answer the most frequently asked questions surrounding the ISO 27701 standard, including why it’s important, who should adopt it, and how closely it aligns with other compliance frameworks.

Chris Lippert, Director of the Privacy Practice at Schellman, details the exciting news of the APEC Cross Border Privacy Rules (CBPR) system officially going global.

Microsoft’s Supplier Security and Privacy Assurance (SSPA) program received a major update with Version 10, which took effect on September 23rd, 2024. This update introduced new requirements, particularly around artificial intelligence (AI) and ISO 42001 compliance.

Like most organizations today, you've probably noticed an increase in privacy questionnaires in addition to the already existing security questionnaires from your customers. This is likely driven by the General Data Protection Regulation of 2016, otherwise known as the GDPR, and your organization is probably trying to figure out what the next best step is for you to take. In this video, we'll walk through some of our offerings related to GDPR as well as the pricing, scoping, and cost structure involved there.