Skip to content

AI, technology & data protection lawyer

Raghav R Handa I help businesses and professionals use AI and data the right way.

For more than nine years I’ve advised companies, founders and professionals on AI, data protection and technology law. My clients sell and operate across the EU, UK, US, Asia, the Middle East and India.

I’m also a builder. LawyerOS, the legal practice system I created, is used by 3,000+ lawyers worldwide. So I know how technology is actually used at work, not just how the law describes it.

  • AI governance & policy
  • Data protection & privacy
  • AI & data audits
  • Technology contracts
  • Crypto & digital assets
I help
Startups · Professional firms · Growing businesses · Enterprises
Where
EU · UK · US · Asia · Middle East · India
Portrait of Raghav R Handa
Raghav R HandaFounder, Law Office of Raghav R Handa
Live from regulators

What I do

Six things I help with.
All of them, done properly.

The template trap

Three prompts in ChatGPT.
One wrong line. Millions in fines.

privacy-policy.docx · generated in 3 prompts

Privacy Policy

1“We do not sell or share your personal information.”

2“We never share your health information with third parties.”

3“By using this service, you consent to personalised advertising.”

4“Our chatbot’s answers are for general information only.”

  1. 1…while the site runs ad and analytics trackers.$1.2 million plus compliance changes and reportingSephora · United States
  2. 2…while data flows to advertising platforms.$7.8 million for consumer refunds and a ban on sharing health data for advertisingBetterHelp · United States
  3. 3…consent buried in terms isn’t valid consent.€310 million fineLinkedIn · Ireland
  4. 4…you’re still bound by what your chatbot tells customers.About CA$812 in damagesAir Canada · Canada

₹250 croreper breach under India’s DPDP Act

4%of global turnover under the GDPR

$7,988per violation under California law

A lawyer-drafted document

  • Matches what your product actually does
  • Covers every market you sell in
  • Lists your real vendors and AI tools
  • Consent and opt-outs that hold up
  • Reviewed by a lawyer, kept up to date
Review my documents

Real cases. The policy wording above is illustrative.

AI policy & data protection

How I do it.
And why it works.

  1. 01

    Map

    Where your data and AI actually flow.

  2. 02

    Assess

    Against every law that applies to you.

  3. 03

    Draft

    Policies and documents written for you.

  4. 04

    Embed

    Settings, training and checklists that stick.

Fair use of data

Collect only what you need, for reasons people expect.

Right use of data

Lawful basis, consent and transfers, done properly.

Responsible AI

Human oversight, honesty about AI, no surprises.

Global by default

One business.
Every rulebook that applies to it.

27 country guides

European Union

  • GDPR
  • EU AI Act
  • ePrivacy
  • Data Act
  • NIS2

United Kingdom

  • UK GDPR
  • Data (Use and Access) Act
  • PECR
  • Online Safety Act

United States

  • CCPA / CPRA
  • State privacy laws
  • Colorado AI Act
  • COPPA
  • HIPAA
  • FTC Act

India

  • DPDP Act 2023
  • DPDP Rules 2025
  • IT Rules
  • CERT-In Directions

Asia-Pacific

  • China PIPL
  • Singapore PDPA
  • Japan APPI
  • Korea AI Basic Act
  • Australia Privacy Act

Middle East

  • UAE PDPL
  • DIFC & ADGM rules
  • Saudi PDPL

Latin America & Africa

  • Brazil LGPD
  • Nigeria NDPA
  • Kenya DPA
  • South Africa POPIA
9+ years
practising technology law
3,000+
lawyers use LawyerOS, software I built
27
country compliance guides
Fixed fees
agreed before we start

Working together

  1. 1Book a call
  2. 2Compliance check
  3. 3Fix-list & fixed fee
  4. 4Documents & ongoing support
How it works

Enforcement news

This is already happening.
Here’s what it cost.

All 43 cases
  1. RH / SYSTEMS / CONTEXT / JUDGMENT
    United States · 27 Aug 2026

    Marketing firms pay $930,000 over fake AI 'listening' ad service

    AI marketing claims must match what the product really does. Burying 'consent' in standard terms of service will not count as permission to collect sensitive data like voice.

    The lesson
  2. RH / SYSTEMS / CONTEXT / JUDGMENT
    Netherlands · Aug 2026

    Uber fined almost €825m for letting an algorithm switch off drivers' accounts

    If software makes a decision that seriously affects someone, such as their income or access to a service, a real person must be able to step in and the person affected must be told how it works. This is now the second-largest GDPR fine on record.

    The lesson
  3. RH / DATA / PERMISSIONS / PEOPLE
    South Korea · 11 Jun 2026

    Coupang hit with Korea's biggest ever privacy fine after insider data leak

    Insider access and key management are real breach risks, and regulators may also penalise unrelated tracking practices they find during a breach investigation.

    The lesson
  4. RH / SYSTEMS / CONTEXT / JUDGMENT
    United Kingdom · 24 Feb 2026

    Reddit fined £14.47m for not checking the age of its users

    Writing 'no children allowed' in your terms is not enough; if children are likely to use your service, you need working age checks and a documented risk assessment.

    The lesson

Free, no call needed

Read before we talk.
All free.

Questions people ask

Straight answers.
No legalese.

Ask your own

Using AI at work

Is it illegal to use ChatGPT, Claude or Gemini for client work?

No. No law bans using AI tools at work. The legal questions are about what you put in, whether your client agreed to it, and whether you checked what came out.

Is the free version riskier than the paid one?

Usually, yes. Free and personal plans may use what you type to improve the AI. Business and enterprise plans usually let you switch that off and offer stronger data terms. Check the settings before any client data goes in.

Are Copilot or Gemini inside Microsoft 365 or Google Workspace safer?

Often, because the business versions sit inside your existing data agreements. But the protection depends on your plan and settings, so check before you assume.

If the AI makes a mistake, who is responsible?

You are. Courts, regulators and clients treat AI output as your work. The AI company’s terms almost always say the same thing.

Who owns what the AI creates?

It is unclear. The US and many other countries only protect work made by a human. If ownership matters, add real creative input of your own and settle ownership in your client contract.

Clients & confidentiality

Do I have to tell clients I used AI?

Not always by law, but often by contract, professional rules or plain good practice. A simple test: if the client would care, tell them. In some places, chatbots and AI-generated images or video must be disclosed.

Can I upload client documents if I remove the names?

It helps, but it is harder than it looks. Addresses, deal values, dates or unique facts can still identify someone. Remove what you can, use a tool that doesn’t train on your data, and only share what the task needs.

My staff use AI on their personal accounts. Is that a problem?

It is the most common gap I see. Client data ends up in accounts you don’t control. A short policy and a company account for an approved tool fix most of it.

Policies & the law

I’m a one-person practice. Do I really need an AI policy?

Not legally, in most cases. But a one-page set of rules protects you when a client asks, and it costs very little to put in place.

Does the EU AI Act apply if I’m not in Europe?

It can. It reaches businesses outside the EU when their AI is used in the EU or its output is used there. If you have European clients or users, it is worth a check.

Which country’s law applies to me?

Usually the law where you are, and also where your clients or users are. That is why one business can face several sets of rules at once. I work out which ones matter for you.

What happens if I ignore all this?

Most often, nothing dramatic at first. The real costs show up as a lost client, a failed due diligence, a complaint, a contract claim or, for data breaches, a regulator fine. Fixing it early is far cheaper.

Working with me

What happens on the first call?

You tell me what you do and how you use AI. I ask a few questions and tell you honestly whether anything applies, and what I would do about it. If you don’t need me, I will say so.

How much does it cost?

Every engagement has a fixed fee, agreed before we start. You will know the full price before any work begins.

Do you work with clients in my country?

Very likely. I advise clients across the EU, UK, US, Asia, the Middle East and India, and bring in a local lawyer where you need one.

Is the information on this page legal advice?

No. It is general information to help you spot what might apply. Your situation depends on your facts, your clients and where you work, which is what the call is for.

Ready when you are

Tell me how you use AI.
I’ll tell you what applies.

One short call. Honest advice. No obligation.

Book a call