Legal & data compliance

Privacy is often treated as a legal checkbox; an afterthought that’s handled by adding a terms and conditions page or writing a privacy policy. But for users, it’s much more important than that. Privacy is something they experience directly when they share data, give consent, or try to have their information deleted.

These experiences are shaped by design choices. When legal and product teams aren’t working closely together, things can break down:

• Deletion requests can be missed because systems don’t give teams visibility
• Consent is collected in ways that are unclear, or not collected at all
• Privacy policies are hard to find or too complex for the average user to understand
• Users lose confidence or file complaints
• Teams disagree on what’s required and projects stall

Non-compliance due to the above breakdowns can be incredibly costly, from a brand reputation perspective and financially, if you suffer legal consequences. It’s important to note, these problems don’t just affect industries with strict regulation, like healthcare or finance, too. Any product that collects user data needs to get this right. Good design can’t fix compliance alone, but it can make the rules easier to follow, reduce friction, and help users feel informed and in control.

We work with product and design teams to help them embed better data practices into their work, especially when working on projects that are governed by strict legal or regulatory constraints. Our process focuses on clarity, alignment, and real-world implementation:

Understand the legal context

We help teams clarify which regulations apply to their product or region, whether that’s GDPR, HIPAA, CCPA, or another standard. We don’t give legal advice, but we do help surface which features or flows might carry legal weight in your specific circumstances.

Map user and data flows

We identify where personal data is collected, stored, displayed, or shared. This includes points like sign-up flows, consent mechanisms, data dashboards, user settings, and third-party integrations.

Align policies with UX

We translate obligations like the right to be forgotten or data access into practical UX patterns, backend workflows, and content changes.

Spot gaps and recommend improvements

From unclear cookie banners to difficult deletion paths, we highlight friction points and suggest how to improve them, often with sketches, flow diagrams, or concrete UX copy recommendations.

Collaborate with legal and technical teams

Where needed, we help mediate conversations between design, engineering, and legal teams to help bridge gaps and ensure compliance doesn’t become a blocker to good design.

Throughout, our focus is on helping clients make confident, well-informed choices by balancing legal requirements, technical feasibility, and user experience.

What this delivers

Depending on the scope and context, our support typically results in:

• A mapped overview of how personal data flows through the product
• Clear UX recommendations for improving consent, transparency, and access
• Draft user flows for data requests (e.g. access, deletion, portability)
• Input on how privacy policies are presented in-product
• Advice on aligning internal processes (like support tickets or CRM workflows) with external obligations