Data-processing review
Mapping collection, use, disclosure, access, retention and deletion in order to identify the legal basis, documentation and controls relevant to each processing activity.
Dr. Dani Geagea advises on privacy policies, personal-data processing, supplier contracts and data incidents in Lebanon. For businesses serving European markets, the review also examines GDPR applicability and cross-border data responsibilities. It begins with how the business actually collects, uses, stores and shares information.
Begin with a brief description of your business and question. The scope and fees are agreed before work starts.
01
How the practice helps
Privacy notices & consent
Drafting and reviewing privacy notices, consent language, online forms and customer-facing explanations so that they reflect the organisation’s actual practices.
Vendors & data contracts
Reviewing data responsibilities in cloud, software, payment, marketing and other supplier arrangements, including confidentiality, security, assistance and incident obligations.
Incidents & cross-border data
Coordinating the legal analysis of data exposure, unauthorised access and international processing while preserving evidence and evaluating contractual or foreign-law exposure.
02
Legal context
Privacy is a governance question before it becomes a dispute.
Lebanon’s Law No. 81/2018 contains the principal general framework for personal data and electronic transactions. Depending on the facts, sector-specific duties, contracts, professional secrecy, civil or criminal rules and foreign privacy requirements may also matter. The correct analysis therefore starts with a documented data map rather than a generic policy.
03
Working with the office
Privacy policies and data-processing contracts
A review can cover the website or application, its privacy notice, consent forms and agreements with cloud, payment or marketing providers. These documents should be assessed against the data collected, its purposes, access arrangements and retention practices.
For related commercial terms, see internet and e-commerce contracts and technology and software agreements.
GDPR advice for Lebanese businesses handling European client data
Handling a European citizen’s data does not, by itself, establish GDPR applicability. Article 3 considers processing in the context of an EU establishment and, for organisations without one, processing connected with offering goods or services to people in the EU or monitoring their behaviour there.
The review identifies the relevant activities, locations and contractual responsibilities. Where advice on a foreign jurisdiction or local proceedings is required, appropriately licensed local counsel is involved.
Documents to prepare for a GDPR assessment
- A short description of the service, target markets and people whose data is processed.
- Current privacy notices, customer terms and any data-processing agreement requested by a European client.
- A list of hosting, cloud and other providers, including where data is stored or accessed.
- Any client compliance questionnaire, incident notice or response deadline.
The agreed review can cover applicability, contractual roles, privacy notices and cross-border data arrangements. Its scope and deliverables are confirmed before work begins.
Source: European Data Protection Board guidance on GDPR territorial scope.
Preparing for the first discussion
Describe your business, the countries in which it operates, the people whose data is processed and the question you need resolved. Identify any existing policy, supplier agreement, complaint or approaching deadline.
If the matter concerns a suspected data incident, mention when it was discovered and the systems involved. See cybersecurity and incident response for the related legal work.
04
Frequently asked questions
Direct questions deserve precise answers.
Can a Lebanese business request help with a European client's GDPR requirements?
Yes. The office can review the business model, the client's proposed data terms, the parties' roles and relevant data flows. The first step is to distinguish applicable legal duties from contractual requests. The scope and fees are agreed in advance, with locally admitted foreign counsel involved where required.
Can I request a remote consultation about private messages involving someone in Lebanon?
Yes. Send a brief summary, the countries involved and whether there has been a threat, disclosure or urgent deadline. The office first checks whether it can assist, then explains the proposed consultation, documents needed and fee. Whether any deletion request or other remedy is available requires an individual assessment; no outcome is promised in advance.
Does Lebanon regulate personal-data processing?
Yes. Law No. 81/2018 provides the principal general rules on personal data and electronic transactions. The applicable duties still depend on the processing activity, sector, parties and any cross-border elements.
Is a privacy policy enough for compliance?
No. A privacy policy should accurately describe real practices, but compliance also depends on internal controls, access, retention, security, vendor arrangements, responses to requests and incident handling.
When can foreign privacy rules affect a Lebanese business?
Foreign rules may become relevant through targeted markets, overseas customers or staff, contractual commitments, foreign group entities, vendors or processing operations. The answer requires a fact-specific jurisdictional analysis.
Professional enquiries
Discuss a privacy, GDPR or data-incident matter
Mention the countries involved, the type of data and any deadline. A short initial summary is enough; the office will explain the documents needed for review.
OfficePanorama Towers, T3, 21st Floor
Mar Roukoz, Metn, Lebanon
Telephone
For a faster initial review, mention the matter type, any approaching deadline, the parties’ locations and the documents available. Do not send highly sensitive information before the communication channel is confirmed.
Prepare an initial enquiry
These details stay in this page until you open WhatsApp or email. The selected service will then process them. Review and send the message there. Avoid confidential documents, passwords and account numbers.
An enquiry does not create an attorney–client relationship or suspend a deadline. The office first checks conflicts, scope and fees.
General information only. This page does not constitute legal advice and does not create an attorney–client relationship.