Data-processing review
Mapping collection, use, disclosure, access, retention and deletion in order to identify the legal basis, documentation and controls relevant to each processing activity.
Dr. Dani Geagea advises on privacy policies, personal-data processing, supplier contracts and data incidents in Lebanon. For businesses serving European markets, the review also examines GDPR applicability and cross-border data responsibilities. It begins with how the business actually collects, uses, stores and shares information.
Begin with a brief description of your business and question. The scope and fees are agreed before work starts.
01
How the practice helps
Privacy notices & consent
Drafting and reviewing privacy notices, consent language, online forms and customer-facing explanations so that they reflect the organisation’s actual practices.
Vendors & data contracts
Reviewing data responsibilities in cloud, software, payment, marketing and other supplier arrangements, including confidentiality, security, assistance and incident obligations.
Incidents & cross-border data
Coordinating the legal analysis of data exposure, unauthorised access and international processing while preserving evidence and evaluating contractual or foreign-law exposure.
02
Legal context
Privacy is a governance question before it becomes a dispute.
Lebanon’s Law No. 81/2018 contains the principal general framework for personal data and electronic transactions. Depending on the facts, sector-specific duties, contracts, professional secrecy, civil or criminal rules and foreign privacy requirements may also matter. The correct analysis therefore starts with a documented data map rather than a generic policy.
03
Working with the office
Privacy policies and data-processing contracts
A review can cover the website or application, its privacy notice, consent forms and agreements with cloud, payment or marketing providers. These documents should be assessed against the data collected, its purposes, access arrangements and retention practices.
For related commercial terms, see internet and e-commerce contracts and technology and software agreements.
GDPR questions for businesses in Lebanon
Handling a European citizen’s data does not, by itself, establish GDPR applicability. Article 3 considers processing in the context of an EU establishment and, for organisations without one, processing connected with offering goods or services to people in the EU or monitoring their behaviour there.
The review identifies the relevant activities, locations and contractual responsibilities. Where advice on a foreign jurisdiction or local proceedings is required, appropriately licensed local counsel is involved.
Source: European Data Protection Board guidance on GDPR territorial scope.
Preparing for the first discussion
Describe your business, the countries in which it operates, the people whose data is processed and the question you need resolved. Identify any existing policy, supplier agreement, complaint or approaching deadline.
If the matter concerns a suspected data incident, mention when it was discovered and the systems involved. See cybersecurity and incident response for the related legal work.
04
Frequently asked questions
Direct questions deserve precise answers.
Does Lebanon regulate personal-data processing?
Yes. Law No. 81/2018 provides the principal general rules on personal data and electronic transactions. The applicable duties still depend on the processing activity, sector, parties and any cross-border elements.
Is a privacy policy enough for compliance?
No. A privacy policy should accurately describe real practices, but compliance also depends on internal controls, access, retention, security, vendor arrangements, responses to requests and incident handling.
When can foreign privacy rules affect a Lebanese business?
Foreign rules may become relevant through targeted markets, overseas customers or staff, contractual commitments, foreign group entities, vendors or processing operations. The answer requires a fact-specific jurisdictional analysis.
Professional enquiries
Discuss a privacy, GDPR or data-incident matter
Mention the countries involved, the type of data and any deadline. A short initial summary is enough; the office will explain the documents needed for review.
OfficePanorama Towers, T3, 21st Floor
Mar Roukoz, Lebanon
Telephone
For a faster initial review, mention the matter type, any approaching deadline, the parties’ locations and the documents available. Do not send highly sensitive information before the communication channel is confirmed.
General information only. This page does not constitute legal advice and does not create an attorney–client relationship.