Shannon Kapadia

Drawing on law firm and in-house experience, including as counsel at a global cloud services provider, Shannon Kapadia translates growing legal and regulatory requirements into practical operational frameworks and risk-based business solutions.

Shannon counsels organizations across the software as a service (SaaS), healthcare, retail, education, and technology sectors. Her work includes developing privacy governance programs, data mapping and retention processes, risk assessments, vendor management procedures, and transparency disclosures. Shannon also helps companies deploying AI across their business build practical governance programs, including AI use policies, risk tiering and approval frameworks, transparency obligations, and AI vendor diligence.

Shannon helps clients address U.S. state and international privacy requirements, including California’s privacy laws, the European Union’s General Data Protection Regulation, and laws governing health, education, and children’s data. She assesses privacy risks associated with websites, marketing, cookies, loyalty programs, and other consumer-facing activities; conducts privacy and data governance diligence for mergers, acquisitions, and strategic investments; and advises on data security incidents and related regulatory obligations. Shannon also drafts and negotiates data processing agreements, business associate agreements, and technology contracts.