Helena J. Engfeldt

Helena's practice is built around supporting data-driven businesses including consumer platforms, enterprise software, infrastructure, logistics and financial services companies.

Helena counsels companies operating across jurisdictions on how to design, defend, and execute business models in compliance with evolving global data privacy, cybersecurity, AI, and digital regulation, while enabling commercial objectives and strategic transactions. Clients engage Helena for advice in numerous contexts including product development, digital advertising campaigns, M&A due diligence, post-acquisition integration, international expansion, cross-border transactions, and employment.

• Advised 300+ companies in various industries with global privacy law compliance including the California Consumer Privacy Act (CCPA), the EU General Data Protection Regulation (GDPR), and privacy laws meant to protect children and health data (such as the Washington My Health My Data Act).
• Advises companies in M&A transactions from due diligence to pre-and-post acquisition integration with deals that span numerous countries and deal values ranging from less than 100k USD to billions of USD.
• Assists companies with designing, documenting, and scaling their global data privacy and AI compliance programs including in connection with risk assessments and cybersecurity requirements.
• Advises on data security incidents and responses including in the context of consumer, employee, and health data ranging from company identified vulnerabilities to ransomware and supply chain attacks.
• Advises on AI in HR and employee monitoring technologies and processes.
• Drafts and negotiates commercial agreements involving data sharing and digital advertising. 
• Assists and represents companies in connection with regulatory inquiries and investigations around the world.

• Shortlisted for Privacy & Data Protection Lawyer of the Year, Women in Business Law Americas Award, 2023, 2024

• Certified in U.S. and European privacy law (CIPP/US and CIPP/E) by the International Association of Privacy Professionals