Kim Phan

Kim is a privacy, data security, and regulatory compliance attorney who provides strategic guidance to companies throughout their business cycle. From product development, marketing, and implementation to breach prevention and response, she provides practical and forward-thinking advice that helps clients to mitigate risk and achieve their goals. Kim has worked with clients across all major industry sectors, and offers particular depth in consumer financial services, retail, hospitality, higher education, and energy.

Kim provides comprehensive advice on federal and state privacy and data security statutes and regulations, helping organizations to incorporate privacy and data security best practices throughout all aspects of their business, including the development and deployment of artificial intelligence. Her experience ranges from helping clients establish effective data governance programs to preparing for, assessing, and responding to data breaches.

With an extensive background in artificial intelligence, e-commerce and mobile issues, Kim regularly counsels clients on updating and enhancing website privacy policies, adapting website functions for accessibility in compliance with the Americans with Disabilities Act (ADA), and establishing employee training on social media interactions with consumers.

Kim’s regulatory compliance practice centers on helping clients with a wide range of state and federal investigations, enforcement actions, and other interactions. She regularly handles matters involving the Consumer Financial Protection Bureau (CFPB), the Federal Trade Commission (FTC), and other federal regulatory agencies. Kim has successfully represented multiple national companies through the FTC investigatory process, resulting in “no-action” letters, and has counseled clients through state attorneys general and departments of consumer protection investigations.

• Counseling a nationwide financial institution with establishing an artificial intelligence governance program in compliance with state AI laws.
• Drafted public comments for an international retail corporation on the CFPB open banking rules.
• Counseled a national automotive manufacturer on navigating evolving legal standards relating to telematics, biometrics, and other privacy issues.
• Assisted a retail client with the adaption of an augmented reality mobile game.
• Counseled a national consumer reporting agency through its CFPB compliance obligations, including conducting risk assessments of consumer products and services, updating policies and procedures, and establishing an audit process to assess compliance with federal consumer finance laws.
• Assisted several clients in developing and launching mobile apps in concert with Apple and Google app store requirements, as well as during the appeals process.
• Provided guidance to numerous companies in responding to security incidents and data breaches.
• Negotiated security requirements for a vendor agreement to provide cloud storage services.
• Counseled a major credit card company in establishing employee training on social media interactions with consumers.
• Conducted online behavioral advertising assessments of websites to update and enhance the online privacy policies of various financial institutions.
• Assisted a national lender in establishing a Gramm-Leach-Bliley Act Privacy Rule compliance program, including drafting annual privacy notices.
• Assisted a major credit company in conducting a comprehensive unfair, deceptive, or abusive acts or practices (UDAAP) assessment of card member rewards programs.
• Represented a national consumer products retailer throughout the company’s response to an FTC enforcement investigation, resulting in a “no-action” letter.
• Counseled a national consumer reporting agency in preparation for CFPB examination, including conducting risk assessments of consumer products and services, updating policies and procedures, and establishing a compliance management system to address federal consumer financial laws, including the FCRA.
• Submitted public comments on behalf of an industry trade association in response to the CFPB’s proposed rule on larger participants in the debt collection market.

• Thomson Reuters Stand-out Lawyer (2024-2025) – independently rated lawyers
• Chambers FinTech Legal USA, Data Protection & Cyber Security (2020-2025)
• American College of Consumer Financial Services Lawyers, Fellow
• JD Supra Readers’ Choice Awards, Data Privacy (2025)
• Wonderful Women Lawyers of Color 2023
• Legal 500 United States for Fintech (2020-2021)
• Named a Top 50 Receivables Professionals of the Year by Receivables Advisor (2019)
• Recognized as one of the 25 Most Influential Women in Collections by Collection Advisor (2016)
• Named to Lawyers of Color’s Inaugural Hot List for 2013, recognizing 100 attorneys younger than 40