Designing a privacy compliance platform for non-lawyers
TerraTrue helps product teams document how their features use personal data, so companies can comply with privacy regulations like GDPR and CCPA. I joined as the founding product designer when only product concepts existed, working in 1-week design-and-build sprints. The people using the product, product managers and engineers, weren’t privacy experts.
The whole product depended on one question: how could non-experts accurately document how their product uses personal data without getting overwhelmed or leaving gaps that create compliance risk?
PROBLEM
Finding the friction in my first draft
The Data Spec is where teams document each launch. I started from a Google Doc with minimal instructions, and both the doc and my first pass framed privacy decisions at too high a level for people outside the privacy team.
The brief
The doc’s questions required written explanations, repeated themselves, and lacked a sense of progress.
First pass
I replaced most of the writing with predefined options grouped in accordions. Testing showed it created new problems: comparing options took too much clicking, and it still felt intimidating to first-time users.
PRINCIPLES
Setting principles for the redesign
Rethinking how to ask complex questions gave me 3 principles for the rest of the work:
Break privacy concepts into small, approachable steps.
Introduce complexity gradually.
Build a system that works across launches and teams.
FLOW
Turning the Data Spec into a guided flow
Instead of asking users to explain everything up front, I restructured the Data Spec into a step-by-step flow: Basics, Data Subjects, Data Uses, Data Types, Third Parties, and Consent, then Questionnaires if the company had written its own, and finally Review. Each step asks for one decision, and earlier answers shape the questions that follow, which keeps the load on users low without losing accuracy.
SCREENS
Designing each screen around one decision
Once the flow was set, I designed every screen around a single decision. The prompts use plain language instead of legal or technical terms, options are grouped visually instead of listed densely, and each screen has one clear primary action.
The harder questions come later. Data types and retention only appear after users have explained why they’re collecting data, so by the time they get there, they already have the context to answer.
UX polish isn't enoughwhen the underlying structure is wrong.
Impact
Lowering the barrier for non-experts
The guided Data Spec let product managers and engineers complete required privacy reviews without a privacy background. It also gave product, legal, and privacy teams a shared language, which made launch approvals faster and more consistent.
This work helped TerraTrue scale its enterprise workflows and was part of the foundation for its $15M Series A.
REFLECTION
Showing the easier questions first gave non-experts confidence before they reached the harder ones.
Designing reusable patterns kept the product consistent as more teams and launches used it.
TerraTrue was my first product designed from the ground up, and I built its design system in the same 1-week sprints as everything else. When requirements grew after components had shipped, their structures had to change, and that meant rework. Since then, I’ve planned every component before the build starts.
