Craig Carpenter said the law firm dynamic was not for him, so he decided to work in more business-facing roles as a practicing lawyer after working at a firm from 1997 to 2000. In 2006, he became the general counsel of the e-discovery company Recommind and stayed in that role until 2013.

Last year, he became the CEO of X1, a data search tool that can be used for e-discovery and is now also being used to track data to help companies comply with laws like the California Consumer Privacy Act, or CCPA, and the European Union's General Data Protection Regulation, GDPR. He is based in San Francisco.

Carpenter spoke to Corporate Counsel on Wednesday about how X1 is being used in the wake of these new data privacy laws and skills GCs who hope to move to the C-suite should have.

This conversation has been edited for clarity and length.

Corporate Counsel: What skills have you taken from your time as a general counsel that you feel are beneficial to you now as CEO?

Craig Carpenter: You have to look at things from the general counsel perspective. I grew up and live in Silicon Valley, and that is not at all how Silicon Valley looks at the world. It is very much "I'm going to build the greatest piece of technology, and you're going to get it because you need it." That is not how GCs look at the world at all. They look at the world as "I have five things right in my face that I have to deal with. Unless you can materially assist me in being able to address one of those five, I don't have time."

Understanding how our technology can benefit them in a quantifiable and demonstrative fashion is critical. I don't think I would have that perspective if I had not been in their shoes.

CC: What advice would you give for a GC who is hoping to get into the C-suite of a company?

Carpenter: The reputation of GCs in the past is that they're really good at understanding risk, but they don't know the business. The first piece of advice I have is to know the business intimately. The second part that GCs don't understand is the world of sales and the customer because they don't tend to be as customer-focused. Any company, I don't care what you do, starts and ends with the customer.

If a GC can nail those down, then they have their natural area of strength, which is understanding the more esoteric areas of the business that are critical like risk, enterprise value and intellectual property and other areas that are naturally in their sweet spot. Those areas are not naturally in the sweet spot of people in sales or marketing.

Understanding all of that makes them better at their job. I came up on the marketing side in my business career. There was such a stark contrast when dealing with lawyers and GCs who understood the business and recognized their job was to support the business versus those who felt that law was the only thing that mattered. If you're in sales, that looks like a blocking function that doesn't add value.

CC: Does having a background as a lawyer better help you sell X1?

Carpenter: One hundred percent. The credibility factor for e-discovery is very important. If you and I walk into a room and we're talking to a GC and we don't understand the nomenclature or we haven't been in their shoes to at least some degree, out of the gate we lose credibility. From an empathetic perspective, GCs tend to not want to deal with people who don't understand their thoughts.

CC: How is X1 beneficial for compliance efforts when it comes to laws like the GDPR and CCPA?

Carpenter: In the privacy realm, being able to query thousands, if not tens of thousands of systems, simultaneously to see if they have personally identifiable information on them is particularly valuable right now. Just to understand what information is there and be able to form some sort of risk assessment and then decide whether or not to delete it is how our product is used.

We help people understand, technologically what information they have and where. In the context of GDPR, what we're seeing is that people are focused on the lower hanging fruit. They're thinking I've got to make sure my HR systems are locked down and make sure the databases with client information are locked down. Which makes sense, but where a lot of people are leaving a pretty gaping hole is what happens when you or I access that and print out a report? There are very few companies that are dealing with that yet.