The team at DLA Piper handles the full gamut of matters for a stellar client base, which notably includes Hilton, Chubb, and Standard Chartered Bank. The practice assists with China CAC assessment projects and vendor due diligence, and exhibits broad expertise in the implementation of incident response plans, and the management of high profile incidents resulting in notifications to both regulators and affected individuals. Carolyn Bigg leads the team, utilising her expansive expertise in the implementation and management of data privacy regulation, in addition to data analytics and connected vehicle projects across the automobile and insurance sectors. Bigg is also noted for advising US and EU technology clients on expansion within China. Senior associate Venus Cheung is noted for her vast knowledge of Chinese regulatory compliance concerning IT infrastructure, the cloud, and apps. Since publication, Yue Lin Lee departed in March 2024.

Norton Rose Fulbright‘s team handles the full gamut of matters for a diverse client base of governmental and corporate data-rich entities within the healthcare and financial services sectors. The group offers expertise across a host of areas, regularly advising on export solutions, data subject request responses, and the location of data storage. Working out of both the Hong Kong and Brisbane offices, practice head Anna Gamvros  is known for her vast experience in assisting with multi-jurisdictional data management projects, privacy compliance issues, and e-commerce related matters. Associate Ruby Kwok  primarily focuses on regulatory issues within the Hong Kong and China TMT sectors, and cybersecurity and breach response protocols and associate Edward Yau is well versed in Australian privacy law, and handles cybersecurity incidents with cross-border elements.

The team at Bird & Bird regularly handles a varied range of mandates involving cross-border data transfer agreements, security breaches, and privacy impact assessments. The group has experienced an increase in data localisation and transfer matters after China’s implementation of the PIPL. The team frequently acts for clients from a broad range of sectors, including banking, technology, and transport, who collect and transfer sensitive data. Having joined the team from an in-house position at Tencent in November 2022, ‘one of a kind‘ practice head Wilfred Ng is noted for his broad experience in advising on data protection compliance and GDPR related matters.

Hogan Lovells provides broad expertise spanning an array of issues, including conducting compliance audits, the handling of personal data within M&A and joint ventures, and commercial arrangements involving the right to use personal data. The group regularly engages with clients seeking to integrate Asian data protection and cybersecurity policies with international regulations, and acts for clients in enforcement actions. Practice head Mark Parsons has a great deal of regulatory expertise, with particular emphasis on the technology and telecoms sectors, and often advises on data licensing and the exploitation of IT assets. TMT specialist Tommy Liu has deep knowledge of outsourcing issues and data privacy matters, while Eugene Low has vast experience in regulatory investigation, litigation, and data breach incidents.

Mayer Brown has strong regulatory capabilities when acting on mandates concerning national security and data security requirements within Hong Kong, and the implications of the PIPL. The group is also known for handling procedures in relation to ransom demands. The well known Gabriela Kennedy leads the team, and is noted for her experience in handling cyber incident responses, often advising on post incident strategies and responses to customers and regulators. Kennedy has broad expertise in the privacy aspects of digital transformation projects, including issues such as data audits, the sovereignty of data, and adequacy assessments under Hong Kong national security rules and GDPR. With ‘unparalleled‘ experience, TL Lim takes a ‘dynamic‘ approach when acting as a breach coach in notifications and communication strategies, often conducting workshops with international corporations.

Tanner De Witt‘s ‘excellent‘ team is praised for its ‘extraordinary skills‘ in handling the full gamut of issues for clients in sectors including banking and finance, hospitality, and manufacturing. The group exhibits deep expertise relating to personal data privacy, data breach notifications under the Personal Data Privacy Ordinance (PDPO), data processing agreements (DPO), and the data privacy aspects of advertising campaigns. Described by clients as a ‘deep thinker‘ and an ‘exceptional lawyer‘, practice head Pádraig Walsh is noted for his vast knowledge of the full range of Hong Kong data protection issues, including compliance regarding regulatory enquiries and data breaches, transfer impact assessments, and data processing and sharing agreements. Associate Tara Chan often assists technology companies and entrepreneurs with data privacy and governance issues.

Deacons houses a broad team which is known for providing comprehensive advice across the PRC and Hong Kong, frequently acting for clients across the hospitality, gaming, and IT sectors. The group handles a variety of matters, including negotiations with service providers, data flow regulations across various jurisdictions, and data requests from law enforcement agencies and data subjects. Charmaine Koo and Machiuanna Chu jointly lead the practice. Koo is noted for her contentious IP expertise, regularly handling compliance issues concerning the exploitation, transfer, and processing of data, in addition to impact assessments on projects. Chu leverages her longstanding commercial expertise to act for technology clients in the commercialisation of digital businesses. Dual qualified in Hong Kong and New Zealand, Kelley Loo handles a broad range of IP related mandates, in addition to privacy policies, and arrangements governing the sharing of data across groups of companies and jurisdictions.