The Legal 500 > United Kingdom - Solicitors > London > Data protection, privacy and cybersecurity

Bird & Bird LLP's dedicated data protection group takes a sector-specific approach to data with notable expertise in the advertising, financial services, pharmaceuticals and health, luxury goods, technology and communications sectors. The practice handles matters at a national and international level; it recently advised Domino's Pizza on its GDPR and European privacy work and assisted Nespresso with its compliance work in over 30 countries. The team also has substantial cybersecurity knowledge, providing advice on all issues from compliance with data security breach requirements to data protection audits. Ruth Boardman and James Mullock jointly lead the department; other key names include Guadalupe Sampedro, who has notable expertise in EU data protection law and financial services and payment matters, and Gabriel Voisin, who has experience in adtech and online advertising privacy issues and cybersecurity mandates. Legal director Elizabeth Upton advises clients in the technology and communications sector.

2018 saw Bristows LLP build on its already well-established position in the data protection field with the recruitment of the 'outstanding' Marc Dautlich from Pinsent Masons LLP; Dautlich is particularly active in the technology, financial services and fintech sectors. Practice head Mark Watts has notable expertise in advising US-based clients and regularly handles global compliance projects and regulatory litigation; Christopher Millard focuses on the technology and communications sectors; and Robert Bond has experience in compliance work, data incidents, cyber attacks and issues relating to health and children's data. As a whole, the practice excels in high-profile and international work; recent examples include Google's right to be forgotten case and British Airways' data breach. Its notable areas of expertise encompass compliance projects, regulatory litigation and product launches. Clients also single out 'excellent' senior associate Hannah Crowther.

Fieldfisher's privacy, security and information law group handles the full spectrum of data issues at a national and international level, including GDPR readiness programmes, data transfers, binding corporate rules, cyber and data security breaches, incident response readiness, data subject rights requests, freedom of information matters and data disputes. Hazel Grant heads up the practice and regularly acts for health, charity and public sector clients. Other noteworthy practitioners include Phil Lee, who has substantial US experience and has considerable expertise assisting cloud, social media and online advertising clients; Antonis Patrikios, who leads the firm's cybersecurity practice; Leonie Power, who focuses on advertising technologies, cross-border matters and e-marketing; and director Nuria Pastor. Compliance specialist Judy Krieg is also a name to note.

Eduardo Ustaran heads up the practice at Hogan Lovells International LLP, which acts for a broad range of high-profile clients including technology companies and financial institutions. The team handles the full range of data protection, privacy and cybersecurity issues including compliance programmes, data transfers, data breaches and global privacy mandates; it has substantial expertise in binding corporate rules and international data transfers, and is also a key name for GDPR work. The group also benefitted from the recruitment of Nicola Fulford from Kemp Little LLP; she regularly acts for technology-rich businesses. Counsel Sian Rudgard is noted for her binding corporate rules expertise.

Under the leadership of Richard Cumbley, Linklaters LLP excels at international work alongside its experience in complex UK-focused matters. The group is also recognised for its knowledge of the fintech, digital health and technology sectors; it counts Bupa, HSBC and Experian as clients. Areas of focus for Cumbley include data security incidents, privacy litigation, regulatory matters and subject access issues. Other key individuals include Julian Cunningham-Day, who has recently been active advising on GDPR projects for global clients; senior privacy counsel Peter Church, who is a noteworthy name for technology issues; and Georgina Kon, whose recent work includes advising on GDPR implications, international data flows and the privacy aspects of big data projects and digitalisation. Managing associate Alaister Johnson is also recommended.

Allen & Overy LLP has made substantial investments in its data protection team over recent years and also benefits from the expertise of special adviser David Smith, the former deputy information commissioner at the UK ICO. The practice handles the full spectrum of data issues including compliance work, transactional support and contentious issues. Jane Finlayson-Brown and Nigel Parker jointly lead the team; Finlayson-Brown is experienced in compliance work and Parker focuses on cybersecurity mandates. The group also draws from the wider partner pool for cybersecurity work including litigator Lawson Caisley, employment specialist Sarah Henchoz and IP litigator Mark Ridgeway.

Baker McKenzie's data protection team leverages the firm’s global network to provide international clients with multijurisdictional advice. Recent areas of expertise for the practice include substantial GDPR compliance projects, breaches and incident response assistance including investigations, notifications and regulated sector issues; and advising third-party providers on the practical implementation of data protection compliance programmes. IT and commercial partner Harry Small heads up the department and assists with contentious and non-contentious mandates including major data protection programmes and data security breaches; other key individuals include Julia Wilson , who leads the employment data protection group; David Halliday, who leads on data security breaches; and Ben Allgrove, who regularly acts for digital media clients. Dyann Heward-Mills left to set up her own DPO company.

Dentons’ data protection and privacy expertise encompasses GDPR implementation mandates, governance issues and global compliance projects including privacy compliance programmes and complex international data transfer projects. The dedicated team acts for a high-profile client roster, which counts John Lewis, Royal Mail, Virgin Atlantic, Aviva and First Data as key examples; it also regularly advises digital media companies on profiling, data analytics, social media, apps and location-based services as well as e-privacy regulations. The group also has experience in cyber risk management and regularly partners with cybersecurity experts to deliver both legal and forensic advice. Newly promoted partner Simon Elliott and Nick Graham jointly lead the department; Elliott has particular expertise in GDPR implementation projects and Graham is also global chair of the firm’s privacy and cybersecurity group. Martin Fanning, Scott Singer and Glasgow-based Ross Nicol are also recommended.

At DLA Piper, Andrew Dyson and Ross McKean jointly lead the data protection, privacy and security group from Leeds and London respectively; Dyson has notable focus on the financial services, technology and consumer sectors, while McKean handles global data governance and compliance work, breach response issues and global sourcing projects. Alongside the firm’s national network, it also regularly handles international mandates utilising its global offices; in a recent highlight, Dyson acted for Reckitt Benckiser on the roll out of its global data protection compliance programme across Europe, the US and other overseas jurisdictions. Other high-profile clients include 21st Century Fox, Chubb Insurance, Aviva, the London Stock Exchange and Condé Nast International. Senior consultant Simon Persoff is also a key name for financial services clients.

Paula Barrett heads up the privacy and cybersecurity law team at Eversheds Sutherland (International) LLP, which sits as part of the firm’s wider international privacy and information law group. The dedicated practice assists with the full spectrum of data protection work with particularly notable expertise in freedom of information law matters and cybersecurity issues including cyber readiness work and data security breaches. Liz Fitzsimons, who is based in Cambridge, leads the firm’s freedom of information and environmental information regulation group and regularly assists with GDPR and privacy programmes including data audits, breach management issues and access requests. Birmingham-based Gayle McFarlane focuses on the retail, technology, automotive and manufacturing sectors and also handles data transactions and issues involving the interaction between data protection and technology.

With a traditional focus on non-contentious data protection work, the group at Latham & Watkins has notably expanded its contentious and regulatory investigations expertise through the experience of litigator Ian Felstead. In a notable highlight, the practice advised Facebook, a new client for the group, on its response to a late-2018 data breach including handling the regulatory investigation and defending it against related litigation. Department head Gail Crawford is also global co-chair of the firm’s technology transactions group; she recently led advice to the BT Pension Scheme, the UK’s largest corporate defined benefit pension scheme, on its GDPR compliance programme and local UK data protection law. Ernst & Young, Majestic and William Hill are also noteworthy clients. Fiona Maclean was recently promoted to the partnership; she has substantial expertise in outsourcing issues, technology transformation projects and cloud computing mandates.

PwC LLP’s data protection strategy comprises its legal team alongside risk professionals, operational specialists, consultants, strategists and cyber security experts to provide comprehensive data protection advice including compliance issues, breaches and e-privacy work. Clients include British American Tobacco, Capita, Met Office, Sainsbury’s Bank and Visa Europe are also clients. Key practitioners include James Drury-Smith, who heads up the non-contentious side of the practice, and Polly Ralph. Fedelma Good and risk professional Jane Wainwright are also noted.

Taylor Wessing LLP excels in the technology sector and has substantial regulatory and corporate expertise. The practice also leverages the firm’s global network to advise on multijurisdictional projects including international data privacy compliance programmes and enforcement actions. Department head Vinod Bange acts for clients across a range of sectors including the technology, financial services, life sciences and healthcare industries; he recently advised Callidus Software on the data privacy aspects of its $2.4bn acquisition by SAP. Litigator Paul Glass heads up the cybersecurity practice and regularly handles cyber-attacks, crisis management issues and regulatory investigations.

Clifford Chance focuses on cross-border work, acting for a substantial international client base including multiple FTSE 100 and Fortune 500 listed companies. It is noted for its expertise in data ethics and AI issues; recent work includes assisting clients with creating ethical frameworks for the use of data, AI and data science. Jonathan Kewley leads the UK team, which sits as part of the firm’s global practice and also leverages the strength of other departments including the corporate, employment, antitrust and litigation teams. Kewley’s recent mandates include advising a global bank on ethical issues regarding the use of data and technology, and assisting a global financial institution with its global cyber incident response plan. Luke Tolaini is recommended for cross-border crisis management and investigations involving financial crime.

Harbottle & Lewis LLP has notable expertise in the technology, media and entertainment sectors acting for a client roster, which includes The Pokémon Company International, Comic Relief, the Harry Potter Theatrical Production and Virgin. The team handles contentious and non-contentious mandates and takes a cross-departmental approach utilising the commercial, employment and litigation teams. Sacha Wilson also enhances the firm’s strength in the data privacy aspects of marketing, adtech and digital media. Daniel Tozer leads the technology and data practice and focuses on commercial data protection. Senior partner Gerrard Tyrrell leads the group’s contentious work and John Kelly regularly acts for private individuals.

Herbert Smith Freehills LLP fields distinct data protection and cybersecurity practices led by Miriam Everett and Andrew Moir respectively; Everett was promoted to the partnership in 2019. Nick Pantlin is general head of the TMT and data practice and has recently been active advising clients on data protection and cyber security issues related to the use of new sourcing delivery models, data analytics and the commercialisation of big data; and Christine Young heads up the employment-related data protection and data subject rights practice. The data protection group’s expertise includes GDPR compliance advice, data transfers, data subject access requests and binding corporate rules and also benefits from the firm’s global network to assist with cross-border mandates; it recently advised Hays on its data protection practices across Europe including a full review as part of its GDPR compliance project. Marcus Turle is also recommended.

Marcus Evans leads the group at Norton Rose Fulbright, which regularly assists with export solutions, data audits, data product advice, regulatory issues, data breaches and data subject access requests. Evans and newly promoted partner Lara White are the key contacts for non-contentious matters, while Ffion Flockhart handles contentious data work; IP practice head Mike Knapper also contributes to the practice. The department has notable expertise in the financial services, healthcare, life sciences, telecoms and technology sectors; key clients include PayPal, Deliveroo, BMW and the Bank of Montreal. Recent highlights include Evans, Ball and Flockhart advised AIG on its global data breach response service; and Evans assisting Mitsubishi Electric with multiple global personal data export projects.

Paul Hastings LLP’s EMEA privacy and cybersecurity practice is led by Sarah Pearce following her recruitment from Cooley (UK) LLP in 2018; Pearce’s expertise encompasses privacy impact assessments, risk management, international data transfers and privacy notices. The practice is particularly active in the financial services sector; American Express is a key client and Pearce recently advised it on the data protection issues related to certain additional payment services it is looking to offer. The group also regularly handles international compliance issues with a notable focus on GDPR mandates, and works alongside the firm’s global litigation team to manage international investigations and disputes.

At Pinsent Masons LLP, Claire Edwards, David Barker and Ian Birdsey lead the practice, focusing on advisory work, litigation and cyber issues respectively. On the advisory side, the group is noted for its expertise in the financial services and technology sectors. The firm’s litigation strength also extends to the technology sector with Barker recently acting for Google in the High Court in two right to be forgotten cases and defending the same client in a landmark data protection class action relating to iPhone cookies. The cyber team regularly handles cross-border breaches and has developed separate US and EU/GDPR desks. Cerys Wyn Davies leads the information law practice in Birmingham. Former global practice head Marc Dautlich joined Bristows LLP.

The practice at RPC is jointly led by Jon Bartley and Richard Breavington specialising in non-contentious issues and cyber breach responses respectively. The team handles the full spectrum of data issues for a client roster spanning the technology, media, professional services, retail and food and drink sectors; noteworthy examples include Associated Newspapers, McArthurGlen Group and Shiseido Group. In a recent non-contentious highlight, Oliver Bray advised Paddy Power Betfair on its GDPR project; contentious work included defending the author of the ‘Trump dossier’ in a High Court data protection claim brought by three Russian oligarchs, and acting for Refinitiv in multiple data protection claims relating to the inclusion of individuals in its ‘Know Your Customer’ database. Keith Mathieson is also highly regarded in the space and is active in issues involving privacy and the misuse of personal data.

Simmons & Simmons’ sector-focused approach to data protection spans the financial services, TMT, healthcare and life sciences sectors with HSBC, O2 and Monzo Bank as notable example clients. The cross-departmental group is led by TMT partner Alexander Brown and includes individuals from the ICT, employment and dispute resolution practices; key names include Lawrence Brown, who focuses on data protection compliance for financial institutions; and litigator Robert Allen, who handles contentious subject access requests, right-to-be-forgotten issues, breach responses and data incident notifications. The practice also leverages the firm’s international reach to handle cross-border mandates. George Morris was also recently promoted to the partnership.

Travers Smith LLP handles a range of complex data protection issues including data protection audit and policy work, data collection and consent issues, e-marketing work, security breaches and international data transfers. The group also has substantial GDPR expertise; it recently advised Caffé Nero, Muzinich & Co, Fortress Investment Group and Office Retail on their GDPR compliance programmes. Group head Dan Reavill regularly assists on data protection, information security and confidentiality issues and Louisa Chambers focuses on the retail, pensions, leisure and financial services sectors. James Longster was promoted to the partnership in 2019; he has significant expertise advising on the data protection aspects of IT and outsourcing transactions, cross-border deals and the exploitation of data obtained by consumer-facing businesses.

Womble Bond Dickinson (UK) LLP’s national network handles contentious and non-contentious matters for UK high-profile UK clients including Kingfisher, the Post Office, Network Rail and NHS Digital. The practice is also noted for its expertise in the retail, financial services and public sectors, and regularly handles cross-border mandates, leveraging the firm’s global network. Team head Andrew Kimble leads the data, privacy and freedom of information team and assists with outsourcing projects, data transfers and data licensing issues. Other key individuals include litigator Andrew Parsons, who focuses on disputes and investigations; Mark Gleeson, who joined from Browne Jacobson LLP in 2019 and specialises in information law; and legal director Peter Given. Jackie Gray moved in-house.

With substantial expertise in the life sciences sector, Arnold & Porter’s practice includes specialists from the employment, commercial, IP, technology and regulatory practices. The group also acts for clients in other highly regulated sectors, advising on the interplay between data protection and regulatory frameworks. Richard Dickinson leads the practice and focuses on transactional mandates, Rob Bratby handles regulatory and transactional work in the telecoms, media and technology sectors; and employment partner Henry Clinton-Davis assists employers with data protection issues relating to employees and HR data transfers outside the EEA.

DAC Beachcroft LLP’s sector-focused approach primarily focuses on the insurance and health sectors with additional expertise in the cyber and technology spaces. The information law group handles contentious and non-contentious mandates under the leadership of Rhiannon Webster; Webster is noted for her experience in data protection compliance work, cross-border personal data transfers and data breaches and ICO complaints. The firm’s cyber and data risk team is headed up by Hans Allnutt, who primarily acts for insurers in claims involving financial institutions, professionals and technology companies. Newly promoted partner Jade Kowalski, Anne Crofts and Alistair Robertson also contribute to the team.

Building on the firm’s national strength, Farrer & Co’s international client base has increased thanks to Ian De Freitas’ expertise; he also has notable experience in ICO investigations and data breaches as well as GDPR compliance work. Henry Sainty leads the data protection and freedom of information department, which is active in GDPR and e-privacy matters; other areas of knowledge include information sharing issues, breach management and litigation. The group is also particularly noted for its safeguarding expertise, regularly advising schools, universities, sports governing bodies and religious organisations on information sharing and child data; and also assists public authorities with freedom of information issues, public sector information and environmental information regulations.

Lewis Silkin LLP’s specialist areas of expertise include the data aspects of employment law, consumer and commercial law, defamation issues and advertising regulations. The group also has particular sector focuses including advertising, technology, sports, media, professional services, retail and hospitality sectors; clients include Viacom, Lush, Fulham Football Club, Cineworld Cinemas and Omnicom Group. The data and privacy group is jointly led by Bryony Long and employment specialist Alexander Milner-Smith; other practitioners include Nathalie Moreno, who has experience in global data protection audits and compliance implementation programmes. Former practice head Nick Walker departed and Simon Morrisey joined Eversheds Sutherland (International) LLP.

Mishcon de Reya LLP counts both private individuals and corporates as clients and regularly handles GDPR compliance work, litigation and data transfers and other transactional matters. For private clients it has noteworthy expertise in subject access requests and also regularly acts for individuals in litigation; in a recent highlight the team represented Richard Lloyd as the representative claimant in a data protection claim against Google relating to the alleged secret tracking and collation of the personal data of iPhone users. Adam Rose heads the department, which also fields non-lawyer cyber security specialists. The department was also recently bolstered by the arrival of data protection advisor Jon Baines; he was previously at National Rail and is also the chair of the National Association of Data Protection and Information Law Officers.

The practice at Orrick, Herrington & Sutcliffe (Europe) LLP stands out for its technology sector focus and high-profile technology clients; key clients include Microsoft, Fujifilm and Go Pro. The group also has a track record in high-profile investigations including advising on privacy investigations by the ICO, the UK Federal Trade Commission and the French CNIL. Keily Blair and James Lloyd joined as partners from PwC LLP in early 2020 to launch a cyber and data privacy litigation & regulatory enforcement practice in London; managing associate Colin Hinds also has experience in online profiling issues, cookies and marketing work, and international data transfers.

Ropes & Gray LLP focuses its efforts on US-related data protection mandates with expertise advising clients in the private equity, asset management, education, healthcare and life sciences sectors. The team has been particularly active in compliance and advisory work and also handles data breaches, crisis response work and regulatory investigations, regularly working with the firm’s risk, investigations and regulatory enforcement partners. The firm’s US strength also makes it well placed to advise on the California Consumer Privacy Act and international data transfers. Rohan Massey heads up the practice and advises on data protection, data security, brand protection, e-commerce and IT matters. Counsel Clare Sellars is also a key name to note.

Jonathan Kirsop leads the data protection and information team at Stephenson Harwood, which handles the full spectrum of data protection issues including GDPR compliance, data breaches, subject access requests and international data transfers. The team advises a client roster spanning the financial services, retail, life sciences, shipping, charity, aviation, rail and professional services sectors; notable examples include BTG, The Movember Foundation and Deloitte. Barclays Bank is also a key client, which Kirsop recently advised on its GDPR compliance. Litigator Ben Sigler is the main contact for contentious data protection issues, particularly subject access requests.

White & Case LLP’s data, privacy and cybersecurity group handles a variety of data protection advisory work, corporate and transactional support issues, and litigation. The team leverages the firm’s global network to assist with international data matters; it represents Facebook in any disputes outside the US and advised Nestlé on global compliance issues. Deutsche Bank, Boeing and Oasis Fashion Holdings are also clients. Tim Hickman heads up the London practice and advises on all aspects of UK and EU privacy and data protection law; counsel Deborah Lincoln is also recommended for data issues arising from corporate transactions.

Wiggin LLP acts for a high-profile client roster of media and technology clients, with notable examples including Netflix, HBO, Disney, Marvel and Virgin Media. The group has recently been active advising on personal data matters; it assisted Netflix and HBO with the processing of cast and crew data and GDPR issues. Other areas of expertise for the practice include contentious data protection work, cybersecurity breaches, regulatory investigations and cross-border projects. David Naylor and Alexander Ross jointly lead the department; Naylor focuses on transactional and advisory work and Ross has notable expertise in digital rights. Caroline Kean is the key contact for contentious matters.