Privacy and Cybersecurity

As data sovereignty requirements intensify across the EU and globally, businesses face a growing and increasingly complex web of restrictions on where personal and non-personal data may be stored, processed, and transferred. We advise clients on the full range of cross-border data transfer mechanisms available under the GDPR — including standard contractual clauses, binding corporate rules, and adequacy decisions — the EU Data Act and national law sovereignty requirements, and help them structure their data flows and governance architectures to meet applicable localization and sovereignty restrictions in the EU and rest-of-world.

We have particular experience advising global companies — including cloud providers, technology platforms, and multinational enterprises — on data migration and sovereignty projects spanning multiple EU and non-EU jurisdictions simultaneously. Where data flows implicate national security concerns, sector-specific restrictions, or the growing body of EU data localization requirements, we develop tailored strategies that are pragmatic, defensible, and aligned with both regulatory requirements and business objectives.

As GDPR enforcement intensifies and regulatory expectations continue to evolve, organizations must go beyond baseline compliance. We specialize in developing practical, risk-based GDPR and ePrivacy compliance programs across the full spectrum of obligations, with particular strength in advising global companies navigating the most complex and sensitive aspects of EU data law.

We advise on a broad range of data compliance matters, including the handling of sensitive and high-volume DSARs, employee monitoring programs, the processing of biometric and other special category data, and the rapidly evolving requirements applicable to AI-related personal data processing. We also advise on tracking technologies, cookie compliance, direct marketing, and AdTech. Our expertise across the broader EU Data and Digital Regulation landscape — including the AI Act, the Data Act, and the EU Health Data Space Regulation (EHDS) — allows us to provide holistic counsel that accounts for the full scope of obligations applicable to our clients' products and operations on the EU market.

As the EU cybersecurity regulatory landscape expands through the NIS2 Directive, the Cyber Resilience Act (CRA), and DORA, organizations face an increasingly complex web of overlapping obligations spanning incident reporting, vulnerability management, supply chain due diligence, and product security. We assist clients in determining whether and to what extent these frameworks apply to their operations and products, including entity and product classification, gap analyses, and the development of bespoke, pan-EU cybersecurity compliance programs tailored to each client's risk profile, sector, and operational footprint.

In the event of a data breach or other security incident, we are on-call for our clients until the issues are resolved — from initial internal investigation through regulatory notification, crisis communication, and follow-on enforcement proceedings and/or damages recovery. We have led complex incident response mandates involving incidents falling simultaneously under several overlapping regimes, including the GDPR, NIS2, DORA, and the CRA, and are able to provide a single integrated team managing the full regulatory landscape without duplication. In collaboration with our colleagues in the U.S. and the UK, and through our trusted network of local counsel, we consult on cross-border incidents worldwide and maintain relationships with forensic firms, auditors, and crisis communication firms to address both the legal and technical aspects of each incident. We also provide tabletop exercises and Board-level training to ensure your organization is prepared before an incident occurs.

Where regulatory scrutiny arises, we represent clients in investigations and enforcement proceedings brought by data protection and cybersecurity authorities, including the EU and Belgian DPA and sector-specific regulators. We have developed particular expertise in investigations and enforcement with a cross-border dimension, making sure our clients have one point of call when faced with enforcement that spans multiple EU (or global) jurisdictions.

We devise tailored strategies for responding to enforcement actions, regulatory audits, and individual complaints, in a strategic manner that blends in with your overall reputational and business strategy. Nothing we do is cookie-cutter unless you ask us to.

With our recovery and litigation specialists, we also defend clients in class action privacy and data protection lawsuits.

Data protection and cybersecurity considerations are increasingly central to the success of complex commercial and corporate transactions. We advise on the full range of transactional data protection, AI and cybersecurity matters, including the negotiation and drafting of data processing agreements, data transfer agreements, and cybersecurity contractual obligations arising under NIS2, CRA, and DORA — encompassing supply chain risk management protocols, audit rights, vulnerability notification obligations, and regulatory cooperation clauses.

As the regulatory landscape becomes increasingly complex, contracts grow in importance to solidify positions amongst parties to cover off risk contractually.

In M&A and other corporate transactions, we conduct privacy, AI and cybersecurity due diligence, identifying material compliance risks and data-related liabilities, and advise on post-closing integration, compliance and remediation strategies. We also advise on the cybersecurity and data protection aspects of complex technology transactions, including acquisitions and partnerships involving AI systems, connected products, cloud infrastructure, and other data-intensive technologies.