Privacy and Cybersecurity Law

The most valuable asset class in the world today is data, and the most valuable sub-set of data is personal data. Each act relating to personal data creates legal issues. Collection, use, processing, transfer, storage and deletion of personal data all have specific rules and regulations that must be followed. Failure to do so may result in a data breach with serious commercial and even criminal consequences. This is the sophisticated and complex world of personal data privacy.

Experienced lawyers in Tanner De Witt’s Privacy practice provide contentious and non-contentious legal advice in Hong Kong to international clients in relation to privacy, cybersecurity, data breach issues and investigations.

We are the exclusive law firm member in Hong Kong of PrivacyRules, an international alliance of privacy experts that combines legal, technical, and data related expertise to assist clients globally with a multi-disciplinary and multilingual approach. Pádraig Walsh also chairs the Know How and Training Committee of PrivacyRules. Pádraig is also a member of the Data Protection Substantive Law Committee of the iTech Law Association. He is also accredited by the International Association of Privacy Professionals (IAPP) as both a Certified Information Privacy Professional/Asia (CIPP/A) and a Certified Information Privacy Manager (CIPM).  These accreditations certify proficiency in the key data privacy practices of major Asian economies, including Hong Kong.

We provide legal services relating to personal data privacy, cybersecurity and data breaches.

Non-contentious advice

We regularly advise on:

  • privacy policies and information collection statements
  • privacy process and compliance reviews
  • legal issues to consider in privacy impact assessments
  • data processing and transfer agreements
  • Hong Kong issues in international personal data transfers and processing
  • privacy by design and privacy by default advice
  • management of responses to data access requests
  • privacy issues in emerging technologies, such as artificial intelligence, blockchain, cloud computing and 5G
  • privacy issues in specific sensitive industry sectors, such as healthcare, life sciences, and education

Contentious and crisis advice

A data breach has the potential to seriously affect the reputation, value and standing of a business. When a data breach occurs, the business must respond swiftly. Working in conjunction with experienced lawyers in our litigation team, we provide clients with strategic advice on data breaches and cybersecurity issues, and represent clients in any enforcement actions, regulatory inquiries, investigations or litigation that may follow. We will assist on issue identification; applicable law assessment; information and data collection; risk and harm assessment; notification assessment; and reporting requirement review.


Lawyers in our Privacy team have advised on:

  • regulatory and compliance advice to a professional services firm on the migration of personal data of Hong Kong data subjects to cloud platforms with data centres located outside Hong Kong
  • data transfer and processing agreements, and related advice, in respect of sharing of personal data between operating entities in Asia Pacific for a multi-national property services firm
  • strategic advice on responses to Privacy Commissioner enquiries in relation to alleged data collection and processing issues from the technology platform operated by an event management business
  • guidance on the relevance under Hong Kong law of GDPR compliance in respect of business operations in Hong Kong of various businesses operating in Asia Pacific
  • guidance on compliance with direct marketing rules for various business operating in Hong Kong
  • personal data process and compliance review for the Hong Kong operations of a US headquartered e-commerce business, including onsite interview, policy reviews, and team training


Tanner De Witt’s lawyers aim to provide practical and commercial advice, acting responsively in accordance with clients’ needs and preferences. Our team of Privacy lawyers works closely with clients, engineering options to reach desired results.

Tanner De Witt is the exclusive Hong Kong law firm member of PrivacyRules. PrivacyRules is an international alliance of privacy experts that combines legal, technical, and data related expertise to assist clients globally with a multi-disciplinary and multilingual approach. This international network of experts is easily accessible by our lawyers ensuring clients receive comprehensive advice that is tailored to their circumstances.