Lillian Tsang MBA

Lillian is an experienced data protection, privacy and AI lawyer, who qualified in England and Wales in 2008. She helps businesses navigate complex and fast-changing data laws with confidence, combining technical expertise with practical, commercially focused advice.

Lillian advises on both UK and international matters, from day-to-day compliance to complex cross-border projects. She also leads our Data Protection Officer as a Service (DPOaaS) offering, acting as an external DPO for businesses of all sizes.

Her work spans:

• data protection compliance reviews and gap analyses
• privacy policies and data processing agreements.
• Data Subject Access Requests (DSARs) and Data Protection Impact Assessments (DPIAs)
• personal data breaches and liaison with regulatory authorities.
• cross-border data transfers and global privacy compliance.
• AI governance and emerging AI regulation.

Earlier in her career, Lillian worked as a group financial services lawyer while also holding the position of group DPO, giving her first-hand insight into the practical challenges businesses face when implementing data protection requirements.

Her experience ranges from start-ups to large multinationals across a wide variety of sectors. She regularly advises on matters spanning several jurisdictions and regulatory regimes – from the California Consumer Privacy Act (CCPA) in the US and France's National Commission on Informatics and Liberty (CNIL), to data protection risk assessments involving India.

Lillian is also active in the artificial intelligence space, advising clients on AI governance and emerging regulation. She holds Certified AI Auditor (CAIA) and Certified AI Ethicist (CAIE) credentials, earned through the University of Oxford AI Programmes.

Lillian is passionate about making data protection easier to understand. She helps clients see compliance not simply as a tick-box exercise, but as an opportunity to build trust, strengthen their processes and support sustainable growth.

Outside of work, Lillian enjoys dining out and attending music festivals.

"Data protection isn't just black and white to me. I enjoy exploring the nuances – particularly where privacy and AI intersect – and finding practical solutions to complex, emerging challenges."