Lillian Tsang MBA

Lillian is an experienced data protection, privacy and AI lawyer, qualified since 2008 (England and Wales). She advises clients on a broad range of matters, from complex data protection issues to strategic compliance with a global perspective, as well as day-to-day operations.

Lillian’s core expertise lies in data protection and privacy. She also leads our Data Protection Officer as a Service (DPOaaS) offering, where we act as external DPOs for businesses of all sizes.

Her work includes reviewing policies and agreements, conducting gap analyses, managing complex cross-border transactions, handling Data Subject Access Requests (DSARs), managing Data Protection Impact Assessments (DPIAs), responding to breaches, liaising with authorities, and more. Her experience spans many sectors and organisations – from start-ups to large multinationals – enabling her to offer pragmatic and strategic guidance on complex data-related issues.

She first specialised in data protection and privacy over 15 years ago, working as the group financial services lawyer while also holding the group DPO position. Since then, she has enjoyed helping clients navigate this ever-evolving area of law.

It’s been exciting to witness data protection laws evolve worldwide. I’ve thoroughly enjoyed helping clients stay ahead of these changes, ensuring they remain compliant and confident in their data protection strategies.

In a single day, Lillian might advise a client on the California Consumer Privacy Act (CCPA) in California, respond to a query regarding the National Commission on Informatics and Liberty (CNIL) in France, and conduct risk assessments relating to India – all without leaving her desk.

Lillian is also active in the artificial intelligence (AI) space, advising on AI governance and emerging AI laws. She is a Certified AI Auditor (CAIA) and Certified AI Ethicist (CAIE) credentials she earned through the University of Oxford AI Programmes, which further reinforces her expertise in the ethical and regulatory dimensions of artificial intelligence. Lillian provides strategic and pragmatic advice to help clients understand and comply with the complex and fast-evolving regulatory landscape surrounding artificial intelligence technologies. Lillian enjoys working with incredibly innovative client technologies, which often bring fascinating data protection and AI governance challenges that she relishes solving.

Data protection isn’t just black and white to me; I love exploring the nuances – especially where data protection intersects with AI – and finding tailored solutions to complex, emerging challenges.

Lillian is passionate about explaining concepts in plain language, helping clients understand that data protection compliance is often a 'win-win' rather than just a tick-box exercise.

Outside of work, she enjoys dining out and attending music festivals. She works with clients both nationally and internationally.