Paolo Sbuttoni

Paolo is a Partner in the Innovation department, with over 20 years’ international experience advising on data, technology and commercial law.

Dual qualified in England & Wales and Hong Kong, Paolo specialises in cross border data protection and cybersecurity, technology and commercial contracts (including cloud services and large-scale outsourcing), and the legal and regulatory challenges arising from evolving technologies such as AI.

He advises clients on multi-jurisdictional matters and supports businesses on international expansion, with particular experience helping organisations enter and grow in Asia.

Paolo works with clients across a range of sectors, including technology, consumer goods and retail, real estate, financial services/ fintech and hospitality.

He is recognised for providing pragmatic, commercially-focused advice on complex international data and technology matters. Legal 500 has described him as “very knowledgeable on technology and privacy matters” and “very strong on data protection issues, blending EU/international and Hong Kong knowledge and experience” and highlights his ability to help clients balance legal risk with regulatory priorities.

Key Experience

• Data protection and cybersecurity projects: Advising on global data protection and cybersecurity compliance, including audits, privacy impact assessments, cross border data transfer, global data breach management and engagement with international regulators

• Procurement of technology services: Advising both suppliers and customers on major technology contracts, from cloud and SaaS to transformational outsourcing arrangements

• Technology and data commercialisation: Supporting clients with their arrangements to buy, sell or licence technology and / or data

• Digital Regulation: Advising on the regulation of digital platforms, including online safety, advertising and marketing compliance and consumer protection

• Artificial Intelligence: Advising on the deployment of AI systems, including governance, data protection compliance, contracting and regulatory risk management

• International expansion: Advising clients on international expansion projects between the UK and Asia, supporting market entry strategies, regulatory structuring and cross border commercial arrangements

Career History

Partner, Mishcon de Reya LLP
Partner, Foot Anstey
Partner, Baker McKenzie
Legal Counsel, British Telecom
Associate, Nabarro (now CMS)
Trainee Solicitor, Nabarro (now CMS)
University College London (UCL), LLM (IT / IP, Telecoms & Competition)
Nottingham Law School, LPC and Postgraduate Diploma in Law
University of Leicester, BA (English Literature)

Articles and Publications

• Data Use and Access Bill could create unintended risks for businesses, The Times
• AI laws should offer certainty - but not stifle innovation, The Times