Lucy Tucker

Lucy Tucker is an associate in the Dubai office of Latham & Watkins and a member of the Data & Technology Transactions Practice.

Ms. Tucker primarily advises clients on data privacy, cybersecurity, and commercial contracts. She has advised a broad range of clients from startups to technology giants on a wide range of EU privacy matters, including in relation to M&A transactions, regulatory investigations, the privacy risks of new technologies, data processing agreements, international data transfers, data protection impact assessments, direct marketing, cookies, and transparency requirements. Prior to joining Latham & Watkins, Ms. Tucker trained and qualified at PwC, where she focused on large scale GDPR transformation projects. 

Ms. Tucker is a Certified Information Privacy Technologist (CIPT), awarded by the International Association of Privacy Professionals (IAPP) and also holds a Practitioner Certificate in Data Protection, awarded by BCS - The Chartered Institute for IT.

Ms. Tucker’s experience includes advising: 

• Facebook on data privacy issues in relation to strategic acquisitions, including its acquisitions of the game developer, Ready at Dawn, the Gif provider, Giphy Inc., and customer service CRM platform, Kustomer Inc.
• A foreign sovereign wealth fund on multiple ultra high-tech megaprojects on the development of its data privacy laws and data related policy
• A multinational professional services firm on global data privacy and cybersecurity issues, including its “best-in-class” global Privacy Impact Assessment program across its federated network to ensure all new global technology solutions are compliant
• A significant social media company in matters before international regulatory bodies in connection with data protection compliance and other issues relating to privacy and security 
• A global conversation technology company on its data protection model, relationships with third parties, ads profiling and how it uses and trains AI/ML 
• A global media group on the territorial scope of GDPR, including in relation to joint controllership and processor requirements 
• IXL Learning on its acquisition of the Rosetta Stone languages division, a platform used by 11 million students
• A global life sciences company on data protection agreements relating to clinical studies
• Square Inc. on the acquisition of Verse, a peer-to-peer payments app
• A global cosmetics retailer on its loyalty program, website terms and privacy policy
• A global energy company on the review and sharing of EU employee correspondence and documentation in relation to a US litigation matter
• A multinational hedge fund and financial services company on commissioning polls and the use of social media data to analyze political statements 
• A betting company on the use of facial recognition technology in its venues
• Numerous companies on data protection matters ahead of stock market listings

• The Technology, Media and Telecommunications Review – 12th Edition, Saudi Arabia Chapter -  January 24, 2022
• UAE Publishes First Federal Data Protection Law  -  December 14, 2021
• Adtech and Real Time Bidding in the Regulatory Crosshairs -  September 11, 2019