Lucy Hannah specialises in privacy, data protection, and AI regulation, with a focus on advising on the Privacy Act, Spam Act, state and territory privacy and information laws, and related regulatory frameworks. She advises on a wide range of compliance issues including privacy and data governance, consent and transparency obligations, marketing practices, data sharing, and emerging regulation.
Lucy works with public and private sector clients across industries including automotive, government, health, technology, financial services, media, and education. She supports clients with privacy compliance assessments and remediation, privacy impact assessments, policy development, incident response, and regulatory engagement, with a practical focus on managing legal risk while enabling innovation.
Lucy teaches privacy and compliance for marketers through the Association for Data-Driven Marketing and Advertising (ADMA) and is a regular contributor to Wolters Kluwer on developments in privacy law.
Expertise
Experience
- National infrastructure and energy organisation Leading a privacy and cyber security compliance assessment and developing a remediation roadmap.
- A Commonwealth Government Agency Undertaking a privacy impact assessment in relation to the Personal Level Integrated Data Asset (PLIDA)
- One of the big four banks Advising in relation to its Spam Act 2003 (Cth) compliance and consent management framework.
- Various clients Advising on the implementation of Privacy Act 1988 (Cth) and Spam Act 2003 (Cth) remediation, including consent management frameworks, privacy notices, policies, retention schedules and third-party vendor procurement and risk management processes.
- Various clients Providing advice in relation to the end-to-end delivery of complex legal projects in data and technology law with a focus on privacy, data protection and AI governance.
- Various clients Advising in relation to the application of international data protection laws, including GDPR.
