Aaron P. Simpson

Aaron advises clients on a broad range of complex global privacy, data protection and cybersecurity matters, including with respect to existing and emerging requirements in the US and EU.

As a leader on the firm’s global privacy team, Aaron’s work includes advising clients on large-scale cybersecurity incidents; conducting diligence and negotiating privacy and data security aspects of corporate transactions; developing of cross-border data transfer solutions; developing local, regional and international privacy and data protection compliance programs with existing and emerging data protection requirements in Europe and the US; and negotiating data-driven commercial agreements.

Aaron is well known as a top privacy professional and has been recognized by Chambers and Partners, The Legal 500 and Computerworld for his work on behalf of clients. Aaron splits his time between the firm’s New York and London offices, and is the only lawyer currently listed in both The Legal 500 United Kingdom and The Legal 500 United States guides, providing clients with a broad and unique transatlantic perspective. He is a sought-after media resource on privacy issues and has been quoted in such publications as Time Magazine, Bloomberg BNA, Businessweek Magazine, Computer Weekly, Corporate Secretary, DataGuidance, Law360, SC Magazine and The Times. Aaron regularly speaks before industry groups, legal organizations, government agencies and educational institutions at conferences, seminars, roundtables and webinars. He has written and co-written numerous articles, book chapters and handbooks on privacy and information security issues.

Relevant Experience

• Advises clients with due diligence and negotiation of privacy and data security issues in corporate transactions.
• Advises clients on compliance with the California Consumer Privacy Act of 2018 (CCPA), including conducting due diligence, preparing gap analyses, developing remediation plans, and undertaking compliance projects.
• Advises clients on all legal issues associated with cybersecurity events pursuant to requirements imposed by laws and regulatory guidance in the European Union and the United States.
• Prepares proactive, data breach-readiness solutions for clients, including through the creation of incident response plans and conducting board-level tabletop exercises.
• Advises clients on international data protection requirements, including the EU General Data Protection Regulation and developing mechanisms to comply with cross-border data transfer requirements (such as through BCRs, the Privacy Shield and Standard Contractual Clauses).