Ross Phillipson

Background

About Ross Phillipson

I am a partner in our Cybersecurity and Technology practice. I provide compliance, risk, and operational resilience legal services with a focus on technology, data, and cybersecurity. Based in Perth, I joined the firm after nearly 19 years working for the global multinational Procter & Gamble in London and Geneva. I have unique and in-depth expertise in legal and compliance risk management in digital operations, including cybersecurity, data protection and operational resilience. This unique and highly specialized skillset was developed while working in various roles for a leading multinational Fortune 10 FMCG company. My practice is end to end, including front end advisory, transaction diligence and advice, and incident/crisis management and regulatory enforcement, across four main areas- Cybersecurity advisory, incident response, regulatory interaction and post-incident remediation - Critical Infrastructure and Operational Resilience advisory, including a specialism in operational technology and the unique challenges it poses - Privacy and data protection advisory, including new products, digital services, and breach advice - Artificial Intelligence (AI) advisory Representative experience includes- A major resources client on two significant data breaches, including strategic advice in relation to immediate rectification activities, notification obligations, review and advice in relation to root cause and remediation and regulator communication- A major resources client on cybersecurity incident management, including advice relating to Australia’s new Cybersecurity Act- A global financial services client as global cybersecurity counsel and privacy advisory- A major Australian headquartered international resources client on its global Privacy program, including multi-country compliance gap analyses and uplift, privacy program design and policy suite review and uplift. I am regularly sought after for industry speaking engagements, often commenting on the drafting and implementation of cybersecurity, critical infrastructure and privacy laws like the Security of Critical Infrastructure Act, the Cybersecurity Act, amendments to the Privacy Act, and emerging topics such as operational technology security and risk. Prior to this, I spoke frequently on the GDPR, its impact, and implementation. I have also been involved in tech regulation and policy in Europe for nearly a decade and have worked in partnership with industry associations and government relations groups to ensure new legislation in the tech arena is fit for purpose.