Tracy Sun


Tracy Sun 

+86 21 6086 0188

Tracy Sun is a data and technology lawyer, and heads the firm's data protection, privacy and cybersecurity practice.

Tracy has extensive experiences on data privacy, data and cybersecurity compliance as well as data breach response in China, and help clients to tackle data compliance challenges and digital transformation in an increasingly complicated legal regime. She has been advising clients in a broad range of industries with an industrial focus on pharmaceutical, internet and technology, e-commerce, telecommunication, medical device and other new technology-driven sectors.

Tracy’s practice also cover regulatory matters raised by the impact of technology and digital innovation, and a range of commercial agreements from technology or data transfer, research collaboration, software development and license agreement etc. to other agreements relating to data processing.

Prior to joining the firm, Tracy was China Data Privacy Head with a global pharmaceutical company for more than four years, and before that she practised with top domestic and international firms for more than ten years.


  • Data protection, privacy and cybersecurity

Key industry

  • Life sciences and healthcare
  • Technology

Representative experience

  • A global pharmaceutical company, on –

- establishing and maintaining privacy control & governance framework in China

- data protection and privacy issues and projects in different functions, e.g. digital, IT, medical, clinical trials, HR and marketing

- setting up and implementing data privacy policy and notice, templates and training programs

- project review and privacy impact assessment

- privacy incidents or breach handling

- risk assessment programs in China

- localizing global privacy projects, guidelines and programs as well as contract clauses

  • A famous sports brand – on e-commerce, data privacy, advertising and internet-related regulatory requirements in China for its new e-commerce website
  • Various website operators in China – drafting terms and conditions of use and privacy policy
  • A market leader in clinical research software – on local privacy requirements, data privacy notice and relevant data localisation considerations
  • A UK insurance group and a famous UK football club – on China data privacy regime and data localisation
  • A US market research group – on China data privacy regime and localisation issues
  • A UK Internet-based cloud computing supplier – on data privacy and regulatory matters
  • Various clients – on various IT/IP-related agreements 


  • University of Bristol, LLM
  • University of International Business and Economics, LLM
  • University of International Business and Economics, LLB


  • PRC


  • Chinese
  • English