Grace Roddie

Grace has extensive experience in advising large-scale businesses on data protection compliance issues, including FCA-regulated companies, FinTechs and companies in the FTSE 100. She advises on a wide range of data protection and e-privacy matters and often advises clients on complex data flows and the related contractual position where clients are procuring new technology.

Grace is also experienced in advising clients on outsourcing arrangements, software licence agreements and cloud services agreements.

Grace has completed a couple of secondments with regulated entities, including a merchant acquirer where she advised the client on several strategic projects, including a first generation outsourcing to AWS.

Jurisdiction: England & Wales

• Advising one of the UK’s largest merchant acquirers on procuring e-receipts functionality from a Fintech provider to offer to its merchant base. This involved analysis of complex data flows concerning multiple third parties, including issuers and consumers using the online banking apps, and advising the client on the designation of each party from a data protection perspective with respect to the various datasets in transit between the parties.
• Advising a building society on its multi-million £ outsourcing of its entire in branch and back office banking platform to a cloud based IT managed service, including compliance with the regulatory aspects of outsourcing services in the financial services sector.
• Advising a merchant acquirer on the development of its in-house omni-channel payment gateway, which included advising the acquirer on its contract with a hosting provider and drafting the customer-facing terms for merchants with respect to use of the gateway.
• Advising a payment provider on its procurement of smart terminals, including an in-depth analysis of the complex data flows between the parties and provision of gateway services to customers.