Luca Lepre

Strategic and highly certified privacy leader (FIP, CIPP/E, CIPM, CIPP/US) with seven years of post-qualification experience across corporate, regulatory, and compliance matters. Specialist in global data protection for the past five years, with expertise in GDPR (EU/UK), UAE PDPL, and US legislation (including CCPA/CPRA). Currently pursuing the IAPP AI Governance Professional (AIGP) certification to further deepen practical AI governance expertise.

Proven track record managing complex cross-border data transfers, executive reporting, and collaborative engagement with Works Councils. Fully prepared and willing to cover self-funded relocation costs for the right position.

Data Protection Officer (DPO) at VistaJet Limited (2025-05 – Present)

• Regulatory Liaison: Act as primary point of contact for Supervisory Authorities and manage regulatory notifications.
• Compliance Oversight: Monitor adherence to privacy laws and governance standards across the organization.
• Incident Management: Direct data breach responses, incident registers, and mitigation strategies.
• Operational Privacy: Drive Privacy by Design and Privacy by Default implementation across all business operations.
• Cookie Compliance: Review and update cookie policies and consent mechanisms.
• Policy Governance: Review and revise privacy policies and notices to maintain regulatory alignment.
• Executive Advisory: Present privacy reports to executive leadership and deliver global training programs.

Senior Privacy Counsel at VistaJet Limited (2024-12 – Present)

• International Frameworks: Advise senior management on GDPR, UK GDPR, UAE PDPL, and CCPA.
• Strategy & Governance: Develop privacy governance frameworks, policies, and cross-border transfer programs.
• Risk Assessment: Conduct and oversee high-level DPIAs and Transfer Impact Assessments (TIAs).
• ROPA Support: Support Records of Processing Activities (ROPA) maintenance by compiling data-processing information through internal questionnaires and stakeholder consultation.
• Data Retention: Draft the organization's data retention policy and develop the roadmap for its implementation.
• Stakeholder Management: Collaborate with Works Council representatives on employee data initiatives.
• Vendor & Contract Risk: Support contract negotiations and privacy-related vendor management, including review of DPAs and SCCs.

Legal & Privacy Counsel at VistaJet Limited (2023-03 – 2024-12)

• Contractual Safeguards: Drafted and negotiated DPAs, SCCs, and complex privacy clauses.
• Rights & Audits: Managed the DSR lifecycle and performed internal privacy audits.
• Multi-jurisdictional Compliance: Assessed data governance from a multi-jurisdictional perspective.
• International Requests: Handled global information and police requests.

Legal Executive at Grant Thornton (Malta) (2021-09 – 2023-02)

• Privacy Auditing: Carried out data protection audits and drafted internal/external privacy and cookie policies.
• Corporate Transactions: Managed M&A, share transfers, capital allotments, and corporate incorporations.
• Legal Review: Reviewed loan, share purchase, and employment agreements.
• Trusts & Immigration: Managed a portfolio of trusts and handled work permits and nomad residence applications.

Junior Legal and Compliance Executive at Integritas Group (2020-12 – 2021-08)

• Compliance & Onboarding: Conducted client onboarding, KYC/due diligence reviews, and regulatory filings.

Junior Lawyer / Corporate Administrator at LIFT Advisory (2018-10 – 2020-11)

• Corporate Services: Managed company incorporations, bank account openings, and provided immigration advice.

Compliance Administrator at STM Group (2018-02 – 2018-10)

• Risk Management: Carried out risk assessments, KYC checks, and ongoing monitoring of client portfolios.

Master of Advocacy in Advocacy – University of Malta (2020)

Bachelor of Laws in Laws – University of Malta (2018)

Diploma Legal Procurator (2018)

Foundation Certificate in Trust Law in Trust Law (2022)