About Andrew
Andrew is a Partner in VWV’s Commercial team, where he heads the Data Protection & Information Law team. He is part of VWV’s AI Law team. He is based in Bristol and acts for universities, schools, charities, research institutions, public sector organisations, and for EdTech.
Andrew helps organisations that develop, supply or use AI tools to understand and manage the data protection and privacy risks. He advises on contract terms, controllership issues, the lawful basis for processing, the reuse of personal data (for example, for model training), international data transfers and data protection impact assessments. He has advised on these issues since well before AI’s widespread adoption, and also advises on AI-related data protection complaints. Andrew has been a Partner at VWV since 2017.
Andrew has been a Partner at VWV since 2017, having qualified in 2008. He heads VWV’s Data Protection & Information Law team.
LLB, Keele University 2003
LPC, University of the West of England 2005
Andrew is based in VWV’s Bristol office and advises clients across the UK and internationally, including on international data transfers and projects with overseas partners.
Advising an EdTech supplier on its AI-powered products, including on controllership, contract terms, lawful bases for processing and wider data protection compliance, and preparing a detailed data protection impact assessment. The platforms were intended to process special category data about children, including health data, which raised the privacy risk.
Advising the seller on the data protection aspects of selling a business that used personal data as part of an AI service.
Reviewing and negotiating amendments to AI suppliers’ terms and conditions for clients wishing to use the AI tools, including advising on the risks of the supplier using personal data for model training and how to reduce those risks.
Advising schools on the data protection risks and compliance considerations of using AI-powered software and platforms.
Advising a university on sharing personal data with international partners, drafting data sharing agreements and advising on the lawful basis for using personal data in research.
What does Andrew specialise in?
Andrew specialises in:
Advising suppliers and users of AI-powered products and platforms on data protection compliance.
Preparing data protection impact assessments for AI tools, including those processing the more sensitive types of data such as special category data about children.
Advising on controller, processor and joint controller arrangements for AI services.
Reviewing and negotiating AI suppliers’ terms.
Advising on international transfers of personal data, including adequacy findings, the ICO’s International Data Transfer Agreement and transfer risk assessments.
Advising on data protection complaints and difficult subject access requests, including those involving AI/
Advising on the data protection issues arising on the sale or purchase of AI focused businesses.
What sectors does Andrew work in?
Andrew works across a variety of sectors, including:
Education, including independent schools and academies
Digital & Technology, including EdTech
Last updated: 13 November 2026
