Member of the Month | Filipa Santos: Building Practical and Scalable Privacy Governance Amid Regulatory Fragmentation

This month, the Hong Kong China Network Security Association (HKCNSA) is pleased to feature Filipa Santos as our Member of the Month for March 2026.

Filipa’s career spans Europe, Macau, and Hong Kong, with over fifteen years of legal and privacy experience across both private practice and in‑house roles. She previously served as Group Data Privacy Legal Counsel and Coordinating DPO at a Macau gaming company, and currently acts as the APAC Regional Data Protection Officer at L’Occitane Group, overseeing data compliance and governance across 22 markets and 8 brands.

Regulatory Trends: From Formal Compliance to Demonstrable Governance

Discussing regulatory developments across the Asia‑Pacific region, Filipa observes a clear shift from form‑based compliance toward substantive and demonstrable governance. Increasingly, jurisdictions in the region emphasise accountability frameworks, operational resilience, data governance, cross‑border data transfers, and incident response as key regulatory expectations.

AI governance is also evolving, moving beyond purely technical controls toward a stronger focus on transparency, human oversight, and responsible use.

“In APAC, compliance is no longer about checking a box—organisations are expected to show that risks are genuinely understood and managed,” Filipa notes. She adds that cybersecurity obligations are becoming more deeply embedded in sector‑specific regulations, making privacy, security, and AI‑related responsibilities closely tied to how organisations identify, assess, and address real operational risks.

Cross‑Jurisdiction Governance: Balancing Consistency and Flexibility

Given the region’s diverse and complex regulatory landscape, Filipa believes a single, uniform governance model is rarely feasible—yet an entirely localised approach is equally difficult to sustain. Effective regional governance requires a balance of consistency and adaptability, supported by cross‑functional collaboration.

According to Filipa, successful regional governance typically depends on:

•        A clear understanding of the organisation’s risk appetite as a common foundation

•        A unified baseline standard with room for local adaptation

•        Collaboration across legal, privacy, information security, IT, and business teams

•        Continuous monitoring of regulatory developments and vendor ecosystems to keep pace with change

The Role of HKCNSA: Bridging Policy, Practice, and the Professional Community

Filipa views HKCNSA’s interdisciplinary platform as a valuable resource that supports both individual professional development and the broader privacy, cybersecurity, and technology community across the region. She notes that the Association’s diverse member base enables cross‑functional exposure that remains relatively unique in the APAC landscape.

HKCNSA contributes by providing a neutral platform for knowledge sharing, facilitating discussions on emerging risks and real‑world case practices, and helping professionals translate complex regulatory expectations into practical, actionable insights.

Looking Ahead: Governance Embedded in Business Decision‑Making

Reflecting on the future, Filipa believes that the way organisations use data and AI—and how they explain these practices to stakeholders—will become increasingly important. As digital and AI‑enabled processes become more integrated into everyday operations, expectations around accountability, transparency, communication and oversight are likely to rise across regulators, customers, partners and boards.

Filipa notes that organisations that treat governance, ethical judgment and resilience as part of their core operations, rather than as separate compliance tasks, will be better prepared to navigate the next phase of technological and regulatory development.