Jörg Hladjk has 20 years of experience advising on complex international artificial intelligence (AI), cybersecurity, and data protection matters. He heads the Brussels Cybersecurity, Privacy & Data Protection team, top-ranked in The Legal 500 EMEA. He serves on the Firm's global Technology Committee.
Jörg counsels financial services, automotive, IT, energy, and life sciences clients on AI's legal dimensions. His practice spans global AI, data, and cybersecurity compliance strategies; Binding Corporate Rules approvals; EU-U.S. Data Privacy Framework certification; data breach preparedness and incident response; and contentious matters and regulatory investigations. He has a strong track record on AI, data, and cyber issues in cross-border M&A and outsourcings and on critical infrastructures, cloud deployments, and data centers.
He advises on every major EU framework, foremost the Artificial Intelligence Act (AI Act), alongside the General Data Protection Regulation (GDPR), Data Governance Act (DGA), Data Act (DA), Digital Services Act (DSA), Digital Operational Resilience Act (DORA), Network and Information Security Directive 2 (NIS 2), and Cyber Resilience Act (CRA).
Representative work includes advising a U.S.-based software company on its EU offering of AI and cybersecurity tools; an electronic trading platform on a cyberattack; an automotive supplier on GDPR implementation; an energy company on critical infrastructure and data centers; and a medical device company on mobile apps.
Since July 2021, Jörg has been co-issue leader for cybersecurity on the Digital Economy Committee at the American Chamber of Commerce to the EU. He chairs the advisory board of Trust in Digital Life (TDL) and is a frequent speaker on AI and cybersecurity challenges. He has authored over 50 articles and coauthored leading commentaries, including GDPR (Ehmann/Selmayr, 1st/2nd/3rd eds.), and served on the IAPP Publications Advisory Board (2018-2020).
Experience
The following represents experience acquired prior to joining Jones Day.
Advised a major U.S.-based telematics services company on EU data protection issues, in particular in relation to its location specific assistance services.
Advised a leading U.S.-based provider of business intelligence and mobile software services on its implementation of a mobile identity software application in various EU Member States.
Advised a global supplier of automotive systems on EU data protection law compliance in various EU Member States, in particular on its company wide employee and vendor screening program.
Advised the EU headquarters of a global package delivery company on a global telematics project and represented the company in its dealings with a German state data protection authority.
Advised one of the largest U.S.-based educational technology companies on its intragroup data transfers, including the implementation of Article 17 contracts and EU standard contractual clauses.
Advised a major U.S.-based health care services provider on a global security incident in 52 countries and the notification requirements of its affiliates across the EU.
Advised the German headquarters of the world's largest logistics group on its strategy for implementing Binding Corporate Rules.
Advised a major U.S.-based company with subsidiaries in various EU Member States on e-discovery issues in relation to internal investigations conducted under the U.S. Foreign Corrupt Practices Act (FCPA).
Advised the Dutch holding company of a global medical technology leader on its strategy for pan-European data protection compliance in 14 countries, including implementation of a global SOX compliance (whistleblowing) hotline.
Advised a Chinese multinational personal technology company on data processing notifications with data protection authorities in 26 countries and the implementation of EU standard contractual clauses for international data transfers between its corporate entities in Europe and China.
Advised the German headquarters of a multinational automotive corporation on EU data protection law compliance and strategy in the context of a business partner due diligence process.
Advised a major German IT service and outsourcing provider on its data transfers to the U.S. and related data center security setup.
Advised a leading U.S.-based enterprise cloud computing company on EU data protection and data security compliance, in particular on its data processing agreements for customers.
Advised the EU headquarters of a major U.S.-based multinational financial services corporation on its wireless payment solution regarding German and European data protection compliance.
Advised the largest U.S.-based oil and gas company on its global strategy for international data transfers and compliance with European data protection law, including certification for Safe Harbor membership.
Advised a large U.S.-based software company for IT security products on European data protection compliance in relation to web site transaction processes and international data transfers with service providers.
Advised a Swiss-based multinational food processing and packaging company on pan-European data protection compliance.
Additional Publications
- February 2019
The German Facebook Case – Towards an Increasing Symbiosis Between Competition and Data Protection Laws?, Competition Policy International - February 2019
The German Facebook Case – Towards an Increasing Symbiosis Between Competition and Data Protection Laws?, coauthor, CPI Antitrust Chronicle
Additional Speaking Engagements
- September 23, 2026
Moderator, panel - Data Protection & AI: Current Challenges, AI Regulation Forum - March 26, 2026
Speaker - When Cyber Strikes: A General Counsel’s Strategic Playbook - The Conference Board - March 26, 2026
Speaker, Jones Day - Cybersecurity and Privacy Update: A Roundtable Discussion of Key Developments and Hot Topics (EU Cybersecurity Laws Update) - March 24, 2026
Moderator, panel - AI Act Cybersecurity - Real-World Risks, Requirements, and What Comes Next - EU Cyber Policy Day - March 12, 2026
Speaker - Managing Risk: Using Legal and Insurance Tools to Protect Asset Value - RenewableUK Cyber & Security 2026 - November 19, 2025
Moderator, panel - Cybersecurity and the AI Act — Practical Challenges and Opportunities, IAPP Europe Data Protection Congress 2025 - February 26, 2025
Speaker, Jones Day - Cybersecurity and Privacy Update: A Roundtable Discussion of Key Developments and Hot Topics (AI Regulation & Enforcement - EU AI Act and Continued EU Digital Agenda Implementation) - November 6, 2024
Speaker, IDACON 2024 - 24th Data Protection Congress - Uniform application and enforcement of the GDPR – The role of the European Data Protection Board (EDPB) - June 20, 2024
Speaker, Jones Day - Cybersecurity and Privacy Update: A Roundtable Discussion of Key Developments and Hot Topics (EU Digital Strategy Overview and EU AI Act) - October 4, 2023
Speaker, Jones Day - Cybersecurity and Privacy Update: A Roundtable Discussion of Key Developments and Hot Topics (Rise of Data Subject Access Requests (DSARs) - June 21, 2023
Speaker, Jones Day - Cybersecurity and Privacy Update: A Roundtable Discussion of Key Developments and Hot Topics (Personal Data Transfers – Update on new EU-U.S. Transatlantic Data Privacy Framework) - April 25, 2023
Panelist, Jones Day Sixth Annual Latin American Privacy and Cybersecurity Symposium - Session 5: Key Developments in Cybersecurity, AI, and Data Protection: Europe vs. Latin America (English) - October 14, 2022
Speaker, Jones Day - Compliance difficulties of data security and personal information protection 数据安全和个人信息保护合规难点 - October 12, 2022
Speaker, Jones Day - Cybersecurity and Privacy Developments for Life Sciences companies - September 28, 2022
Moderator, panel, What If Privacy Shield 2.0 Never Happens? Practical Advice On Lawful International Data Transfers at PrivSec Amsterdam (Part of the Digital Trust Europe Series) - June 22, 2022
Speaker, Jones Day - Cybersecurity and Privacy Update: A Roundtable Discussion of Key Developments and Hot Topics (GDPR enforcement trends) - December 15, 2021
Speaker, Jones Day - Life Sciences Cyber Session: Cybersecurity and Privacy risks in life sciences transactions - September 22, 2021
Moderator, Session 5. The GDPR vs. Brazil's General Data Protection Law, Jones Day's Fifth Annual Latin America Data Protection, Privacy & Cybersecurity Symposium - June 24, 2021
Speaker, Cybersecurity Incidents – EU Legal Framework and Data Breach Response, BJA Webinar on Cybersecurity – how to prepare your company for a Cyber Crisis - March 26, 2021
Speaker, Obligation to document data breaches and Post-breach management measures: contract management and liability issues, Online Seminar "Responding to personal data breaches in the Post-GDPR", Academy of European Law (ERA) - January 13, 2021
Jones Day - Cybersecurity and Privacy Update: A Roundtable Discussion of Key Developments and Hot Topics (Update on Schrems II Developments) - October 8, 2020
Session 2: Practical GDPR – Challenges in real life/lessons learned, Legal Council - November 11, 2019
How to close the deal: Data protection risks and solutions for M&A transactions, Roundtable Topic Discussion, IAPP Europe Data Protection Congress 2019 - October 23, 2019
Big Data and GDPR, IDACON Data Protection Congress - June 18, 2019
GDPR - a catalyst for digital transformation? European Association for Identity and Security (EEMA) Annual Conference 2019 - June 6, 2019
The GDPR One Year On: A Look at the Lessons From Implementation and the Next Steps for Compliance and Enforcement - May 23, 2019
Eighth Annual European Labor & Employment Conference - April 30, 2019
Panelist, Cybersecurity and Data Governance: Threat Landscape, Legal Regime, and Policy Challenges, Seminar: Cybersecurity, Data Protection, and the Rule of Law - Evolving Policy and Legal Risks in a Global Digital Economy, Jones Day and Peking University Law School - April 10, 2019
Data Localization and Privacy Regulations - Cybersecurity Risk Management Council - January 2019
Implications of the US Cloud Act and Other Developments Regarding Data Protection in Context of the USA, GDD Winter Workshop - November 29, 2018
International Data Breach Notification: How to Get it Right, Roundtable Topic Discussion, IAPP Europe Data Protection Congress 2018 - October 25-26, 2018
Data Protection and Open Banking: Experiences and Expectations - October 5, 2018
Marketing under GDPR: Challenges, experiences and solutions, IAPP Brussels KnowledgeNet Chapter - October 1, 2018
Wearables in the context of data protection regulations (Risks & Challenges), FIFA Football Technology & Data Summit 2018 - February 28, 2018
Antitrust and Data Portability Rights, EMEA Conferences: GDPR and Antitrust - January 2018
The European Union's General Data Protection Regulation (GDPR), Jones Day MCLE University - January 2018
The ePrivacy Regulation, Jones Day MCLE University - January 2018
The European Union's General Data Protection Regulation (GDPR), Jones Day MCLE University - October 23, 2017
How to Prepare for the GDPR for Japanese Companies - October 17, 2017
The EU-U.S. Privacy Shield in context of the developments in the USA, Annual IDACON Conference - September 14, 2017
Introduction to the GDPR - Top 10 Implementation Issues for Companies - July 12, 2017
The Upcoming ePrivacy Regulation: Status and Assessment of the Commission’s Proposal, IAPP Knowledge Net - April 25, 2017
GDPR Workshop: Best Practices for Implementing the EU General Data Protection Regulation, Jones Day Seminar - April 24, 2017
GDPR Workshop: Best Practices for Implementing the EU General Data Protection Regulation, Jones Day Seminar - April 5, 2017
Le RGPD en détail – Analyse des directives des autorités de protection des données et des efforts de mise en œuvre au niveau national - April 2, 2017
The EU Cybersecurity Directive—What Do the New Rules Mean for Business?, 10th Annual GDD Seminar Data Protection International - March 15, 2017
Webinar Series: EU General Data Protection Regulation (three-part series) - November 28, 2016
Advanced Training for Data Protection Officers on "International Data Transfer: EU Standard Contractual Clauses and Privacy Shield", German Federal Association of Data Protection Officers (Berufsverband der Datenschutzbeauftragten Deutschlands (BvD) e.V.) - October 14, 2016
What to Do in Case of a Cyber-Incident or Data Breach: How to Prepare for, and Avoid, a Crisis, Jones Day Seminar - October 14, 2016
Crisis Management: Prepare for the Unexpected - September 13, 2016
Binding Corporate Rules under the EU General Data Protection Regulation (GDPR), IAPP Knowledge Net - August 2, 2016
A Briefing on the EU-U.S. Privacy Shield - July 11, 2016
Overview and business impact of the EU GDPR – How can companies prepare for compliance?, Japanese Chamber of Commerce, Data Protection Seminar - June 16, 2016
Trust in the Digital World - The EU General Data Protection Regulation - How can companies prepare for compliance? - October 14 and 15, 2015
Advanced Training for Data Protection Officers on "International Data Transfer", German Federal Association of Data Protection Officers (Referentin der Fortbildungsveranstaltung des Berufsverbands der Datenschutzbeauftragten Deutschlands (BvD) e.V. zu "Internationaler Datentransfer") - April 23, 2015
Status und Vergleich der grenzüberschreitenden Datenschutzkonzepte: APEC Cross Border Privacy Rules und EU Binding Corporate Rules, 8. GDD-Fachtagung Datenschutz International 2015 - December 3, 2014
Can the EU legal framework promote trust? Challenges towards trusting the network and the Cloud, NetWorld2020 GA 2014: The future of telecommunication networks - November 18, 2014
Internet of Things, Data Protection and Security: What are the Legal Challenges, and How Do We Overcome Them?, IAPP Europe Data Protection Congress 2014 - November 12, 2014
Enforcement action risks for organizations of multinational reach. Understanding regulation and global enforcement trends and the impact for General Counsel and Data Protection Officers, The Future of Data Protection Conference - May 12, 2014
The EU Cybersecurity strategy – overview and business impact, European Data Protection Days (EDPD) - April 28, 2014
APEC Privacy Framework – Geschäftsaktivitäten im asiatisch-pazifischen Wirtschaftsraum, 7. GDD-Fachtagung Datenschutz International 2014 - April 28, 2014
APEC Privacy Framework – Geschäftsaktivitäten im asiatisch-pazifischen Wirtschaftsraum, 7. GDD-Fachtagung Datenschutz International 2014 - April 28, 2014
Technologien für mobiles, kontaktloses Bezahlen (NFC), 15. Jahresfachkonferenz, Datenschutz und Datensicherheit (DuD 2013) - June 3, 2013
Successfully Navigating Hazardous Waters: The 3rd Joint ABA/DAV Conference on Transatlantic Deals and Disputes, Data Privacy for M&A Lawyers
"A star lawyer. He is a great communicator and provides practical advice that is readily implemented."The Legal 500 EMEA
- Johann Wolfgang Goethe-University Frankfurt am Main (Dr. jur. in Data Protection Law 2006; First State Law Exam 2001); Second State Law Exam (Wiesbaden, Germany, 2005); Centre for Commercial Law Studies (CCLS), Queen Mary University of London (LL.M. in Computer & Communications 2005)
- Brussels (E-List) and Frankfurt am Main
Lawdragon 500 Leading Global Cyber Lawyers (2024 and 2025)
The Best Lawyers in Belgium for privacy and data security law (2023)
BTI Client Service All-Star (2022)
The Legal 500 EMEA for EU regulatory: privacy and data protection (2016-2025), ranked as a "Leading Individual"
International Who's Who of: Data Privacy & Protection Lawyers (2019-2024) and Information Technology Lawyers (2012-2018)
Acritas "Star Lawyer" (2019)
Recommended for data protection in Brussels in JUVE Handbook since 2020
- English, German