Antonia Boyce

Associate - Data protection & privacy

Toni Boyce's headshot

Antonia advises on privacy and data protection across UK GDPR and EU GDPR, ePrivacy, cookie and tracking compliance, data governance and incident response. She advises extensively on data‑driven products and services, including adtech and programmatic advertising, consent management and AI‑enabled initiative.

She brings a combination of in‑house and private practice experience. She joined Bristows from a role where she was supporting a global business on UK and European compliance, advising senior stakeholders and leading privacy assessments (including DPIAs and LIAs) and DSAR response. Much of her work sits at the point where legal risk, technical reality and commercial pressure collide. She is known for bridging legal, technical and operational perspectives, developing practical templates and guidance, and negotiating complex data processing and commercial arrangements to deliver pragmatic risk based outcomes.

Antonia has deep experience in regulated and research‑heavy environments. She was seconded to the Information Commissioner’s Office, supporting policy and DPIA work on major public sector programmes, and to a data science and AI institute, where she built governance frameworks and supported research projects involving personal and special category data.

Antonia’s work highlights include:

  • Advising a global organisation on UK/EU privacy compliance, including GDPR, ePrivacy and EU AI Act considerations, and translating regulatory requirements into practical delivery.
  • Developing and leading a process for multi‑territory reviews of tracking technologies (cookies, pixels and tags), strengthening consent governance and supporting CMP/consent framework alignment.
  • Providing strategic guidance on AI privacy issues in Europe, including the interaction between AI regulation and established privacy frameworks.
  • Developing and leading a process for privacy assessments (DPIAs/LIAs) and building scalable processes, templates and guidance (including RoPA and DSAR procedures) to embed privacy by design.
  • Managing complex DSARs (including employee and production personnel matters) through cross‑functional coordination, improving operational efficiency and response quality.
  • Supporting life sciences and healthcare data matters, including special category data and secondary use for research, and drafting/negotiating data sharing and collaboration arrangements.
  • Handling breach response matters, including assessing notification obligations and supporting investigations and remediation planning.

Antonia is particularly valued for her ability to operate at the intersection of legal advice, operational delivery and risk management. She has extensive experience designing and embedding scalable privacy governance frameworks, including assessment processes, decision‑making tools and internal guidance that can be applied consistently across large, multi‑jurisdictional organisations.

She is frequently involved in complex, high‑risk matters where legal requirements have to be balanced against commercial, technical and organisational constraints. That often means helping teams make difficult calls when the perfect options are not available. Her approach is informed by first‑hand experience of regulatory expectations, having worked closely with regulators and supported policy‑level work on major public sector programmes.

Antonia also brings strong operational credibility in areas that are often resource‑intensive and business‑critical, including large‑scale DSAR handling, incident response and internal investigations. She is known for building practical processes that work in real‑world environments and for supporting cross‑functional teams through high‑pressure situations with clear, defensible advice.

Credentials

  • University of St Andrews – BSc (Bachelor of Medical Science)
  • University of Manchester – MBChB (Bachelor of Medicine and Surgery)
  • FRCA (Royal College of Anaesthetists)
  • GDL, BPP Law School
  • LPC, BPP Law School
  • Qualified: Solicitor of the Senior Courts of England and Wales (SRA), 2020
  • Certified Information Privacy Professional/Europe (CIPP/E)