IAPP Privacy. Security. Risk. + AI Governance Global 2026

Michael Roberts advises clients on issues at the intersection of privacy, cybersecurity, artificial intelligence (AI), emerging technologies, and crisis management. He provides strategic counsel to clients on managing data risks, enhancing data security programs, preparing for and responding to cybersecurity incidents, and conducting internal investigations and regulatory defense.

With extensive experience guiding companies through matters before US regulators and agencies, Michael has a comprehensive understanding of how investigations and enforcement actions unfold and how best to advocate for clients. He draws on this deep experience in assisting clients with matters before the CFTC, CISA, DOJ, FCC, FINRA, FTC, HHS OCR, NYDFS, SEC, and state attorneys general.

Michael also regularly advises clients on compliance strategies, product design, privacy program development, and risk management with respect to federal and state privacy and data security laws and regulations. He has guided clients through complex issues on an expansive array of counseling matters, including those that involve compliance with CAN-SPAM, COPPA, FCRA, FERPA, the FTC Act, GLBA, HIPAA, NYDFS Part 500, TCPA, and state privacy laws, as well as industry self-regulation on advertising and PCI DSS. Additionally, Michael regularly counsels clients in evaluating and mitigating data-related risks in complex transactions.

Michael frequently contributes to thought leadership on privacy, cybersecurity, and AI legal issues. He has served as the managing editor for the Practising Law Institute’s Privacy Law Answer Book (2023 and 2024 editions). Michael has also co-authored articles in publications including the Harvard Law School Forum on Corporate Governance, the Cybersecurity Law Report, the Massachusetts Institute of Technology Computational Law Report, and the Review of Banking & Financial Services.

Dr. Natallia Karniyevich is a partner in the Privacy & Cybersecurity practice and advises multinational companies across the full spectrum of cybersecurity and data protection law.

Based in Düsseldorf, Natallia guides clients through the evolving European cybersecurity regulatory landscape - from the strategic design of compliance programs to the management of cybersecurity incidents. She regularly leads complex multijurisdictional projects on the implementation of the NIS2 Directive and the Critical Entities Resilience Directive, and advises on the Cyber Resilience Act and DORA. A particular dimension of her practice is the intersection of cybersecurity and artificial intelligence, including the cybersecurity requirements of the EU AI Act. Her clients include providers of digital infrastructure and digital services, operators of critical infrastructure, and companies across the manufacturing, food, transport, and health sectors.

Natallia is a frequent author and speaker on current developments in cybersecurity law. She recently co-authored the International Comparative Legal Guide Cybersecurity 2026 (ninth edition) and the Casebook European Data Law – Ten Years of the GDPR: A Milestone in EU Data Regulation (Nomos, 2026), and a guest lecturer at the Frankfurt School of Finance & Management.