Anne-Cécile Colas, CIPP/E, CIPM



Group DPO

Anne-Cécile is an in-house lawyer at Sodexo leading the data protection practice for the group since May 2016. She has been appointed Group Data Protection Officer in January 2018.

She has spent 10 years+ as a Paris-based attorney-at-law (notably with Bird & Bird and EY) and a privacy & data protection expert lawyer advising multinational companies, including U.S. and Asian companies; focusing on defining international data transfer strategies and data protection compliance programs. Her practice includes leading data protection law compliance assessments at European and worldwide levels, drafting & implementing BCRs (Binding Corporate Rules), handling broad-scale international data protection projects and the drafting of various legal memos, procedures and policies relating to data protection compliance.

Anne-Cécile is also a specialist counsel on data protection issues in litigation. She has assisted many French and international companies based in France in case of audit and enforcement actions from the French data protection authority. She has also assisted a French aircraft company in several litigations regarding data protection matters before the French courts. 

Additionally, Anne-Cécile is member of Women in Privacy and of IAPP (International Association of Privacy Professionals). She is certified by the IAPP for her European Legal Data Protection practice (CIPP/E). 


Contributions by Anne-Cécile Colas

  • Maintenir sous contrôle les risques relatifs aux fournisseurs
    Speaker at IAPP Data Protection Intensive: France 2022
  • Le RGPD, Trois Ans Après: Bilan et tendances
    Speaker at Virtual France KnowledgeNet: 25 May 2021
  • Discussions pour les DPO réalisées par les délégués français
    Speaker at IAPP Data Protection Intensive: France 2020
  • Notion of Risk for Data Subjects in DPIA and Data Breach
    Speaker at IAPP Europe Data Protection Congress 2019