Pulina Whitaker

Pulina is often appointed to conduct independent misconduct investigations, including most recently for UNICEF UK in response to bullying allegations. She acts for employers in defending against employment and data privacy allegations and claims, including for bullying/harassment, unfair dismissal, discrimination, whistleblowing, breach of data processing, and employment contract claims. She has experience working with international and European clients to help them comply with the EU General Data Protection Regulation, including advising on audits of data processing activities and data security incidents.

Pulina advises on cross-border commercial outsourcing and corporate reorganizations, negotiating warranty and indemnity provisions and disclosures in transactional documentation, and conducting global redundancy and furlough projects. She is skilled at navigating individual and collective consultation requirements in multiple jurisdictions, including dealing with trade unions and works councils. She also advises on the automatic transfer of employment requirements and related information and consultation obligations in the United Kingdom and across other European jurisdictions. 

Pulina’s practice spans internationally, and she speaks French and Italian.

She has been described by clients in The Legal 500 as “extremely knowledgeable with a practical approach” and is noted as being “a key name for issues covering employment and data privacy work.” Also named as a Legal 500 leading practitioner, they go on to note Pulina “is head and shoulders above the data protection and privacy pack on her command of law, requirements, and implementation.”

• Advised one of the world’s largest travel technology companies on all aspects of GDPR compliance and international privacy compliance, from commercial contracts, data security incidents, reports to supervisory authorities, compliance with Government mandates in the COVID-19 pandemic restricting travel, employee data processing and data subject requests
• Advised several large Foundations on international privacy matters
• Advised a large New York bank on a data privacy dispute with a UK commercial partner
• Advised and defended a UK payment technology company against potential claims following a cyber security data breach
• Advised an investment company following a phishing data breach, involving the theft of several million GBP, including assisting with tracing the stolen found across borders and dealing with the UK supervisory authority enquiries
• Advised a large multinational technology provider on an SEC whistleblowing complaint involving allegations of GDPR breaches in the design of its technology and processing of personal data
• Advised a former toy retailer on its GDPR compliance project
• Advised a logistics provider on its GDPR compliance project
• Advised a medical technology provider on its GDPR compliance project and related commercial negotiations, as well as data security incidents, data subject requests, transfers of personal data and data sharing arrangements
• Advised a sports injury research organization on its data processing and data sharing requirements for processing special categories of data of minors
• Provided counsel to one of the world’s largest IT companies on the international employment and stock issues related to its global merger with a US IT company and subsequent global integration issues
• Advised on the joint venture of one of Europe’s largest payment processing businesses
• Advised on the acquisition of a manufacturing conglomerate across multiple jurisdictions, including informing or consulting employee representatives, dealing with a substantial defined benefit pension scheme deficit, and negotiating new service agreements for the board of directors
• Conducted a fraud investigation and liaised with the City of London police
• Managed the international data breach reporting requirements in over 130 countries relating to a data breach incident
• Advised on the UK Modern Slavery Act requirements for numerous multinational organizations
• Advised on UK gender pay reporting requirements for UK companies
• Appointed as the independent Compliance Monitor for the United Nations, advising on employee misconduct risks, training requirements, employment contract and incentive changes, the reporting process for raising concerns, managing investigations of employee misconduct, and on termination of employees and consequential penalties (ongoing)
• Appointed as the independent Compliance Monitor by USAID for a charity for three years
• Conducted an independent investigation into allegations of bullying by the former Chair of UNICEF UK
• Advised on cross-border data transfers for numerous multinationals, including executing model clauses and similar data transfer agreements, and other alternative options for transferring personal data to non-European jurisdictions
• Advised numerous data controller and data processor organisations, including European, US, Middle Eastern, and APAC organisations, on their requirements under the General Data Protection Regulation and local European data privacy laws
• Defended a sexual harassment claim involving employees in US and UK jurisdictions