People

Drew Ricci advises organizations on data privacy, artificial intelligence governance, and cybersecurity, working at the intersection of regulatory compliance, product strategy, and enterprise risk. He partners with executive leadership, in-house counsel, and technical teams to build governance structures that support innovation while managing legal and operational exposure. 

His privacy practice covers U.S. and international frameworks including GDPR, CCPA/CPRA, HIPAA/HITECH, GLBA, COPPA, FCRA, and state privacy laws, and extends to building practical compliance programs: data mapping, risk assessments, cross-border transfer strategy, vendor and SaaS risk allocation, consumer rights processes, and regulator-facing documentation. He also negotiates complex technology and data processing agreements with a focus on liability, indemnification, security representations, and audit rights. 

On the AI side, Drew advises companies deploying AI and machine learning across product, marketing, and internal environments. His work includes building AI governance structures, addressing automated decision-making and bias risk, developing generative AI deployment policies, and preparing for EU AI Act requirements and emerging U.S. regulations. 

In cybersecurity incident response, Drew helps organizations coordinate forensic efforts, analyze regulatory notification obligations, assess contractual exposure, and develop post-incident strategy. His litigation experience defending data-related claims directly informs his approach to preventive governance. 

Drew holds the Certified Information Privacy Professional (CIPP/US) designation and regularly writes and presents on AI governance, cybersecurity risk, and privacy regulatory developments.