A French strategist building the bridge between Chinese data regulation and the international frameworks the rest of the world reports against.
Begin a conversation →Born in France, trained in international business and information security, drawn to Shanghai by the conviction that the most consequential cybersecurity questions of the next decade would be written in Chinese.
For more than a decade, I have advised European subsidiaries and multinationals operating in mainland China on the practical reality of complying with the Cybersecurity Law, the Personal Information Protection Law, the Data Security Law, and the Multi-Level Protection Scheme — while keeping their global posture aligned to NIST, ISO 27001, and the obligations imposed by their own headquarters thousands of kilometres away.
That space — the narrow, often misunderstood corridor where Chinese statutory grounding meets international assurance frameworks — is where I have built my practice, and where my clients tend to find me most useful.
Independent advisory practice serving European multinationals operating in greater China. Engagements span PIPL readiness, cross-border data transfer assessments, MLPS classification, incident response design, and the production of audit-ready policy artifacts for global headquarters.
Led mid- and large-scale information security engagements across manufacturing, luxury, and life sciences clients. Built the regional methodology for harmonising Chinese local controls with NIST SP 800-53 and ISO 27001:2022, used today as the basis for client deliverables across the practice.
Transitioned from European GDPR programmes into Chinese data law as the CSL came into force. Advised on the first wave of cross-border transfer mechanisms and built a working translation layer between European data protection thinking and the emerging Chinese framework.
First exposure to enterprise risk and IT governance, working alongside auditors on COBIT-aligned control reviews. The starting point of a longer interest in the structural side of security — frameworks, processes, and the unglamorous work that holds them together.
Programme design and execution against the Cybersecurity Law, PIPL, the Data Security Law, and MLPS 2.0 — including the harder edge cases involving Critical Information Infrastructure Operators.
Selection and execution of the right transfer mechanism — Standard Contract, Security Assessment, or Certification — and the documentation discipline required to defend it under regulatory scrutiny.
Enterprise-grade information security policy suites written to dual-align with Chinese local requirements and international assurance frameworks, designed to read as authentically human-drafted by counsel.
Risk methodology aligned to ISO 31000 and the requirements of the parent group. Practical, defensible, and built to actually inform decisions rather than fill a binder.
Tabletop exercises and incident response playbooks calibrated to the realities of operating in mainland China — including notification timing, regulator engagement, and parent-company coordination.
Diligence and ongoing oversight of Chinese suppliers, processors, and cloud providers — with a working understanding of which security claims can be verified locally and which cannot.
Shanghai is, for me, the only city where the conversation about cybersecurity is genuinely tri-cultural — Chinese, French, Anglo-Saxon — held over the same table, often in the same evening.
I arrived in Shanghai with two suitcases and roughly fifty Mandarin words, on a six-month assignment that quietly extended itself into a decade. The city is unsentimental about newcomers — it does not slow down for anyone — and that, in the end, is what made me stay. There is a particular discipline you acquire when nothing around you assumes that your way of doing things is the right one.
You begin to think in two systems at once. After a while, you stop translating.
Professionally, I came of age inside the slow, deliberate emergence of Chinese cybersecurity law — the CSL in 2017, the DSL and PIPL in 2021, the constant drumbeat of supporting measures and regulator guidance ever since. Watching that architecture rise in real time, from the inside, while simultaneously translating it for European boards who were still calibrating their GDPR programmes, has shaped how I think about regulation more generally.
Outside of work, my life is built from the small, ordinary rituals of a long expatriation. Tea bought from the same shop in Yuyuan for seven years now. A run along the Suzhou Creek before the heat sets in. The particular pleasure of a bilingual conversation that drifts, mid-sentence, from French to Mandarin and back without anyone noticing. Shanghai is, finally, the only home where I have learned to be patient.
Whether you are entering the Chinese market, navigating a regulatory change, or simply looking for a clearer head on a complicated brief — I would be glad to hear from you.