Find a Lawyer
Fiona Guo
Guo Xuefei Associate
Compliance and Risk Management
Cross-Border Investment and Trade
IP and Technology Innovation
Dispute Resolution
Detailed introduction
Fiona is an associate in the firm's Shanghai corporate department. Her practice areas include cybersecurity, data security and personal information protection, corporate, and technology transactions.
She advises clients across diverse sectors, including data exchanges, fintech, omni-channel marketing, foreign-invested consumer goods, multinational industrial enterprises, leading global energy companies, the automotive industry, and smart electronics. She has hands-on experience in data compliance and personal information protection, covering a broad spectrum of work such as conducting compliance assessments and providing compliance advice for projects involving data element applications, data product development and sales, recognition of data assets on balance sheets, data transactions, authorized use of public data, personal information protection impact assessments, cross-border data transfer risk assessments, as well as data security incident management and response. She also has substantial practical experience assisting clients in coordinating and managing legal services across multiple jurisdictions.
She earned her Bachelor of Laws (LL.B.) from East China University of Political Science and Law and her Master of Laws (LL.M.) from the University of California, Berkeley.
Data Security and Personal Information Protection
E-commerce
E-commerce platforms: advised numerous e-commerce platforms operating in various jurisdictions on legal matters including business operations, data compliance, consumer privacy protection, marketing and promotions, platform policies, and rules.
Italian apparel brand: conducted due diligence and gap analysis and provided compliance advice for a well-known Italian apparel brand on issues related to data compliance and personal information protection for its business in China.
French fashion retailer: provided due diligence, gap analysis and assisted in the implementation of compliance recommendations for the employee personal information protection program of the client’s Chinese subsidiary.
E-commerce omni-directional marketing company: conducted due diligence, provided compliance advice and issued legal opinion on data security and personal information protection for the Hong Kong IPO of an e-commerce omni-directional marketing management services company.
Leading French skincare brand: provided legal services to the client’s Chinese subsidiary in relation to the protection of personal information, including revising the personal information protection policy and offering advice on data compliance and outbound data transfer matters.
Well-known outdoor brand: provided a response plan for it to respond to the inspection and rectification requirements of the Multi-level Protection of Information Security put forward by the regulatory authorities, and assist it in communicating with the regulatory authorities on the rectification of the Multi-level Protection of Information Security report.
Other industries
Industrial Manufacturer: conducted cybersecurity and data compliance assessment for a wholly owned manufacturing subsidiary of a European refractory manufacturer in the territory.
Payment company: provided compliance analysis and feasibility suggestions on regulatory issues that may be involved in the expansion of instant messaging business in China by a multinational payment company, covering issues like value-added telecommunications regulation, content management, Internet information services and whether the derivative services and products involved in the chat content of users can be used.
Medical AI solution provider: advised on pre-IPO data compliance program covering AI and deep learning technologies for a leading medical AI solution provider.
Communications and information technology solution provider: advised a communications and information technology solutions provider on data compliance and personal information protection matters including important data identification, self-assessments for outbound data transfers, personal information audits, and due diligence on data assets and transactions.
Smart recruitment platform: providing legal services relating to data compliance and personal information protection in relation to recruitment and HR products for a business developing smart recruitment management systems.
A leading European furniture brand: Provided ongoing legal support on data compliance and personal information protection in China for a prominent European furniture brand. Services included drafting and updating privacy policies, conducting PbDs and PIAs for different scenarios, assisting with PIPCA, regulatory filings, and so on.
GDPR
US fashion e-commerce platform: provided legal analysis and compliance advice for client's data compliance under Chinese law and GDPR.
Automobile manufacturer: developed and implemented a compliance program for a Chinese automobile manufacturer launching a sales website in Europe, including conducting gap analysis of website functionality and personal information collection and use, drafting user agreement and privacy policy, and updating standard contract clauses for cross-border data transfers within auto manufacturer's group.
Civil aviation information technology company: provided compliance advice under the GDPR for a civil aviation information technology company.
Medical AI solution provider: provided multi-jurisdictional data compliance services for another top provider of medical AI solutions.
Cybersecurity company: provides legal consulting services for privacy protection and data compliance for the company's software and smart devices in accordance with the PRC and the GDPR.
Data Protection Impact Assessment (DPIA)
Advertising and marketing technology services company: evaluated and issues legal opinions for the processing of personal information under anonymous subscription SMS delivery products and anonymous ID marketing products with clients.
Online media and value-added information service provider: assessed the personal information processing activities involved in the procurement of app promotion services for clients, provided compliance advice and assisted in revising the agreements signed between clients and marketing and promotion platforms.
Electronics distribution company: provided gap analysis and compliance recommendations for the employee personal information protection of a U.S. electronics distribution company.
Airports group company: performed due diligence and gap analysis and provided compliance recommendations on deployment of facial recognition technology and business use cases for an airports group company as a critical information infrastructure operator.
FinTech service provider: assessed the personal information processing activities involved in loan risk management data products listed on data exchanges for clients, and issue an assessment report.
Architecture: assessed the personal information processing activities involved in listing data products for clients at data exchanges and issue legal opinions.
Outbound Data Transfer
French fashion retailer: advised on protection and outbound transfer of employees’ PI for the client’s Chinese subsidiary, including due diligence, gap analysis and provision of compliance suggestions, preparation of assessment report, and assisted in the filing of China SCC for the outbound transfer of personal information in Shanghai.
European medical device company: provided legal services for its Chinese subsidiary in relation to outbound data transfer and data hosted by data exchanges in China, and assisted in the filing of China SCC for the outbound transfer of personal information. The Chinese subsidiary intends to file the China SCC with the cyberspace administration authority in Beijing and is currently in the stage of implanting compliance measures and preparation of materials for filing.
European supplier of refractory products: provided data compliance services to the client, including due diligence, gap analysis, compliance advice, and assisted in completing the filing of a standard contract for the exit of personal information in Shanghai.
European machinery manufacturing company: provided data compliance (including outbound data transfer) services to the client, including due diligence, gap analysis, providing and assisting in the implementation of compliance advice, and assisting in the filing of China SCC. This is one of the first batch of filings accepted by the regulator in Zhejiang Province.
European automotive group: provided data compliance services to the client, including due diligence, gap analysis and assistance in implementing compliance advice, and assisted in completing the filing of China SCC for the outbound transfer of personal information in Shanghai.
German medical device manufacturer: provided legal services for the filing of China SCC for the outbound transfer of personal information in Beijing, covering the expert argumentation, questionnaire completion and report feedback.
Sino-German joint venture for chemical manufacturing: provided data compliance legal services to the client, including due diligence, gap analysis, providing and assisting in the implementation of compliance advice, and assistance in the filing of China SCC for the outbound transfer of personal information in Jiangsu Province.
American environmental science corporation: provided data compliance services to the client, including conducting legal due diligence, assisting the client in conducting self-assessment and preparing the self-assessment report, and assisted in completing the filing of China SCC for the outbound transfer of personal information in Shanghai.
U.S. real estate management company: provided legal services on the risk assessment for outbound data transfer and filing of the risk assessment. The filing has been accepted by the cyberspace administration authority in Shanghai and is awaiting feedback.
U.S. electronics distribution company: provided gap analysis and compliance recommendations for the employee personal information protection of a U.S. electronics distribution company and provided compliance analysis and advice on the outbound transfer of personal information.
Hong Kong jewelry and gold ornament company: advised on outbound data transfer, including due diligence, gap analysis, provision of compliance, preparation of the risk assessment report, and assistance with the implementation of compliance suggestions and filing of the security assessment with the regulator.
Hong Kong real estate company: advised on outbound data transfer and assisted with the risk assessment and filing of the security assessment. The filing has been accepted by the Cyberspace Administration of China and is currently implementing compliance measures according to feedback.
Global business communications platform: advised the client on its personal data protection issues in the Chinese market, and assisted in conducting a risk assessment of its Chinese subsidiary’s outbound data transfer.
A leading domestic home appliance brand: provided comprehensive legal services on privacy protection and data compliance for a prominent domestic home appliance brand expanding into over 30 countries across Europe, North America, Southeast Asia, the Middle East, and Africa. Our work included conducting legal and regulatory research, drafting privacy policies, preparing cross-border data transfer agreements, and other related services.
Data Breach Response
App inspection response: advised on compliance issues regarding the collection and use of personal information by the App of an online medical continuing education platform and assisted in responding to enforcement inspections regarding the App.
HR data Breach Response: analyzed incident reporting obligations related to a data breach involving unauthorized access and downloads of employee information from an online HR management system at a chemical manufacturing company.
Transactions and Corporate Business
Online medical education platform: advised on an e-learning platform which focuses on continuing education of medical professionals and advised on corporate issues and various compliance matters for its daily operation.
European software company: advised on corporate issues and various compliance matters for a European software company’s operation in China.
Security company: advised a security company on legal issues and compliance matters in its daily operation.
LL.B., East China University of Political Science and Law
LL.M., University of California, Berkeley, School of Law, Berkeley, CA
Dacheng Law Firm (Shanghai) (December 2020 - Present)
Shanghai Daopeng Law Firm (September 2018 - July 2019)
Shanghai Heqin Law Firm (August 2015 - August 2018)
Zhongyin Law Firm (Shanghai) (July 2014 - July 2015)
PRC Bar
Law & Tech Certificate (Berkeley)
Global Data Compliance Response for Chinese Enterprises Going Global, China Commercial Press, 2025.
《中国企业出海的全球数据合规应对》，中国商业出版社，2025
Copyright © 2024 Dacheng All Rights Reserved 2024
Beijing Public Security Network Registration: No. 11010502053550