Nora Santalu

Nora Santalu is a Senior Associate in the privacy and data protection team in London. Her primary practice area is Data Protection Law, and she advises on the GDPR and the EU AI Act with a particular focus on the regulation of biometrics and fraud prevention tools.

She has many years of experience advising on various types of biometric tools, including identification, verification, age estimation, emotion recognition and biometric categorisation, and their regulation under the GDPR and the EU AI Act. Her practice also covers automated decision-making tools, fraud prevention and data brokering arrangements, and she has a keen interest in neuroscience and neurotechnologies.

She was invited by the European Parliament as a speaker in May 2024 to discuss the regulation of biometrics in the EU. She has spoken at industry events such as the IAPP AIGG Europe 2025 and has been cited by the Harvard Cyberlaw Clinic's Memorandum to Representative Stephanie Jerome on recommendations for the regulation of biometrics in the State of Vermont. She has also been quoted in the International Journal of Applied Engineering & Technology.

Since joining Bird & Bird, she has undertaken six secondments totalling four years at a financial services institution, where she gained experience in fraud prevention tools, data brokering arrangements, the payment ecosystem and open banking.