Melissa Fai

Biography

Melissa is a Partner in our Technology and Intellectual Property group.

Her clients rely on her advice and solutions to both commercial and regulatory challenges in the tech and digital space.

Melissa's practice spans the whole spectrum of technology contracting, including complex outsourcing, SaaS arrangements, large-scale IT procurement transactions, from both a customer and supplier perspective, digital transformation projects, complex commercial projects and data commercialisation. She also has significant experience advising on the technology separation and transition issues associated with complex M&A transactions.

She is a leading data, privacy, cyber and tech regulatory practitioner. Melissa's experience includes assisting clients in a broad range of sectors, but particularly those in highly regulated industries such as energy and infrastructure, financial services, healthcare and telecommunications, to comply with their privacy (including surveillance issues) and cyber obligations.

Melissa is adept at advising on, and managing the response to, significant cyber-attacks and data breach issues, including reporting obligations to, and investigations conducted by, privacy and other regulators.

She is constantly looking around corners for her clients by focusing on the ever emerging tech and digital regulatory regime; advising on impending privacy and cyber law reform, online safety, as well as mis/disinformation, Consumer Data Right, security of critical infrastructure and developing AI reform.

Experience

Melissa’s experience includes advising:

  • Microsoft on its strategic commercial deals in the region and advice on regulatory reforms and proposed new legislation in Australia.

  • A Big Four Bank on the procurement of its fleet of POS devices and related systems for its merchant services business; and its agreement with a global telecommunications provider about its network perimeter security services.

  • Department of Home Affairs and ComCover on a large representative complaint under the Privacy Act. One of the first data breach class actions to be run in Australia, particularly under the federal Privacy Act.

  • PwC on its agreement with the Australian Bureau of Statistics for the development, implementation, hosting and support of the Australian Census.

  • Clients including Energy One, Tissupath and Australian Clinical Labs, on triaging and responding to major cyber incidents and data breaches, and navigating compliance regimes and engagement with regulators.

  • MYOB on the proposed sale of MYOB to ANZ; the acquisition of GreatSoft; and its establishment of a strategic commercial relationship with Butn.

  • The Department of Customer Services and TfNSW on the privacy impact assessment for a new government digital identity service.

  • A Big Five consulting firm on the proposed sale of its own internally developed SaaS platform to a commercial buyer, including the multijurisdictional SaaS licensing arrangements back from the potential buyer.

  • NSW Health and the Breast Cancer Institute of NSW on the procurement of an AI solution to assist in scanning mammogram images and diagnosis of breast cancer.

  • Velocity Frequent Flyer on its submissions on privacy and data to the ACCC’s inquiry into customer loyalty schemes.

  • An international human rights organisation on a public cloud migration project and the relevant data security, surveillance and intercept concerns under surveillance and telecommunications legislation.

  • Various clients on the technology and data separation aspects of complex M&A transactions, including KKR’s proposed $2.175 billion purchase of Perpetual.

Awards and Recognition

  • The Legal 500 Asia Pacific 2024

    Leading Individual for Data Protection

  • The Best Lawyers in Australia 2025

    Information Technology Law Outsourcing Law

  • Doyle’s Guide 2022

    Recommended for Technology, Media & Telecommunications