Michael Morris

Michael is a senior legal expert in data, cyber, privacy, technology and AI; ICT procurement and digital transformation; and commercial IP. He is known for calm, pragmatic and commercially grounded advice.

Widely regarded as a “safe pair of hands” and a “quiet achiever”, he advises on data breaches, cyber incidents and data handling regulatory investigations. Having advised on privacy, technology and data issues for 25+ years across the Asia-Pacific and London, his deep experience, knowledge of his clients’ operations and insight into the expectations of regulators such as the OAIC, ASIC, APRA and CISC enable him to guide organisations in strengthening their data and AI governance, cyber resilience, AI enablement and digital transformation programs.

He also specialises in IT and telecommunications procurement, outsourcing, and commercial IP.

He has extensive experience across the technology and data, financial services, government, infrastructure, energy, education, not‑for‑profit and transport sectors.

Admitted in 2001, Michael was a partner at a top‑tier Australian firm from 2013 to 2021 and now consults with Mills Oakley.

Memberships, Accreditation and Activities

  • Bachelor of Laws (Hons), QUT, Brisbane (1998)
  • Bachelor of Business (with Distinction), QUT, Brisbane (1998)
  • Admitted to the Supreme Court of Queensland (2001), High Court of Australia (2001)
  • Queensland Law Society, Member (1999 – present)
  • The Best Lawyers in Australia ‘Lawyer of the Year’ for Brisbane, ‘Privacy and Data Security Law’, 2025
  • The Best Lawyers in Australia ‘Lawyer of the Year’ for Brisbane, ‘Privacy and Data Security Law’, 2022
  • The Best Lawyers in Australia for ‘Information Technology Law’, 2025

Expertise

  • ICT procurement and other ICT commercial arrangements
  • Privacy, cyber and digital law and regulation including for entities regulated by APRA/CPS 230, 231 and 234 and CISC/SOCI
  • Data and AI governance
  • Data breach preparedness and incident planning
  • Data breach and cyber incident response
  • Data handling regulatory investigations
  • Commercial intellectual property
  • Privacy/Cyber/IT/IP due diligence for corporate, government and finance transactions and projects
  • Digital transformation, systems separations and transitional service agreements
  • Business process outsourcing

Recent Matters

  • Major European car manufacturer on data protection / privacy compliance, information governance and connected vehicle regulation re its current and planned Australian operations.
  • Major social media platform on numerous hacked account matters.
  • Service NSW on its data breach of 47 employee mailboxes, involving 3.8 million documents affecting 100,000 NSW residents.
  • ANZ on the IP, IT, and data sharing arrangements in connection with the splitting and $3.8bn divestment of its wealth division to Zurich (life insurance business) and IOOF (super, investments and aligned dealer groups business), and the associated strategic alliance / distribution agreements regarding data sharing.
  • Big four bank on numerous notifiable data breaches, and on two comprehensive preliminary enquiry investigations by the OAIC into various data handling practices.
  • Major roll road operator on various notifiable data breaches and privacy compliance issues.
  • A major insurer on APRA regulated material outsourcing agreements.
  • Queensland Rail on its $100m managed technology services procurement awarded to DXC, assisting with all procurement stages including evaluation, competitive dialogue, and vendor negotiations.

Memberships, Accreditation & Activities

  • Bachelor of Laws (Hons), QUT, Brisbane (1998)
  • Bachelor of Business (with Distinction), QUT, Brisbane (1998)
  • Admitted to the Supreme Court of Queensland (2001), High Court of Australia (2001)
  • Queensland Law Society, Member (1999 – present)
  • The Best Lawyers in Australia ‘Lawyer of the Year’ for Brisbane, ‘Privacy and Data Security Law’, 2025
  • The Best Lawyers in Australia ‘Lawyer of the Year’ for Brisbane, ‘Privacy and Data Security Law’, 2022
  • The Best Lawyers in Australia for ‘Information Technology Law’, 2025