Director, Global Privacy Program

Overview

The organization is seeking a Global Privacy Program Director to coordinate day-to-day privacy program operations and implementation under the direction of the Deputy General Counsel, Global Privacy, Cybersecurity and AI Governance Officer; Chief Privacy Officer.

This full-time role requires a highly responsive, technology-aware, and business-oriented privacy professional who can translate privacy strategy, regulatory obligations, emerging AI requirements, and leadership priorities into practical controls, policies, workflows, notices, and operating guidance across the United States, EMEA, and other global markets.

Responsibilities

• Coordinate day-to-day execution and continuous improvement of the global privacy and data-protection program in alignment with strategy, priorities, and risk direction set by the Chief Privacy Officer, including policies, standards, procedures, controls, issue tracking, testing, and remediation.
• Implement privacy governance processes, decision records, escalation pathways, and accountability mechanisms approved by the Chief Privacy Officer to ensure privacy issues are identified, owned, tracked, and resolved in a timely manner.
• Operate with a high degree of independence on day-to-day program execution, using sound judgment to prioritize work, make practical recommendations, and escalate material legal, regulatory, client, or enterprise risk issues to the Chief Privacy Officer.
• Provide practical program support and operational guidance on GDPR, UK GDPR, U.S. state privacy laws, and other global privacy and data protection requirements.
• Track privacy, cybersecurity, AI, and data-governance developments and prepare practical recommendations, roadmap updates, training, templates, notices, and operational control enhancements for review and direction by the Chief Privacy Officer.
• Apply emerging AI laws, regulations, regulatory guidance, and AI governance requirements to privacy program activities, including policy updates, just-in-time notices, DPIA/PIA enhancements, data-use reviews, and practical evaluation of AI-related privacy risk.
• Partner closely with Legal, Information Security, IT, Product, Operations, Sales, HR, and client-facing teams to embed privacy-by-design into new products, services, client solutions, vendor relationships, and internal initiatives.
• Partner effectively with regional stakeholders, including EMEA Legal, Security, Operations, and client-facing teams, to address GDPR, UK GDPR, cross-border transfer, and other regional privacy requirements as part of the broader global privacy program.
• Maintain, refresh, and mature core privacy program elements, including records of processing, data maps, DPIA/PIA processes, privacy notices, consent and rights processes, data retention, cross-border transfer assessments, training, audit readiness, and related transfer compliance controls.
• Identify opportunities to automate privacy operations where practical, including intake, workflow, reporting, evidence collection, reminders, control tracking, and other repeatable privacy program activities.
• Develop and maintain global privacy policies, procedures, playbooks, templates, training, and communications that are clear, practical, and aligned with business operations.
• Support operational privacy risk review in commercial, client, vendor, supplier, and technology matters, including DPAs, data processing terms, security/privacy questionnaires, data-use restrictions, audit rights, AI-enabled services, just-in-time notices, and sensitive data use cases; escalate material privacy, AI, client, regulatory, or enterprise risk issues to the Chief Privacy Officer.
• Support privacy incident readiness and response by partnering with Legal, Security, and business stakeholders to assess risk, coordinate response activities, and document outcomes.
• Maintain privacy program metrics, dashboards, control testing, remediation plans, and risk reporting inputs to support Chief Privacy Officer-led executive readouts, roadmap decisions, and leadership reporting.
• Support regulatory inquiries, investigations, audits, and information requests by coordinating documentation, facts, timelines, evidence, and draft response materials for Chief Privacy Officer review and direction.

Requirements

• Minimum 7+ years of relevant privacy, data protection, compliance, technology law, and/or privacy operations experience.
• Deep, practical knowledge of GDPR is required, along with strong familiarity with UK GDPR, EMEA privacy requirements, U.S. state privacy laws, international transfer requirements, data governance, privacy operations, and privacy risk management.
• IAPP certification strongly preferred, including CIPP/E and/or CIPP/US; CIPM, CIPT, or other recognized privacy, data protection, or security certifications are a plus.
• D., equivalent legal qualification, or comparable.
• Excellent drafting, communication, and training skills, with the ability to translate complex privacy requirements into clear, actionable guidance for legal, technical, and business audiences.
• Strong business judgment and professional presence, with the ability to support leadership discussions, influence cross-functional stakeholders, and elevate issues requiring Chief Privacy Officer direction.
• Working familiarity with AI governance concepts and emerging AI regulatory frameworks, with the ability and interest to develop deeper fluency and apply AI requirements to privacy policies, notices, assessments, and risk reviews.
• Ability to interpret regulatory guidance and enforcement trends and convert them into practical, risk-based recommendations for business, legal, security, and technology stakeholders.
• Experience supporting interactions with privacy, data protection, or other relevant regulators, including preparing factual summaries, documentation, evidence, and draft response materials for senior legal review.

Preferred Qualifications

• Significant experience improving and managing day-to-day privacy program operations, including governance forums, policy frameworks, controls, issue management, regulatory change management, metrics, roadmap support, and reporting inputs.
• Experience building, scaling, maintaining, or materially improving privacy program components such as DPIAs/PIAs, data mapping, records of processing, privacy notices, consent and preference processes, DSARs, vendor privacy reviews, third-party risk, training, audits, readiness assessments, and recurring control refresh processes.
• Demonstrated experience supporting EMEA operations and stakeholders; experience collaborating across UK, EU, APAC, and U.S. teams is strongly preferred.

Location

United States, EMEA, and other global markets