Legal Counsel - Data Privacy

The Legal Counsel, Data Privacy serves as a strategic legal advisor responsible for providing guidance on privacy, data protection, cybersecurity, digital technologies, artificial intelligence (AI), data governance, and regulatory compliance. This role partners closely with the business, technology, information security, product, marketing, and compliance teams to enable innovation while managing legal and regulatory risks associated with the collection, use, storage, transfer, and protection of data.

Minimum Education and/or Experience:

• Juris Doctor (JD) from an accredited U.S. law school. 
• Active member of the Florida Bar or Florida Authorized House Counsel in good standing. 
• 5 years of relevant legal experience, preferably combining law firm and in-house practice. 
• Experience in cybersecurity, AI, and data privacy.

Knowledge, Skills, and Abilities

• Deep knowledge of global privacy laws and digital regulations.
• Experience advising on cybersecurity incidents and regulatory investigations.
• Strong contract drafting and negotiation skills.
• Ability to communicate complex legal concepts to non-legal stakeholders.
• Excellent communication and stakeholder engagement skills, including interaction with senior leadership. 
• Strong project management and cross-functional collaboration capabilities. 

Preferred:

• In-house experience within a technology, digital services, aviation, financial services, or highly regulated industry.
• Privacy certifications (e.g., CIPP/US, CIPP/E, CIPM, CIPT, or equivalent).
• Experience with AI governance and emerging technology regulation.
• Familiarity with cloud computing, SaaS platforms, data analytics, and cybersecurity frameworks (e.g., NIST, ISO 27001).

Travel

• Up to 5% travel required. 

Physical Demands

• Standard office environment; ability to perform essential duties with reasonable accommodation as needed. 

Essential Duties and Responsibilities: 

Privacy and Data Protection

• Lead and support the Company’s privacy and data protection program.

• Provide guidance on data lifecycle practices, including collection, use, transfer, and retention of personal data.

• Support privacy-by-design initiatives across products, services, digital platforms, and business processes.

• Conduct and advise on privacy impact assessments, data protection impact assessments, risk assessments, and records of processing activities.

• Oversee third-party data compliance and partner with the IT, security, compliance, and business teams to implement effective privacy controls. 

• Support privacy-related regulatory inquiries, audits, and investigations.

Regulatory Compliance & Governance

• Monitor, interpret, and advise on evolving global digital, privacy, data protection, AI, and cybersecurity laws and regulations, including GDPR, UK GDPR, CCPA/CPRA, PIPEDA, and other emerging frameworks.

• Support development and maintenance of compliance frameworks, policies, training programs, and governance practices.

• Advise executive leadership on legal and regulatory developments affecting digital operations.

• Support regulatory examinations, audits, investigations, and enforcement inquiries.

• Partner with compliance and risk management teams to implement effective governance structures.

Contracting & Commercial Support

• Review and negotiate data processing agreements (DPAs), data sharing agreements, cross-border data transfer mechanisms, and other privacy-related contract terms.

• Draft, review, and negotiate technology and digital services agreements, including software development, hosting,  and managed services. 

• Advise procurement and vendor management teams on third-party risk, data protection, cybersecurity, and compliance considerations.

• Support mergers, acquisitions, partnerships, and strategic transactions involving data and technology assets.

Digital & Technology Law

• Advise on legal issues related to digital transformation, cloud services, SaaS agreements, software licensing, e-commerce, and digital platforms.

• Counsel stakeholders on legal risks associated with emerging technologies such as AI, machine learning, blockchain, and digital identity solutions.

• Support product development teams throughout the product lifecycle.

Cybersecurity & Incident Response 

• Provide legal guidance on cybersecurity governance and risk management.

• Support incident response activities, including breach assessments, notification obligations, regulatory reporting, and communications strategies.

• Advise on legal requirements relating to cyber resilience and security frameworks.

• Collaborate with Information Security and Compliance teams on cybersecurity policies and controls.

Artificial Intelligence & Emerging Technologies

• Provide insights that inform responsible AI use, bias mitigation protocols, and other risk-management safeguards.Review AI use cases, model deployment, vendor solutions, and contractual protections.

• Support the development of internal AI governance frameworks and policies.

• Assess legal risks related to automated decision-making, algorithmic transparency, and intellectual property.