Data Policy Manager

Job Description:

At Bank of America, we are guided by a common purpose to help make financial lives better through the power of every connection. We do this by driving Responsible Growth and delivering for our clients, teammates, communities and shareholders every day. Being a Great Place to Work and providing a culture of caring is core to how we drive Responsible Growth. We are intentional about fostering an inclusive workplace where every teammate has the opportunity to succeed, build a career and contribute to our shared success. This includes attracting and developing exceptional talent, recognizing and rewarding performance, and supporting our teammates’ physical, emotional, and financial wellness through affordable, competitive and flexible benefits. We value the unique perspectives individuals bring from all backgrounds and career paths - whether shaped by military service, community college education, or a wide range of work and life experiences. These journeys foster resilience, leadership and innovation, strengthening our workforce and positively impact the communities we serve. Bank of America is committed to an in-office culture that supports collaboration, engagement, and career development. Our approach includes clear in-office expectations, while providing an appropriate level of flexibility based on role-specific responsibilities and business needs. At Bank of America, you can build a successful career with opportunities to learn, grow, and make an impact. Join us!

Job Description:
This job is responsible for keeping line of sight into any data risk and related issues impacting the FLU/CF, in accordance with other data related policies. Key responsibilities include monitoring key performance indicators and internal controls, identifying gaps in adherence and escalations, and working with partners to develop plans to close gaps and ensure effective controls over data for respective Domain. Job expectations include partnering with technology to create an infrastructure and processes that enable adherence to the other data related policies and other regulatory mandates.

This role supports the Enterprise Privacy Program across EMEA and Canada. You will help adapt regional privacy frameworks, support statutory Data Protection Officer (DPO) obligations, and manage local privacy regulatory change and regulator engagement. You will also provide advisory support in a dynamic, regulated financial environment and work with cross-functional teams to strengthen compliance and operational effectiveness.

Responsibilities:

• Provide privacy leadership, strategic guidance, and advisory support across non-U.S. jurisdictions.
• Adapt and operationalize global privacy frameworks to meet regional and local regulatory requirements.
• Assess privacy regulatory developments and oversee implementation of required changes.
• Maintain DPO governance documentation and support compliance with statutory DPO obligations.
• Prepare annual DPO reports for EU and UK legal entity boards.
• Manage regulatory and consumer privacy complaints, including appropriate escalation and resolution.
• Contribute to privacy incident and breach assessments, notification processes, and Data Protection Impact Assessments (DPIAs).
• Contribute to the design, implementation, and ongoing maintenance of Privacy Standards, Playbooks, Metrics, and Quality Assurance programs.
• Support regional privacy training, controls, governance, and regulatory engagement.
• Maintain strong knowledge of privacy compliance requirements and operational risks across assigned jurisdictions.

• Monitor industry trends, regulatory developments, and emerging privacy and data protection risks to proactively identify and address potential impacts.

Required Qualifications:

• Relevant professional experience in privacy, data protection, compliance, risk management, legal, or a related field, with demonstrated experience implementing or supporting privacy programs.
• Working knowledge of privacy and data protection laws, regulatory requirements, and industry practices, with the ability to apply them in a business environment.
• Knowledge of EMEA and Canadian privacy requirements, with familiarity with major global privacy frameworks such as GDPR, UK GDPR, and CCPA/CPRA.
• Strong technical and data acumen, with the ability to assess new technologies, products, and data uses and advise on applicable privacy requirements and risks.
• Experience conducting or supporting Data Protection Impact Assessments (DPIAs), privacy risk assessments, and data incident or breach assessments, including notification considerations.
• Ability to interpret complex legal and regulatory requirements and translate them into practical, risk-based guidance and solutions.
• Strong analytical, problem-solving, and sound judgment skills, with the ability to appropriately assess and escalate complex or emerging privacy risks.
• Demonstrated ability to identify emerging privacy and data protection risks, assess potential business impacts, and recommend proactive mitigation strategies.
• Effective written and verbal communication skills, including the ability to communicate privacy and regulatory matters clearly to a range of audiences, including senior leaders and governance bodies.
• Strong collaboration and stakeholder management skills, with the ability to build effective relationships across Legal, Compliance, Risk, Technology, Cybersecurity, Data, and business functions.
• Ability to work effectively across functions, cultures, and geographies, both independently and collaboratively.
• Ability to manage competing priorities and regulatory requirements across multiple jurisdictions in a complex business environment.
• Demonstrated commitment to continuous learning, including staying current on evolving privacy regulations, technologies, regulatory expectations, and emerging risks.

Desired Qualifications:

• Legal or compliance background.
• Experience in financial services or another highly regulated industry.
• Privacy certifications such as CIPP-E, CIPP-M, or equivalent.
• Familiarity with privacy related technology considerations such as AI, automated decision making, digital objects, cross border data transfers, mobile devices, biometrics and geolocation data is desired
• Experience managing or supporting regulatory inquiries, consumer privacy complaints, or interactions with Data Protection Authorities or comparable regulatory authorities.
• Experience supporting DPO activities and participating in DPDA programs.
• Experience preparing or presenting privacy, compliance, or risk matters to senior executives, governance committees, or legal entity boards.
• Demonstrated prior experience working in a highly matrixed, complex organization

Skills:

• Interpret Relevant Laws, Rules, and Regulations
• Attention to Detail
• Regulatory Change Implementation and Control Design
• Risk Management
• Written Communications
• Active Listening
• Critical Thinking
• Influence
• Issue Management
• Policies, Procedures, and Guidelines
• Decision Making
• Monitoring, Surveillance, and Testing
• Negotiation
• Process Management
• Relationship Building

Shift:

1st shift (United States of America)

Hours Per Week: 

40

Pay Transparency details

US - NJ - Pennington - 1400 American Blvd - Hopewell Bldg 4 (NJ2140), US - NY - New York - 1100 Ave Of The Americas - Two Bryant Park (NY1540)Pay and benefits informationPay range$120,000.00 - $185,000.00 annualized salary, offers to be determined based on experience, education and skill set.Discretionary incentive eligibleThis role is eligible to participate in the annual discretionary plan. Employees are eligible for an annual discretionary award based on their overall individual performance results and behaviors, the performance and contributions of their line of business and/or group; and the overall success of the Company.BenefitsThis role is currently benefits eligible. We provide industry-leading benefits, access to paid time off, resources and support to our employees so they can make a genuine impact and contribute to the sustainable growth of our business and the communities we serve.