Senior Counsel, Privacy & Data Protection Officer (EU/UK)

requirements. Advise on privacy-by-design and data protection-by-design principles across the full range of TFH products, services, and technologies. Lead drafting, review, and maintenance of privacy notices, policies, disclosures, consent frameworks, and internal governance documentation. Provide practical and strategic legal guidance on GDPR, UK GDPR, ePrivacy, AI regulation, biometrics, digital identity, cross-border transfers, marketing, cookies, and emerging global privacy frameworks. Partner closely with product, engineering, security, policy, communications, and business teams to support innovative product development while managing legal and regulatory risk. Oversee and support Data Protection Impact Assessments (DPIAs), Legitimate Interest Assessments (LIAs), vendor reviews, and records of processing activities (ROPAs). Respond to and manage privacy-related regulatory inquiries, investigations, audits, and enforcement matters globally. Support incident response, breach assessment, notification obligations, and remediation efforts in coordination with Security and Compliance teams. Develop scalable privacy resources, templates, training materials, and operational tools that enable teams across the company to provide consistent and durable guidance. Data Protection Officer

Responsibilities (EU & UK) Serve as the designated Data Protection Officer for relevant EU and UK entities. Monitor organizational compliance with applicable data protection laws, regulations, policies, and standards. Advise the company and internal stakeholders on obligations under GDPR, UK GDPR, CCPA and other global data protection frameworks. Act as the primary point of contact for EU and UK supervisory authorities and cooperate with regulators on data protection matters. Serve as a contact point for data subjects regarding the exercise of their privacy rights and inquiries relating to personal data processing. Independently monitor compliance efforts, including audits, risk assessments, training initiatives, and governance processes. Provide guidance on international data transfer mechanisms, including SCCs, transfer impact assessments, and evolving EU/UK transfer

requirements. Support the ongoing development and maturity of the company’s global privacy governance framework and accountability program. Knowledge, Skills & Abilities Deep expertise in privacy, cybersecurity, AI, and technology regulation. Strong working knowledge of GDPR, UK GDPR, ePrivacy

requirements, CCPA LGPD, APAC privacy laws, and other major global privacy frameworks. Experience supporting privacy compliance programs in multinational organizations. Hands-on experience with privacy regulatory investigations, incident response management, breach reporting, and operational privacy governance. Demonstrated understanding of data protection officer obligations and regulatory expectations in the EU and UK. Ability to balance legal risk with practical business objectives in a fast-moving technology environment. Strong strategic thinking and judgment with the ability to prioritize effectively amid ambiguity and evolving priorities. Excellent written and verbal communication skills, including the ability to explain complex legal concepts to technical and non-legal audiences. Detail-oriented, collaborative, business-minded, and comfortable operating independently in a high-growth environment. Enthusiasm for emerging technologies, including AI, blockchain, digital identity systems, and cryptocurrency ecosystems. Strong interpersonal skills and a positive, solutions-oriented mindset. A sense of humor. Minimum

Qualifications Fully qualified lawyer in Germany, another EU jurisdiction, the UK, or the United States (or equivalent foreign qualification). Ability to serve as Data Protection Officer under GDPR and UK GDPR

requirements. 8+ years of legal experience, including experience at a law firm, in-house legal department, and/or government authority. Significant experience advising on global privacy laws, regulations, and compliance frameworks, particularly in the technology, internet, social media, AI, or digital products sectors. Experience advising on privacy legal risks, mitigations, governance structures, and operational compliance programs. Experience handling regulatory investigations and interactions with data protection authorities. Experience working cross-functionally on multiple complex projects in fast-paced environments. Excellent problem-solving, client counseling, and stakeholder management skills. Fluent in German and English, other languages are a plus. Preferred

Qualifications Prior experience serving as a Data Protection Officer or deputy DPO. In-house experience at a multinational technology company. Familiarity with AI governance, biometric data regulation, blockchain technologies, and cryptocurrency-related legal issues. Working proficiency in German and/or additional European languages. Relevant privacy certifications (e.g., CIPP/E, CIPM, CIPT) are a plus.

A meeting lands on your calendar

If they’re a yes, I book the chat. You show up — that’s the whole job-hunt.