Privacy & Compliance Officer

Location:

Type:

Environment:

Role Overview

We are looking for a Privacy & Compliance Officer who can take complete ownership of our data protection, privacy governance, documentation, policy development, and audit readiness. This role requires someone who understands modern SaaS environments, cloud security controls, and privacy expectations in large enterprise supply chains.

You will maintain privacy policies, ensure correct handling of personal data, review third-party systems, and prepare evidence and documentation for external reviews. You’ll also work closely with our technical and operations teams to ensure privacy requirements are consistently implemented across tools, platforms, and workflows.

Key Responsibilities

Privacy Program Ownership

• Maintain and update the company’s privacy documentation (policies, notices, registers, SOPs).
• Ensure personal data is collected, used, stored, and deleted in accordance with documented requirements.
• Maintain data flow diagrams and system inventories with accurate data classifications.
• Oversee access rights, data minimization, and least-privilege enforcement across systems.

Data Handling & Governance

• Ensure data retention and deletion schedules are followed across all systems (LMS, CRM, SharePoint, email, endpoints, etc.).
• Maintain records of processing activities and vendor assessments.
• Monitor data transfers, storage locations, and third-party access.
• Review configurations of systems that process personal data to ensure proper privacy controls.

Compliance & Audit Preparation

• Maintain an audit-ready evidence library including:
• Device encryption status
• Identity & access management records
• Data retention and deletion logs
• Incident response documentation
• Policy version history
• Prepare screenshots, reports, and narrative descriptions required during external reviews.
• Track compliance tasks monthly, quarterly, and annually.

Security & Data Protection Collaboration

• Work closely with M365 Admin and Security teams on:
• Conditional access
• Endpoint compliance
• DLP rules
• Access reviews
• Identity lifecycle
• Ensure the privacy perspective is embedded into technical workflows (onboarding, offboarding, access requests, system provisioning).

Incident Response & Reporting

• Maintain and improve the incident response plan.
• Coordinate triage, documentation, and notification workflows during any data incident.
• Maintain a log of historical incidents and corrective actions.
• Run periodic drills or tabletop exercises.

Vendor & Third-Party Oversight

• Maintain records of all platforms used by the company and their privacy/security positions.
• Conduct privacy impact checks for new tools.
• Ensure vendor contracts include appropriate data protection terms.
• Track and follow up on any vendor-related risks or required remediations.

Training & Awareness

• Conduct privacy awareness sessions for employees.
• Maintain training logs and completion records.
• Publish internal updates on new policies, changes, or reminders.

Required Skills & Experience

• Solid understanding of global privacy principles (purpose limitation, minimization, retention, security, access control).
• Experience managing privacy documentation, registers, and evidence libraries.
• Familiarity with cloud security and SaaS platforms, ideally Microsoft 365.
• Strong analytical skills to interpret how policies apply to technical systems.
• Ability to write clear, precise documentation and procedures.
• Excellent organizational discipline and attention to detail.