Data Privacy Officer

Responsibilities include but are not limited to:

• Own and continuously enhance the enterprise privacy program, including policies, standards, procedures, controls, governance, tools, documentation, and reporting across the organization and subsidiaries.
• Monitor and interpret applicable privacy laws and regulations (e.g., GLBA, Regulations P and S-P, CCPA/CPRA, and state privacy laws), assess enterprise impacts, and direct implementation of required changes.
• Lead privacy risk management, including privacy impact assessments, privacy-by-design reviews, independent challenge, risk acceptance recommendations, and mitigation planning for products, services, systems, vendors, and technologies.
• Establish requirements and oversee the accuracy of data inventories, data maps, and records of processing activities covering personal information collection, use, sharing, retention, notices, and disclosures.
• Govern privacy operations, including consumer rights requests, consent and preference management, privacy notices, escalations, service levels, controls, and evidence retention.
• Oversee privacy reviews of third parties, contracts, and data-sharing arrangements, ensuring appropriate obligations, controls, remediation, monitoring, and control testing are in place.
• Partner with Legal, Compliance, Risk, Information Security, Technology, Marketing, Procurement, and business leaders to operationalize privacy requirements and resolve material issues.
• Govern privacy aspects of AI platforms and use cases, including intake, risk tiering, assessments, incident management, data subject rights, and alignment with applicable AI risk management frameworks.
• Identify, escalate, and oversee remediation of privacy risks, compliance gaps, incidents, complaints, and control weaknesses; represent the program in audits, examinations, breach response, and risk acceptance processes.
• Define privacy metrics, KRIs, KPIs, training, and executive reporting; support governance committees and foster enterprise-wide privacy accountability and awareness.