Privacy & AI Consultant

Key Responsibilities: Draft, review, and update consumer and employee privacy notices and disclosures, including helping ensure that disclosures accurately reflect actual data practices. Develop and support data subject access request (DSAR) programs, including access, deletion, correction, and opt-out requests, and help clients develop effective processes for receiving, verifying, tracking, and responding to requests. Conduct and document Data Protection Impact Assessments (DPIAs) / Data Protection Assessments and similar privacy assessments for products, technologies, vendors, and data-processing activities. Develop and maintain data inventories and data maps, working with legal, business, product, engineering, and other stakeholders to understand how personal data is collected, used, disclosed, retained, and deleted. Assist clients with cookie and tracking-technology management, including cookie inventories, consent banners, preference centers, and related compliance documentation. Help design, implement, and assess consent and privacy opt-out mechanisms, including processes for honoring consumer privacy choices across websites, applications, and internal systems. Conduct privacy-related research and translate regulatory requirements into practical policies, procedures, workflows, and implementation recommendations. Work collaboratively with attorneys and client privacy, product, engineering, marketing, and compliance teams. Develop clear, polished client deliverables, including assessments, implementation plans, process documentation, data-flow materials, and compliance recommendations. Assist clients with identifying practical solutions to privacy issues that take into account both legal requirements and how their products, technologies, and business processes actually operate.

Required Experience: Candidates should have meaningful hands-on experience in several of the following areas and familiarity with all of them: Privacy notices DSARs and consumer rights request processes DPIAs or comparable privacy assessments Data inventories and data mapping Cookie and tracking-technology management Consent and privacy opt-out mechanisms Candidates must have implemented, supported, or operated these processes in practice. Experience limited primarily to legal research or regulatory analysis will not be sufficient. Preferred Experience and Credentials Experience or expertise in one or more of the following areas would be a plus: Marketing and adtech privacy, including experience with advertising technologies, cookies, pixels, SDKs, targeted advertising, measurement, and related consent and opt-out requirements. Privacy engineering, including experience working with engineering or product teams to translate privacy requirements into technical or product requirements. AI governance or AI red teaming, particularly experience evaluating AI systems, products, or use cases for privacy, data governance, safety, or compliance risks. Relevant AI governance, responsible AI, or AI risk management credentials, such as the IAPP Artificial Intelligence Governance Professional (AIGP) certification or another recognized AI governance or risk certification. Relevant professional privacy certifications, particularly IAPP CIPP credentials appropriate to the candidate’s experience and areas of practice, such as CIPP/US or CIPP/E, and CIPM or CIPT. In-house experience working and collaborating with legal to implement legal requirements and best practices in products and systems.

Qualifications: Experience working in a privacy, data protection, compliance, consulting, technology, or related role. Working knowledge of major privacy and data protection frameworks and laws, such as the GDPR, CCPA/CPRA, and other U.S. state comprehensive privacy laws. Strong analytical and organizational skills, with the ability to move between regulatory requirements and detailed operational implementation. Excellent written and verbal communication skills, including the ability to explain complex privacy requirements clearly and practically. Comfort working directly with clients and collaborating with cross-functional teams. Strong attention to detail and the ability to produce accurate, polished client deliverables. Ability to manage multiple projects and workstreams effectively. An interest in technology and a willingness to dig into how products, systems, data flows, and business processes actually work. The judgment to recognize when an issue requires additional legal, technical, or subject-matter expertise. A law degree is not required. Candidates may come from an in-house privacy team, consulting firm, technology company, privacy operations team, law firm, or similar environment.

What We Are Looking For: Above all, we are looking for someone who is practical, curious, detail-oriented, collaborative, and comfortable getting into the operational details of privacy compliance. The right person can take a legal or regulatory privacy requirement and help answer the next question: What does the client actually need to do to implement this? We also seek someone who can understand our clients’ business objectives and learn how their technology affects the collection, use, sharing, storage, and protection of data. We do not expect candidates to arrive as experts in every area listed above. We do expect a solid foundation in core privacy operations, sound judgment, strong communication skills, excellent attention to detail, and an eagerness to develop deeper expertise in emerging areas such as adtech, privacy engineering, and AI. Relevant privacy and AI certifications are valued as evidence of additional subject-matter knowledge, but practical experience implementing privacy requirements is particularly important for this role.