Senior Director, Data Privacy

This is a fully remote position, open to applicants in Pennsylvania.

📋 Description

• Lead and enhance Savara's global privacy program, acting as the main in-house legal advisor on GDPR, UK GDPR, and relevant U.S. federal and state privacy regulations, while also serving as the escalation point for privacy inquiries from any department.

• Manage and execute enterprise-wide Data Protection Impact Assessments (DPIAs), collaborating with the external Data Protection Officer to establish and sustain Records of Processing Activities (ROPAs) across all functions, as well as support audits and regulatory inquiries.

• Draft, implement, and periodically update Savara's fundamental privacy policies and procedures to ensure internal consistency (e.g., aligned breach-notification timelines) and compliance with current laws.

• Oversee the complete data subject/consumer rights program (including access, rectification, erasure, restriction, portability, opt-out, and 'limit the use of sensitive personal information' requests), managing intake channels, identity verification, statutory deadline tracking, and coordination with processors and vendors.

• Develop and maintain a vendor privacy compliance program, which includes a central vendor register, a risk-based due diligence and questionnaire process, as well as a portfolio of Data Processing Agreements (and, where relevant, Business Associate Agreements) with all key and non-key processors, prioritizing vendors that handle special-category or patient data.

• Review and negotiate privacy and data protection clauses in contracts, encompassing data processing agreements (DPAs), clinical trial agreements, master services agreements, vendor agreements, standard contractual clauses (SCCs), and related provisions, ensuring consistent and appropriate privacy language across all contractual forms and third-party engagements.

• Assess and document controller, joint-controller, and processor relationships throughout Savara's operations (including HR employer-of-record arrangements, clinical trial sites and CROs, patient advocacy and expanded access partners, and commercial media/analytics partners) and establish Article 26-compliant joint-controller arrangements where necessary.

• Map Savara's cross-border data transfer processes and implement suitable transfer mechanisms (Standard Contractual Clauses, UK IDTA/Addendum, or successor mechanisms), including Transfer Impact Assessments and supplementary measures when required, and lead the remediation of any outdated or legacy transfer documentation.

• Act as the business owner for Savara's incident and breach response program, ensuring a unified, internally consistent breach-notification procedure that complies with GDPR/UK GDPR, HIPAA, FTC, and applicable state law timelines, and personally lead or co-lead breach investigations and regulator/notification decisions.

• Provide advice to Clinical Operations and Pharmacovigilance on privacy considerations for sponsored trials, expanded access/named-patient programs, and safety data flows, including legal basis, informed consent form privacy language, investigator and site-staff transparency notices, and vendor/CRO data flows.

• Consult with Commercial, Marketing, and Patient Services on privacy-by-design for HCP and patient-facing digital properties, hub and patient-support programs, CRM/analytics platforms, and any real-world-data or de-identification initiatives, including cookie consent, ad-tech governance, and state consumer health data legislation.

• Ensure Savara's compliance with HCP transfers-of-value reporting (Sunshine Act/Open Payments) from a privacy perspective, collaborating with Finance, Compliance, and Commercial to guarantee appropriate notices and data-handling practices are established prior to go-live.

• Design and implement a role-based data protection training and awareness program for all employees and contractors that aligns with compliance initiatives, including tailored modules as necessary, and monitor completion rates.

• Collaborate with IT/the Managed Service Provider on privacy-related security controls (access management, encryption, data classification, and vendor contracts) to ensure that technical and organizational measures are documented and defensible.

• Monitor and provide guidance on emerging and evolving privacy obligations impacting Savara's operations, including new U.S. state privacy laws, changing FTC and state enforcement priorities, and cross-border transfer developments, while periodically updating Savara's data protection gap analysis and the associated remediation roadmap.

• Prepare regular privacy program metrics and status reports (including open data subject requests, breach notifications, vendor compliance status, training completion, DPIA/ROPA coverage) for the Chief Legal Officer and, as necessary, the Audit Committee of the Board of Directors.

• Foster a culture of privacy, ethics, and accountability across all regions.

• Manage contractors, vendors, and/or outside counsel engaged in supporting the privacy program.

• Perform other duties and projects as assigned.

⛳️ Requirements

• Juris Doctor (JD) from an accredited law school.

• Admission to a state bar and an active license to practice law.

• At least 8 years of relevant legal experience, with significant hands-on experience in developing or managing a privacy program, preferably in-house at a life sciences, pharmaceutical, or biotechnology company, or in a law firm or consultancy advising such companies.

• Extensive working knowledge of GDPR and UK GDPR, including practical experience with Records of Processing Activities, DPIAs, cross-border transfer mechanisms, and data subject rights programs.

• Strong understanding of the U.S. privacy landscape relevant to biopharmaceutical companies, including HIPAA, the FTC Act and Health Breach Notification Rule, and state comprehensive and consumer-health privacy laws (e.g., CCPA/CPRA, Washington MHMDA, Connecticut CTDPA, Nevada SB 370).

• Familiarity with clinical trial and pharmacovigilance data flows and applicable regulatory frameworks (ICH-GCP, EU Clinical Trials Regulation, FDA regulations), as well as with life sciences transparency reporting (Sunshine Act/Open Payments).

• Privacy certification(s) such as CIPP/E and/or CIPP/US are highly preferred.

• Proven ability to translate legal requirements into practical, risk-based operational programs and to drive cross-functional remediation efforts to completion, rather than merely identifying gaps.

• Exceptional verbal and written communication skills, with the capability to convey information clearly and persuasively to both technical and non-technical stakeholders and professionals outside the organization.

• Strong project management abilities, with the capacity to develop and execute a multi-year remediation roadmap and prioritize competing demands.

• Proactive, self-directed, and capable of operating with a high degree of ownership and minimal supervision in a dynamic, fast-paced organization.

• Excellent professional judgment, a high level of integrity and trustworthiness, and the ability to cultivate collaborative working relationships across all levels of the organization.

• Adaptable and able to adjust to meet changing business needs as Savara transitions from clinical-stage to commercial-stage operations.

🏝️ Benefits

• Highly competitive medical, dental, and vision coverage.

• Flexible Spending Accounts for healthcare and dependent care expenses.

• Paid time off and paid holidays, including Dec 24-Jan 1.

• Paid parental leave.

• 401k with a highly competitive match.

• Life, AD&D, STD, and LTD insurance coverage.