Senior Director, Data Privacy

Job not on LinkedIn

🕒 5 days ago

🔔 Pennsylvania – Remote

🔔 Pennsylvania – Remote

💵 $250k - $290k / year

⏰ Full Time

🟠 Senior

🧑‍💼 Attorney / Lawyer

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

SAVARA

WebsiteLinkedInAll Job Openings

11 - 50 employees

Founded 2018

🧬 Biotechnology

💊 Pharmaceuticals

Biotechnology • Pharmaceuticals

Savara is a clinical-stage biopharmaceutical company focused on developing treatments for rare respiratory diseases, principally autoimmune pulmonary alveolar proteinosis (aPAP). Their lead product candidate, MOLBREEVI (molgramostim inhalation solution), is an inhaled recombinant GM-CSF currently in Phase 3 development for aPAP; the company maintains clinical programs, medical affairs, patient resources, and investor relations activities related to advancing this therapy. Savara conducts clinical trials, engages with investigators and patient advocacy organizations, and provides information on diagnostics, expanded access, and regulatory status.

📋 Description

• Own and mature Savara's global privacy program, serving as the primary in-house legal advisor on GDPR, UK GDPR, and applicable U.S. federal and state privacy laws, and as the escalation point for privacy questions raised by any function • Oversee and conduct enterprise-wide Data Protection Impact Assessments (DPIAs), partner with the external Data Protection Officer to build and maintain Records of Processing Activities (ROPAs) across all functional areas, and support audits and regulatory requests • Draft, implement, and periodically refresh Savara's core privacy policies and procedures, ensuring internal consistency (e.g., aligned breach-notification timelines) and alignment with current law • Own the end-to-end data subject/consumer rights program (access, rectification, erasure, restriction, portability, opt-out, and 'limit the use of sensitive personal information' requests), including intake channels, identity verification, statutory deadline tracking, and coordination with processors and vendors • Build and maintain a vendor privacy compliance program: a central vendor register, a risk-based due diligence and questionnaire process, and a Data Processing Agreement (and, where applicable, Business Associate Agreement) portfolio with all critical and non-critical processors, prioritizing vendors that process special-category or patient data • Review and negotiate privacy and data protection terms in contracts, including data processing agreements (DPAs), clinical trial agreements, master services agreements, vendor agreements, standard contractual clauses (SCCs), and related provisions, and ensure consistent and appropriate privacy language across all contractual forms and third-party engagements • Evaluate and document controller, joint-controller, and processor relationships across Savara's business (HR employer-of-record arrangements, clinical trial sites and CROs, patient advocacy and expanded access partners, and commercial media/analytics partners) and put in place Article 26-compliant joint-controller arrangements where needed • Map Savara's cross-border data transfer flows and implement appropriate transfer mechanisms (Standard Contractual Clauses, UK IDTA/Addendum, or successor mechanisms), including Transfer Impact Assessments and supplementary measures where required, and lead remediation of any legacy or outdated transfer documentation • Serve as the business owner for Savara's incident and breach response program, ensuring a single, internally consistent breach-notification procedure that meets GDPR/UK GDPR, HIPAA, FTC, and applicable state-law timelines, and personally leading or co-leading breach investigations and regulator/notification decisions • Advise Clinical Operations and Pharmacovigilance on privacy aspects of sponsored trials, expanded access/named-patient programs, and safety data flows, including legal basis, informed consent form privacy language, investigator and site-staff transparency notices, and vendor/CRO data flows • Advise Commercial, Marketing, and Patient Services on privacy-by-design for HCP and patient-facing digital properties, hub and patient-support programs, CRM/analytics platforms, and any real-world-data or de-identification initiatives, including cookie consent, ad-tech governance, and state consumer health data laws • Own Savara's readiness for HCP transfers-of-value reporting (Sunshine Act/Open Payments) from a privacy perspective, working with Finance, Compliance, and Commercial to ensure appropriate notices and data-handling practices are in place ahead of go-live • Design and roll out a role-based data protection training and awareness program for all employees and contractors aligned with compliance initiatives, with tailored modules as needed, and track completion • Coordinate with IT/the Managed Service Provider on privacy-relevant security controls (access management, encryption, data classification, and vendor contracts) to ensure technical and organizational measures are documented and defensible • Track and advise on emerging and evolving privacy obligations relevant to Savara's operations, including new U.S. state privacy laws, evolving FTC and state enforcement priorities, and cross-border transfer developments, and periodically refresh Savara's data protection gap analysis and the associated remediation roadmap • Prepare periodic privacy program metrics and status updates (open data subject requests, breach notifications, vendor compliance status, training completion, DPIA/ROPA coverage) for the Chief Legal Officer and, as appropriate, the Audit Committee of the Board of Directors • Promote a culture of privacy, ethics, and accountability across all geographies • Manage contractors, vendors, and/or outside counsel engaged to support the privacy program • Other duties and projects as assigned.

🎯 Requirements

• Juris Doctor (JD) from an accredited law school • Admission to a state bar and active license to practice law • Minimum of 8 years of relevant legal experience, with substantial hands-on experience building or operating a privacy program, preferably in-house at a life sciences, pharmaceutical, or biotechnology company, or in a law firm or consultancy advising such companies • Deep working knowledge of GDPR and UK GDPR, including practical experience with Records of Processing Activities, DPIAs, cross-border transfer mechanisms, and data subject rights programs • Strong working knowledge of the U.S. privacy landscape applicable to biopharmaceutical companies, including HIPAA, the FTC Act and Health Breach Notification Rule, and state comprehensive and consumer-health privacy laws (e.g., CCPA/CPRA, Washington MHMDA, Connecticut CTDPA, Nevada SB 370) • Familiarity with clinical trial and pharmacovigilance data flows and applicable regulatory frameworks (ICH-GCP, EU Clinical Trials Regulation, FDA regulations), and with life sciences transparency reporting (Sunshine Act/Open Payments) • Privacy certification(s) such as CIPP/E and/or CIPP/US strongly preferred • Demonstrated ability to translate legal requirements into practical, risk-based operational programs and to drive cross-functional remediation work to completion, rather than only identifying gaps • Excellent verbal and written communication skills, with the ability to communicate clearly and persuasively with both technical and non-technical stakeholders and with professionals outside the organization • Strong project-management skills, with the ability to build and drive a multi-year remediation roadmap and to prioritize across competing demands • Proactive, self-directed, and comfortable operating with a high degree of ownership and minimal supervision in a lean, fast-moving organization • Excellent professional judgment, high level of integrity and trustworthiness, and the ability to build collaborative working relationships across all levels of the organization • Adaptable and able to pivot to meet changing business needs as Savara transitions from clinical-stage to commercial-stage operations.

🏖️ Benefits

• Highly competitive medical, dental, and vision coverage • Flexible Spending Accounts for health care and dependent care expenses • Paid time off and paid holidays, including Dec 24-Jan 1 • Paid parental leave • 401k with highly competitive match • Life, AD&D, STD and LTD insurance coverage