Description:
The Data Privacy Architect is the authoritative voice on legal, regulatory, and architectural requirements for data privacy across the platform. This role owns the design of technical controls that satisfy global privacy and AI regulations and governs the platform against those standards. It bridges legal and regulatory frameworks with system architecture, embedding privacy controls into the full data lifecycle: collection, processing, storage, sharing, and deletion.
Key Responsibilities:
- Own the design and enforcement of privacy-by-design architecture patterns across the platform, with authority to require remediation of non-compliant designs through architecture governance.
- Lead Data Protection Impact Assessments (DPIAs) and data flow mapping exercises, translating regulatory obligations into concrete architectural requirements and controls.
- Serve as the team's authoritative interpreter of data privacy and AI regulations, including GDPR, CCPA, FedRAMP, and the EU AI Act, ensuring technical decisions are evaluated against their legal and regulatory implications.
- Define and govern data classification, retention, anonymization, and deletion practices, and review services for compliance with those standards.
- Lead privacy and regulatory architecture for AI across the platform, covering privacy obligations for internally developed models, third-party models used in the product, and compliance with emerging AI regulatory frameworks including the EU AI Act.
- Collaborate with Security, Compliance, Legal, Risk, and Engineering teams to implement and verify data access governance, maintaining architecture diagrams and documentation for audits and attestations.
- Drive data lineage and observability capabilities that support privacy impact assessments and regulatory accountability.
Minimum Requirements:
- Strong experience in data, privacy, security, or platform architecture, with demonstrated ability to translate privacy and regulatory requirements into scalable technical architecture and controls.
- Strong knowledge of data privacy principles and regulations, particularly GDPR, with experience applying privacy-by-design principles within complex technology environments.
- Experience leading or contributing to Data Protection Impact Assessments (DPIAs) and data flow mapping exercises, including identifying privacy risks and defining appropriate technical controls.
- Strong understanding of data lifecycle management, including data classification, retention, anonymization or tokenization, deletion, and secure data flows.
- Experience with cloud platforms, data stores, and Identity and Access Management (IAM) concepts, with an understanding of their privacy and security implications.
- Demonstrated experience partnering with Engineering, Security, Legal, Compliance, and Risk teams to translate privacy policy and regulatory obligations into practical technical solutions.
- Ability to provide technical leadership and challenge architecture or engineering designs where privacy, data protection, or regulatory requirements are not adequately addressed.