Commercial Attorney – Data Privacy Compliance

About the role

Morae Global is seeking a senior‑level Commercial Attorney with a strong focus on data privacy compliance. The role involves guiding global clients through privacy frameworks, conducting risk assessments, and leading the negotiation of data processing agreements.

Key responsibilities

• Conduct end‑to‑end Privacy Impact Assessments (PIA/DPIA), identifying processing activities, data flows and risk areas.
• Assess legal bases, proportionality and necessity of processing, and recommend mitigation measures.
• Collaborate with business, IT, security and product teams to gather inputs and validate processing activities.
• Maintain full assessment lifecycle documentation in OneTrust, from initiation to closure.
• Review, draft and negotiate Data Processing Agreements and data‑protection clauses in vendor and customer contracts.
• Identify key risk areas such as sub‑processing, data‑security, breach notification, audit rights, data retention, deletion and cross‑border transfers.
• Apply internal playbooks and templates to ensure consistency, and support redlining and negotiation cycles with stakeholders.

Required profile

• Bachelor’s or Master’s degree in Law, Information Security, Data Privacy or a related field.
• IAPP CIPP or CIPM certification is an advantage.
• Minimum three years post‑qualification experience in transaction documentation with proven exposure to risk and data‑privacy compliance.
• Ability to lead privacy risk assessments for clients across geographies and product types.
• Familiarity with global privacy regulations such as CCPA/CPRA, GDPR and UK‑GDPR.

Required skills

• Proficiency with OneTrust for privacy assessment management.
• Drafting and negotiating Data Processing Agreements.
• Strong knowledge of privacy regulations and risk‑assessment methodologies.