Data Protection & Privacy Counsel for Poland & Central Europe

Location: Warsaw

Hybrid model of work

Typical and Specific Accountabilities

Role purpose. Provide practical, business-oriented legal advice on privacy, data protection and related data-governance matters across Poland, the Czech Republic, Slovakia and Hungary. The role enables the responsible use of personal data across business operations, clinical research, patient-related activities, HR, digital solutions, analytics, AI and other new technologies, translating global standards and evolving EU requirements into proportionate and workable safeguards.

• Act as the primary privacy legal adviser for Poland and provide coordinated privacy support across the Czech Republic, Slovakia and Hungary, working closely with local Legal and Compliance teams, privacy representatives and the Global Privacy Office.
• Provide clear, risk-based advice on the collection, use, sharing, retention, transfer and deletion of personal data, including local implementation of global privacy standards and monitoring of relevant legal and regulatory developments.
• Lead and advise on Privacy Impact Assessments and Data Protection Impact Assessments for new or materially changed processes, systems, studies, technologies and third-party engagements, identifying proportionate safeguards and documenting material risks and decisions.
• Advise on AI, Generative AI, Digital Health, analytics and other emerging technologies, including GDPR, EU AI Act, privacy-by-design, transparency and internal technology-governance considerations.
• Provide privacy support for clinical studies, observational research, real-world evidence, patient-support activities and other medical or research initiatives involving health, genetic or other sensitive personal data.
• Review and negotiate privacy provisions in commercial, technology, vendor, clinical-study and data-sharing agreements, including DPAs, controller/processor allocations, Standard Contractual Clauses and Transfer Impact Assessments.
• Support privacy due diligence and risk assessment of vendors and technology providers, partnering with Procurement, IT, Cyber Security, Digital and business owners throughout selection, contracting and implementation.
• Coordinate local and regional privacy support for suspected personal-data incidents and investigations, including assessment, containment, remediation, contractual obligations and potential regulatory or data-subject notifications.
• Coordinate and advise on complex data-subject rights requests in cooperation with global and local stakeholders, ensuring appropriate consideration of confidentiality, third-party rights, privilege and applicable limitations.
• Develop and maintain local and regional privacy procedures, notices, guidance and audit-ready compliance documentation, and deliver targeted privacy training and awareness activities.
• Coordinate consistent regional positions, manage external privacy counsel where required, and support engagement with supervisory authorities and regulatory enquiries in cooperation with Legal and the Global Privacy Office.
• Build effective relationships across Legal, Compliance, HR, Procurement, IT, Digital, Medical, Clinical Operations and other relevant business functions, translating complex requirements into practical actions.

Geographic Remit

Operates in four countries: Poland, Czech Republic, Slovakia and Hungary.

Requirements:

Essential:

• Degree in law or equivalent legal qualification.
• At least five years of relevant legal, privacy or data-protection experience, including substantial hands-on GDPR advisory experience in an organisation, law firm or regulated environment.
• Strong practical knowledge of GDPR, including lawful basis, transparency, special-category data, privacy by design, data-subject rights, incidents, accountability and international transfers.
• Demonstrable experience with PIA/DPIA, privacy contracts and DPAs, vendors, cross-border transfers, incidents and data-subject-rights processes.
• Working knowledge of privacy and data-governance issues arising from AI, Generative AI, cloud services, analytics and other digital technologies.
• Ability to independently manage complex matters, competing priorities and stakeholders across multiple jurisdictions and translate requirements into practical, proportionate advice.
• Strong legal drafting, negotiation, analytical and communication skills, with experience in an international matrix environment.
• Fluent written and spoken English and Polish.

Desirable:

• Experience in pharmaceuticals, biotechnology, healthcare, medical technology, clinical research or another highly regulated and data-intensive industry.
• Experience with clinical-study data, patient or health data, real-world evidence, informed-consent documentation or patient-support programmes.
• Practical familiarity with the EU AI Act, AI governance, Digital Health or related emerging-technology frameworks.
• Experience supporting a DPO/DDPO function, interacting with supervisory authorities or coordinating privacy activities across multiple jurisdictions.
• Recognised privacy or AI-governance qualification, such as CIPP/E, CIPM or AIGP.

Date Posted

Closing Date

AstraZeneca embraces diversity and equality of opportunity.  We are committed to building an inclusive and diverse team representing all backgrounds, with as wide a range of perspectives as possible, and harnessing industry-leading skills.  We believe that the more inclusive we are, the better our work will be.  We welcome and consider applications to join our team from all qualified candidates, regardless of their characteristics.  We comply with all applicable laws and regulations on non-discrimination in employment (and recruitment), as well as work authorization and employment eligibility verification requirements.