Director, Privacy Officer
Lego · Billund, Denmark · hybrid
Job Description
Director Privacy Office
Just imagine shaping privacy standards that protect children and consumers while enabling the LEGO® Group’s direct-to-consumer ambitions. Then make it real.
About the role
As our Director Privacy Office, you will be a senior lawyer with a minimum of 10 years’ post-qualification legal experience and specialist expertise in privacy and data protection, particularly GDPR. This is a senior individual-contributor role: you will set strategic direction in your assigned privacy areas and personally deliver the legal analysis, drafting and day-to-day work needed to turn that direction into practical outcomes.
The Privacy Office is the LEGO Group’s Data Protection Officer (DPO) function and privacy centre of excellence within Legal, Compliance and Risk. You will help strengthen its global privacy programme, shaping privacy policies, standards and processes across direct-to-consumer activities, marketing and advertising technology, kids’ privacy, controller and joint-controller responsibilities, and third-party supplier compliance. You will provide independent legal advice and expert sparring to the Head of Privacy Office, Privacy Office colleagues, the wider Legal, Compliance and Risk team and senior stakeholders on complex or high-risk matters.
Required Qualifications
- Legal qualification and practice: Qualified lawyer with a minimum of 10 years’ post-qualification experience practising law, gained in a law firm, an in-house legal function or another role involving substantive legal practice. Experience must include personally analysing complex legal issues, drafting legal advice and exercising independent legal judgement; privacy programme management alone is not sufficient.
- Privacy and GDPR specialisation: Extensive specialist experience advising on privacy and data-protection law, including at least 5 years applying GDPR in legal practice. Demonstrated depth in core principles, lawful bases, data-subject rights, transparency, accountability, international transfers, data protection impact assessments (DPIAs), controller/processor roles and breach handling, with experience translating these requirements into practical legal advice and action, standards and processes.
- Strategic direction: Experience setting direction as a senior privacy legal specialist within defined areas of responsibility, identifying priorities and emerging risks, forming a clear legal position and developing risk-based policies, standards or guidelines.
- Consumer privacy and enforcement: Experience advising on consumer privacy law and related enforcement matters.
- Hands-on individual contribution: Demonstrated experience personally delivering legal analysis, written advice, policies, guidance and process improvements from initial scoping through completion. Able to prioritise competing demands, manage dependencies, and follow through without relying on a team of direct reports to execute the work.
- Practical communication and judgement: Able to translate complex or new privacy requirements into clear, usable guidance for legal colleagues and the business, and distinguish routine legal advice from strategic privacy direction and matters requiring escalation.
- Collaboration in a flat team: Demonstrated ability to work independently while sharing knowledge, seeking input and contributing to colleagues’ work. Comfortable listening to and constructively challenging colleagues regardless of rank or seniority, welcoming challenge to your own views and influencing through expertise and collaboration rather than hierarchy.
- Analytical judgement and business understanding: Able to analyse detailed legal and factual issues, assess privacy risks and recommend proportionate mitigations that balance legal requirements, individuals’ rights, business needs and practical implementation.
- Self-directed delivery: Able to set your own priorities and deadlines, navigate ambiguity and changing requirements, and manage competing demands with strong organisation, responsiveness and attention to detail.
- Advised commercial or IT agreements, transactions and M&A/integrations involving privacy, controller, joint-controller or supplier responsibilities. Experience should cover providing legal advise on strategic projects, international transfers, DPIAs, data processing agreements (DPAs) and standard contractual clauses (SCCs).
- Advised on privacy requirements outside the EU/EEA, for example in the UK, US, China, South Korea or other APAC jurisdictions.
- Worked with senior stakeholders, external counsel, auditorsand, where relevant, supervisory authorities on complex privacy matters.
Preferred Qualifications
- Developed privacy guidance for the handling of employee data.
- Reviewed IT contracts for privacy and data-protection requirements.
- Kids’ privacy: Experience interpreting and advising on kids’ privacy laws and applying them to practical privacy compliance questions.
- Managed privacy litigation and supported regulatory enforcement cases.
- Developed practical privacy controls, templates or playbooks, or contributed to privacy governance and assurance.
- Hold relevant privacy certifications, such as CIPP/E, CIPP/US or CIPM.
What you'll build
- Set priorities and personally develop, draft and maintain core privacy policies in your assigned areas, particularly for personal data used in marketing, advertising technology and direct-to-consumer activities.
- Set clear legal direction and develop practical standards for kids’ privacy, controller and joint-controller responsibilities, and third-party supplier compliance.
- Translate complex legal requirements into clear, risk-based guidance, templates and playbooks that enable legal colleagues to provide day-to-day privacy advice to the business.
- Personally deliver legal analysis and improvements to processes for data breaches and privacy compliance matters, providing specialist support on complex or high-risk cases.
- Work collaboratively with legal colleagues, digital security, physical security, risk and audit teams to resolve privacy issues, agree practical actions and follow through on delivery.
- Strengthen and further develop our global privacy programme through practical governance, policies, playbooks, privacy-by-design, reporting and assurance. Work with legal colleagues and selected business partners to clarify responsibilities and set proportionate risk thresholds.
- Monitor legal and regulatory developments and recommend and deliver updates to policies, privacy positions, processes and controls.
- Lead or support privacy risk assessments, DPIAs, audits, investigations, breach assessments and enquiries from supervisory authorities within your assigned areas.
- Build privacy awareness and understanding across the global organisation, explaining complex privacy topics in clear business language.
- Coach colleagues and stakeholders and share specialist knowledge while operating independently as a senior individual contributor.
Your experience may come from a privacy legal practice, an in-house legal function, a Data Protection Authority, a Data Protection Officer function or a global company’s Privacy Office. Whatever the setting, you must bring extensive substantive legal-practice experience and deep privacy/GDPR specialisation, together with evidence of personally delivering practical legal work and setting direction. A senior title or people-management experience alone does not meet these requirements.
Life on the team
You’ll join the Privacy Office within Legal, Compliance and Risk. We are a small, closely connected team with a global privacy outlook and a flat, collaborative way of working. Everyone has a voice, regardless of rank or seniority. We value curiosity and colleagues who listen, share expertise, ask for help, welcome constructive challenge and contribute to the work that needs doing. You should be comfortable combin