[Hiring] Senior Director, Data Privacy @ARAVAS INC

Role Description

The Senior Director, Data Privacy is a newly created, attorney-held role responsible for building and personally owning Savara's global data privacy program across GDPR, UK GDPR, and the U.S. federal and state privacy landscape (including CCPA/CPRA, HIPAA, and comparable state consumer health and comprehensive privacy laws). Reporting to the Chief Legal Officer, this individual will serve as Savara's substantive privacy counsel and program owner, working hand-in-hand with various departments to design, implement, and maintain the governance, documentation, and controls needed to meet Savara's obligations as it scales from a clinical-stage to a commercial-stage biopharmaceutical company.

This role will be accountable for building forward-looking privacy infrastructure to support the U.S. commercial launch of molgramostim, including:

• HCP and patient-facing digital properties
• Hub and patient-support services
• Healthcare-professional transparency reporting

The Senior Director, Data Privacy will be the central point of accountability so that privacy risk is identified and addressed proactively.

Responsibilities

• Own and mature Savara's global privacy program, serving as the primary in-house legal advisor on GDPR, UK GDPR, and applicable U.S. federal and state privacy laws.
• Oversee and conduct enterprise-wide Data Protection Impact Assessments (DPIAs).
• Partner with the external Data Protection Officer to build and maintain Records of Processing Activities (ROPAs) across all functional areas.
• Support audits and regulatory requests.
• Draft, implement, and periodically refresh Savara's core privacy policies and procedures.
• Own the end-to-end data subject/consumer rights program, including intake channels and identity verification.
• Build and maintain a vendor privacy compliance program.
• Review and negotiate privacy and data protection terms in contracts.
• Evaluate and document controller, joint-controller, and processor relationships.
• Map Savara's cross-border data transfer flows and implement appropriate transfer mechanisms.
• Serve as the business owner for Savara's incident and breach response program.
• Advise Clinical Operations and Pharmacovigilance on privacy aspects of sponsored trials.
• Advise Commercial, Marketing, and Patient Services on privacy-by-design for digital properties.
• Own Savara's readiness for HCP transfers-of-value reporting from a privacy perspective.
• Design and roll out a role-based data protection training and awareness program.
• Coordinate with IT/the Managed Service Provider on privacy-relevant security controls.
• Track and advise on emerging and evolving privacy obligations.
• Prepare periodic privacy program metrics and status updates for the Chief Legal Officer.
• Promote a culture of privacy, ethics, and accountability across all geographies.
• Manage contractors, vendors, and/or outside counsel engaged to support the privacy program.
• Other duties and projects as assigned.

Qualifications

• Juris Doctor (JD) from an accredited law school.
• Admission to a state bar and active license to practice law.
• Minimum of 8 years of relevant legal experience.
• Deep working knowledge of GDPR and UK GDPR.
• Strong working knowledge of the U.S. privacy landscape applicable to biopharmaceutical companies.
• Familiarity with clinical trial and pharmacovigilance data flows.
• Privacy certification(s) such as CIPP/E and/or CIPP/US strongly preferred.
• Demonstrated ability to translate legal requirements into practical, risk-based operational programs.
• Excellent verbal and written communication skills.
• Strong project-management skills.
• Proactive, self-directed, and comfortable operating with minimal supervision.
• Excellent professional judgment and high level of integrity.
• Adaptable and able to pivot to meet changing business needs.

Location and Travel

• This role is remote within the US and requires availability to work US Eastern Time Zone.
• Periodic overnight travel within the U.S. is required.
• Occasional international travel may be required to support engagement with Savara ApS (Denmark) and EU/UK stakeholders.