Associate Director, EU Data Protection Officer (DPO)

Job Description:

Support Global Privacy Officer with governance, program execution, and oversight

• Operationalize GDPR compliance and broader privacy obligations across Europe, in alignment with PTC’s global privacy policies, standards, procedures, and governance model.
• Apply and promote existing program controls, tools, and templates to drive consistent ways of working across functions and countries.
• Provide ongoing, risk-based assessments of privacy obligations and program effectiveness; identify opportunities to enhance controls, processes, and program maturity.
• Maintain strong operating cadence with the Global Privacy & Data Protection Office; escalate material risks, incidents, and non-compliance in a timely manner.

Cross-functional business partnering and advisory

• Serve as a trusted advisor to the business, process owners, and employees by providing clear, practical, business-oriented guidance on GDPR and related requirements, including handling of special category data and data relating to vulnerable populations where relevant.
• Support privacy-by-design and privacy-by-default in business initiatives e.g., clinical development operations, vendor-enabled processing, and adoption of emerging technologies etc.
• Partner with cross-functional stakeholders to ensure privacy requirements are embedded into end-to-end processes proactively. Escalate to the Global Privacy Office as appropriate.
• Help enable compliant outcomes by helping teams interpret requirements and implement workable solutions, balancing regulatory expectations with business needs and understanding business risk.

Risk assessments and privacy assurance

• Lead and/or oversee privacy risk assessments, including Data Protection Impact Assessments (DPIAs), Legitimate Interest Assessments (LIAs), and/or Fundamental Rights Impact Assessment (FRIA) as appropriate and using PTC’s established methodology.
• Collaborate with the Global Privacy Office to identify, assess, monitor, and track privacy risks and mitigation measures in coordination with business and control owners.
• Support privacy controls testing, compliance monitoring, and audit readiness activities, including follow-up on remediation actions.

Data subject rights, inquiries, and external engagement

• Coordinate with Global Privacy Office responses to data subject rights requests and privacy inquiries in line with statutory timelines and established PTC processes and procedures.
• In collaboration with the Global Privacy Office, provide support for engagement with relevant supervisory data protection authorities, including coordinating inputs, tracking actions, and helping ensure quality and timeliness of responses.

Records, documentation, and contractual compliance

• Maintain and continuously improve privacy documentation (policies, procedures, standards, guidance, templates, and required internal records), in coordination with the Global Office.
• Maintain the Record of Processing Activities (RoPA) for relevant European data.
• As needed, review and validate privacy terms in agreements (e.g., DPAs, data sharing agreements, and vendor contracts), ensuring appropriate safeguards, data transfer considerations, and security requirements are addressed.

Incident and breach management

• Strictly follow established internal procedures, advise and support management of data incidents and personal data breaches, including triage, documentation, risk assessment, containment/mitigation support, and notification decision support.

Training, awareness, and culture-building

• In collaboration with the Global Privacy Office, support PTC’s privacy training strategy, including delivering and creating role-based training by jurisdictions for key functions and targeted refreshers.
• Provide hands-on enablement to cross-functional teams by reinforcing good practices and helping stakeholders apply program requirements in daily operations.
• Help build and sustain a network of privacy champions/local points of contact to embed privacy capabilities across European functions.

Regulatory horizon scanning and enforcement updates

• Monitor developments in privacy, cybersecurity, and technology regulation (including EU and national guidance and evolving AI/digital governance expectations).
• In collaboration with Global Privacy Office prepare periodic external enforcement and regulatory update summaries for internal stakeholders, translating developments into practical impacts and recommended actions.
• Perform other tasks and assignments as needed and specified by management.

KNOWLEDGE/SKILLS/ABILITIES REQUIRED

• Law degree (e.g., JD, LLB, or equivalent qualification recognized in the relevant jurisdiction)).
• 6–8 years of relevant professional experience in privacy/data protection roles within complex and/or international organizations (life sciences/ pharma experience strongly preferred).
• CIPP/E or other equivalent DPO EU-specific training/certification.
• Demonstrated expertise in practical GDPR implementation, including DPIAs, vendor/privacy contract review, RoPA governance, and data subject rights management.
• Proven ability to advise and influence stakeholders at multiple levels, while maintaining appropriate independence and sound judgment.
• Strong communication, stakeholder management, and execution skills in multidisciplinary environments.
• Strong track record of managing competing priorities, meeting deadlines, and escalating concerns appropriately.
• Fluent English required and an additional European language is a strong advantage.
• Experience supporting privacy aspects of digital transformation, data governance, and emerging technology (including AI-enabled processing).
• Experience in Pharma industry and knowledge of clinical trial set-up and applicable regulations in EU countries (e.g., CTR, MR-001 methodologies) is a plus

10-20% (domestic and/or international)