Legal Consultant

Support of the existing DPO function in the operational handling of privacy and data protection files within CM-MC.

There is already a DPO within CM-MC who does the operational follow-up of our privacy files, meetings, DPIAs, etc., but the consultant is expected to provide support in the execution and follow-up of the DPO tasks.

The assignment is also carried out in close collaboration with the relevant business, legal, security and IT stakeholders.

Profile

• Legal background (Master of Laws, or functional equivalent).
• 5 years of relevant experience, with the tasks and responsibilities listed below.
• 5 years of experience within a large or medium-sized company, with a preference for experience within the health sector or public sector.
• Have the necessary IAPP certificates, or equivalent certificates.
• Demonstrable experience working with multiple stakeholders and making connections with the various files and projects.
• Good team spirit and the ability to identify with the values as well as the social commitment of CM/MC.

Objective

Operationally strengthen the DPO so that privacy questions and files can be dealt with in a timely, qualitative and independent manner, with correct escalation to the DPO where necessary:

• Prepare Data Privacy (DP) advice and answer privacy questions, if necessary, after feedback with the DPO.
• Supervise, assess and document DPIAs.
• Handle and follow up on data subject requests.
• Analyse, document and – if necessary – report data breaches to the DPA, as well as provide the required follow-up.
• Collaborate within the DPO Office and support data privacy leads (these are the experts in the field who support the DPO office from the regions) in the business.

Responsibilities

• Substantiated and documented DP advice and privacy assessments.
• Complete DPIA files with risks, measures and clear follow-up points.
• Correctly and timely handled data requests, with demonstrable follow-up.
• Documented assessment and follow-up of data breaches, including notification support if required.
• Up-to-date file follow-up and clear reporting to the DPO on status, risks and outstanding actions.
• Practical support and knowledge sharing with stakeholders involved in data protection.

Acceptance Criteria

The candidate proposes a consultant with demonstrable experience in the field of data protection and privacy compliance.

The consultant has relevant practical experience (as described above) in providing privacy and GDPR advice to (large) organisations and has independently handled files on, among other things, DPIAs, requests from data subjects, data breaches, processing agreements and the assessment of processing from a GDPR perspective.

The consultant has experience in supporting a DPO function or taking on a similar advisory role within a complex organizational environment. He or she is familiar with the application of the GDPR in practice, can assess risks, translate legal analyses into workable recommendations and guide stakeholders on privacy issues.

The relevant experience is demonstrated on the basis of the curriculum vitae and an overview of similar assignments carried out during the past five years.