Director, Legal Counsel, Data & Privacy

Loblaw; Brampton; On-site; CAD 170,000 - 220,000; Full time

Job summary

Loblaw Companies Limited in Brampton is seeking a Director, Legal Counsel, Data & Privacy to lead our privacy and data governance program. You will shape policy, manage compliance, and partner with business teams to embed privacy by design across products and services.

You'll provide strategic legal advice on privacy, data governance, CASL, and regulatory matters, while guiding breach response, risk assessments, and vendor arrangements. This role reports to the Enterprise Privacy Officer.

Qualifications

• 7–10 years of in-house or compliance experience focusing on privacy and regulatory matters.
• Experience advising on CASL and related regulatory requirements.
• Ability to interpret privacy laws and provide practical, business-oriented guidance.
• Experience drafting and negotiating complex privacy and cybersecurity provisions.

Responsibilities

• Provide strategic privacy, data governance, and CASL legal advice across the enterprise.
• Oversee DPIAs and assess data/privacy risk with actionable controls.
• Lead privacy, data and cybersecurity negotiations in commercial agreements.
• Manage privacy breach and regulator engagement activities.
• Build and develop a high-performing data and privacy team.

Skills

Privacy law

Data governance

CASL compliance

Contract drafting

Regulatory risk management

Leadership

Privacy DPIAs

AI governance

Stakeholder engagement

In-house counsel

Education

Law degree

Ontario Bar admission

Job description

Come make your difference in communities across Canada, where authenticity, trust and making connections is valued – as we shape the future of Canadian retail, together. Our unique position as one of the country’s largest employers, coupled with our commitment to positively impact the lives of all Canadians, provides our colleagues a range of opportunities and experiences to help Canadians Live Life Well®.

At Loblaw Companies Limited, we succeed through collaboration and commitment and set a high bar for ourselves and those around us. Whether you are just starting your career, re-entering the workforce, or looking for a new job, this is where you belong.

Director, Legal Counsel, Data & Privac y | Brampton

The Data Trust Office is an enablement-first function. We embed privacy and data governance into products and services to build customer trust and loyalty, ensuring compliance by design.

As Director, you will play a pivotal role in shaping and driving Loblaw’s enterprise privacy and data governance program. You will be accountable for executing the Data Trust strategy, overseeing risk management and compliance activities, developing policy, managing breaches, and fostering stakeholder engagement across the business.

As Legal Counsel, you will serve as a key partner to the commercial legal team, providing privacy, data and cybersecurity subject matter expertise on complex commercial arrangements and supporting the development, review and negotiation of appropriate contractual protections.

In both functions you will provide strategic, practical and business-oriented legal advice on privacy, data governance, CASL and related regulatory matters to the business, helping them navigate complex legal requirements while enabling the responsible use of data and innovation.

This role reports to the Enterprise Privacy Officer.

WHAT YOU’LL DO:

• Champion privacy as a business enabler by driving stakeholder engagement and embedding privacy and data governance into products and services.
• Provide strategic legal advice on privacy, data governance, CASL and related regulatory matters across the business, including in connection with new products, services, technologies, digital initiatives, data uses, artificial intelligence, marketing and other strategic projects and transactions.
• Advise on the interpretation and application of privacy laws, CASL, related regulatory requirements and regulator guidance, translating legal requirements into practical, business-oriented advice.
• Conduct Data and Privacy Impact Assessments (DPIAs), identify and evaluate legal, regulatory, data and privacy risks, and provide practical, risk-based recommendations on appropriate controls and mitigation strategies.
• Partner with commercial legal counsel as the privacy, data and cybersecurity subject matter expert on commercial agreements involving personal information, data sharing, technology, vendors, artificial intelligence or access to Loblaw systems and data. Provide practical legal advice and support the negotiation and resolution of complex or escalated privacy, data and cybersecurity issues.
• Provide legal advice on consent and transparency requirements, data governance and lifecycle matters, and the responsible use of data, including in connection with artificial intelligence and emerging technologies.
• Oversee privacy breach, complaint and investigation management activities, including intake, escalation, investigation and response, and provide legal advice on notification obligations, regulatory risk, remediation and response strategy.
• Advise on privacy and CASL regulatory matters and engage with regulators, as appropriate, in connection with regulatory inquiries, investigations, complaints and other regulatory matters, including engagement and management of external legal counsel as appropriate.
• Recruit, lead, and develop a high-performing data and privacy team, including coaching and developing privacy professionals and fostering strong legal and risk judgment across the team.
• Stay ahead of evolving national privacy and health privacy laws, global regulatory developments, privacy-enhancing technologies, and emerging innovations (e.g., AI/LLMs), CASL and related regulatory developments, and advise on their legal, regulatory and business implications.
• Partner cross-functionally across the enterprise to continuously improve privacy-related policies, templates, guidance, processes and controls and create efficiencies while maintaining appropriate legal, cybersecurity and regulatory safeguards.

WHAT YOU BRING:

• Law degree and member in good standing with the Law Society of Ontario, with 7-10 years of relevant experience in an in-house legal department and/or compliance function, including significant experience advising on privacy and related regulatory matters. Experience at a leading law firm is also considered an asset.
• Practical, solutions-oriented and agile, with strong legal and business judgment and a demonstrated ability to navigate complexity and ambiguity, move beyond identifying risk, and develop creative, pragmatic solutions that enable business objectives while appropriately managing legal, privacy and data risk.
• A supportive and engaged people leader who invests in the development of their team and creates an inclusive, high-performing environment where people are empowered, supported and accountable.
• Thrives in a fast-paced, dynamic environment, with the agility to manage competing priorities, make sound decisions and drive matters forward.
• Strong collaborator and trusted advisor who builds effective relationships, influences stakeholders and facilitates practical solutions across the enterprise.
• Excellent communication, organizational and presentation skills, with the ability to distill complex legal, technical and privacy issues into clear, concise and actionable advice for stakeholders at all levels of the organization.
• Demonstrated leadership experience delivering privacy and data programs and advising on complex privacy, data and regulatory matters within large, matrixed organizations.
• Significant experience interpreting and applying Canadian federal and provincial privacy laws, CASL and related regulatory requirements to complex business and technology initiatives, including digital products and services, analytics, artificial intelligence, marketing and other data-driven activities.
• Demonstrated experience conducting Data and Privacy Impact Assessments (DPIAs), evaluating risk and developing practical controls and mitigation strategies.
• Proven experience managing regulatory risk and engaging directly with privacy regulators, including in connection with inquiries, investigations, complaints or other regulatory matters.
• Experience drafting, reviewing and negotiating privacy and cybersecurity provisions in complex commercial agreements, including data processing, data sharing, technology and vendor arrangements.
• Experience advising on privacy incidents and breach response, including assessing legal and regulatory obligations and supporting cross-functional response and remediation efforts.
• Experience in corporate retail, direct-to-consumer or other complex, highly regulated environments is an asset.
• CIPP-C or equivalent privacy certification preferred; AIGP and DCAM certifications are considered an asset.

Our commitment to Sustainability and Social Impact is an essential part of the way we do business, and we focus our attention on areas where we can have the greatest impact. Our approach to sustainability and social impact is based on three pillars – Environment, Sourcing and Community – and we are constantly looking for ways to demonstrate leadership in these important areas. Our CORE Values – Care, Ownership, Respect and Excellence – guide all our decision-making and come to life through our Blue Culture. We offer our colleagues progressive careers, comprehensive training, flexibility, and other competitive benefits – these are some of the many reasons why we are one of Canada’s Top Employers, Canada’s Best Diversity Employers, Canada’s Greenest Employers & Canada’s Top Employers for Young People.

If you are unsure whether your experience matches every requirement above, we encourage you to apply anyway. We are looking for varied perspectives which include diverse experiences that we can add to our team.

We have a long-standing focus on diversity, equity and inclusion because we know it will make our company a better place to work and shop. We are committed to creating accessible environments for our colleagues, candidates and customers. Requests for accommodation due to a disability (which may be visible or invisible, temporary or permanent) can be made at any stage of application and employment. We encourage candidates to make their accommodation needs known so that we can provide equitable opportunities.
Please Note :
Candidates who are 18 years or older are required to complete a criminal background check. Details will be provided through the application process.

Hiring Range / Échelle salariale à l’embauche :

$170,000.00 - $220,000.00 / 170.000,00$ - 220.000,00$ (per year / par an)

A candidate’s experience and knowledge as well as the geographical region in which the position is located may be factored into the pay a candidate receives for this position. This posting is for an existing vacancy. The Company uses artificial intelligence for the purpose of screening, assessing and/or selecting applicants for this position. / L’expérience et les connaissances d’un candidat ainsi que la région géographique dans laquelle le poste est situé peuvent être prises en compte dans la rémunération qu’un candidat reçoit pour ce poste. Cette offre d’emploi concerne un poste vacant existant. L’entreprise utilise l’intelligence artificielle dans le but de filtrer, d’évaluer et/ou de sélectionner les candidats à ce poste.

#EN

#SS #LEGAL #ON