Privacy Counsel and Data Protection Officer

Mecka AI; Toronto; On-site; CAD 150,000 - 230,000; Full time

Job summary

Mecka AI is seeking a Privacy Counsel and Data Protection Officer to lead the privacy programme across all markets and capture models. You will maintain consent standards, manage cross-border transfers, and collaborate with engineering to embed privacy by design into products and workflows.

You will independently advise on data protection obligations, monitor compliance, and serve as the main contact for data subjects and regulators globally.

Qualifications

• Qualified lawyer with admission to practice in at least one jurisdiction.
• 5 to 8+ years of privacy and data protection experience, ideally in tech or AI companies.
• Proven ability to advise on multi-jurisdictional data protection regimes and regulator engagement.
• Experience drafting and maintaining consent, cross-border transfer, and data subject processes.

Responsibilities

• Lead privacy programme across markets and capture models, including processing records and retention policies.
• Advise on data protection requirements, monitor compliance, and act as point of contact for subjects and regulators.
• Own consent/transparency framework for contributors and partners; update notices and vendor agreements.
• Oversee cross-border data transfers, regulator registrations, and local filings for operating entities.
• Partner with engineering on privacy by design—redaction, encryption, access controls, and data minimization.
• Lead incident response, DSARs, complaints, regulator inquiries, and manage outside counsel.

Skills

Privacy program management

DPO independence

Regulatory engagement

Cross-border data transfers

Education

Law degree and admission to practice

Job description

About Mecka AI

Mecka AI is building the data infrastructure layer for robotics and embodied AI.
We design and operate global systems for data capture, data labeling, and hardware-enabled workflows used by leading AI labs and robotics companies to train and validate humanoid and embodied AI systems.
We work closely with frontier robotics teams to bridge real-world data, simulation, learning-based systems, and deployed hardware.

About the Role

We collect egocentric video data for AI training through our own capture teams, through commercial partners, and through individual contributors using our mobile app. In each of these models, the questions that decide whether a market can operate are privacy questions: whether valid consent has been obtained, how footage leaves the country where it was recorded, and which registrations, filings, and regulatory appointments each operating entity needs.

As Privacy Counsel and Data Protection Officer, you will own the privacy programme across every market and capture model we run. You will maintain and update the consent standard our teams and partners follow, maintain and build upon the cross-border transfer and registration framework for each operating entity, and work with engineering and operations so that controls such as redaction, retention, deletion, and access limits continue to be considered in product design. You will be the first call for operations teams on privacy questions and will manage outside privacy counsel in each jurisdiction.

In your capacity as Data Protection Officer, you will independently advise the company on its data protection obligations, monitor compliance, and act as the lead point of contact for data subjects and supervisory authorities globally. You will have direct access to senior management, appropriate resources to perform the DPO function, and independence in carrying out your statutory responsibilities.

What You Will Do

• Privacy programme: Maintain and build upon the privacy and data protection programme across all markets and capture models, including records of processing, impact assessments, retention schedules, and policies that operating teams can apply without a legal review of every question. Develop and deliver privacy training for relevant employees, contractors, partners, and other stakeholders.

• Data Protection Officer: Independently advise the company and its personnel on applicable data protection requirements; monitor compliance with applicable laws and internal policies; advise on data protection impact assessments; and report material privacy risk. Serve as the point of contact for data subjects and supervisory authorities and cooperate with regulators where required.

• Consent: Own the consent and transparency framework for contributors, venue owners, and bystanders, maintain the approved consent forms, privacy notices, disclosures, and related records used in every capture model, and continue to update those standards into partner and vendor agreements.

• Cross-border data: Continue to implement and monitor the transfer mechanisms that let footage move from the country of capture to our storage and processing, and manage regulator registrations, local data protection representative appointments, and local filings for each operating entity.

• Privacy by design: Partner with engineering, product, security, and quality teams on redaction, encryption, access controls, data minimization, and deletion, and review new capture models, datasets, and customer deliveries before they go live.

• Incidents and counsel: Advise operations teams on the privacy conditions a market must meet before it opens, lead the response to data incidents, data subject requests, complaints, and regulator inquiries, including assessing notification and remediation obligations, and manage outside privacy counsel against clear scopes and budgets.

What You Bring

• Qualification: Law degree and admission to practice in at least one jurisdiction.

• Experience: 5 to 8+ years of privacy and data protection practice, with time both at a top tier law firm and in-house at a high-growth technology, marketplace, AI, or data company.

• DPO capabilities: Demonstrated ability to perform the DPO function independently and objectively; communicate directly with senior management and regulators .Multi-jurisdiction: Hands-on experience advising on data protection regimes in several

• countries at once, including consent, cross-border transfers, data protection impact assessments, data breach response, and regulator registration, and managing outside counsel across those countries.

• Technical and operational judgment: Ability to translate complex privacy requirements into practical controls for engineering, operations, and delivery teams.

Even better if you have

• Data type: Experience with video, image, biometric, or location data, or with datasets collected or processed for machine learning training.

• Certification: A privacy certification such as CIPP/E, CIPP/A, or CIPM.

• Industry: In-house experience at a marketplace, delivery, AI, data, or gig platform operating across emerging markets.

• SOC 2 compliance or audit-readiness initiatives is an asset.

• Regulatory engagement: Experience communicating with data protection authorities, responding to regulatory inquiries, and managing multi-jurisdictional personal data incidents.

If you don't check every box above but believe you can do the job, we encourage you to apply — we're looking for capability and trajectory, not a perfect checklist match.

We strive to create an inclusive work environment for all; we welcome applicants from all backgrounds and are committed to providing equal opportunities. Should you require any accommodations during the recruitment process, we will partner with you to meet your needs.

We may use AI-assisted tools to help evaluate applications against the requirements of this role. These tools support our recruiting team in identifying qualified candidates but do not replace human judgment or limit which applications may be reviewed or considered.