Legal Associate

Outbreach Ltd.; Greater London; On-site; GBP 65,000 - 90,000; Full time

Job summary

Outbreach Ltd. is seeking two Legal Associates to deliver breach counsel to clients during and after cyber incidents. You would work directly on live matters from day one, supporting organisations through notification decisions, regulatory exposure and the evidential requirements that follow a breach.

This is hands-on legal work inside an incident response business rather than a law firm. The role requires working to tight deadlines, strong drafting precision and the ability to interpret

Qualifications

• Experience with UK GDPR and data breach notification in practice.
• Ability to draft clear notifications for regulators and data subjects.
• Ability to work to tight deadlines in incident response.
• Comfort interpreting forensic findings and challenging conclusions.
• Client-facing confidence in high-stress situations.
• Eligibility to work in the UK.

Responsibilities

• Provide Notification Advice on breach obligations, timelines and risk.
• Draft notifications for regulators, data subjects and affected parties.
• Assess regulatory exposure under UK GDPR and international regimes in scope.
• Advise on evidence preservation and legal requirements for investigations.
• Contribute legal sections of incident reports and review for exposure.
• Support litigation and disclosure work with solicitors and counsel.
• Conduct post-incident legal reviews and turn findings into actionable steps.
• Review inbound contracts, DPAs and subcontractor terms under supervision.
• Maintain and update notification templates, regulatory trackers and knowledge base.

Skills

Data protection

Drafting

Deadline management

Technical literacy

Client-facing

Right to work in the UK

Education

Qualified lawyer in England & Wales

Job description

Outbreach is seeking two Legal Associates to deliver breach counsel to clients during and after cyber incidents.

Outbreach is looking for two Legal Associates to deliver breach counsel to clients during and after cyber incidents. You would work directly on live matters from the first day, supporting organisations through notification decisions, regulatory exposure and the evidential requirements that follow a breach. This is hands on legal work inside an incident response business rather than a law firm. The pace is different, the client is usually mid crisis, and the advice has to be usable immediately.

Key Responsibilities:

• Notification Advice: Advise clients on breach notification obligations, timelines and the risk attached to each option.
• Drafting: Prepare notification drafts for regulators, data subjects and other affected parties.
• Regulatory Assessment: Support the regulatory exposure assessment across UK GDPR and the international regimes in scope for the client.
• Evidence: Advise on evidence preservation and the legal requirements that shape how an investigation is run.
• Report Contribution: Contribute the legal sections of incident reports, and review the remainder for anything that creates exposure.
• Litigation Support: Support litigation and disclosure work alongside instructing solicitors and external counsel.
• Post Incident Review: Conduct post incident legal reviews and turn them into something the client can act on.
• Contract Review: Review inbound contracts, DPAs and subcontractor terms under the direction of the Director.
• Knowledge Base: Keep our notification templates, regulatory trackers and knowledge base current.

Skills and Experience:

• Qualification: Qualified lawyer, England and Wales or a comparable jurisdiction. We will consider strong candidates across a range of post qualification levels.
• Data Protection: Working knowledge of UK GDPR and data breach notification in practice, not only in principle.
• Drafting Precision: Notifications are read closely by people looking for problems, so precision matters.
• Deadlines: Able to work to short deadlines without losing accuracy.
• Technical Literacy: Comfortable enough with technical material to interrogate a forensic finding rather than accept it.
• Client Confidence: Client facing confidence in a stressful situation.
• Eligibility: Right to work in the UK.

Highly Desirable (But Not Essential):

• Experience in a law firm cyber, privacy or technology practice.
• Exposure to live breach matters, from any side of them.
• Familiarity with sector specific regimes such as NIS, DORA or financial services rules.
• CIPP, CIPM or a similar certification.
• A second language.

Both seats involve some out of hours availability, because notification clocks do not pause. We are open to permanent or freelance arrangements for the right people, and to different levels of seniority across the two positions.