Privacy Counsel

SHEIN; Greater London; On-site; GBP 90,000 - 120,000; Full time

Job summary

SHEIN is seeking a motivated Privacy Lawyer to support day-to-day data protection and privacy compliance across its EU-based online commerce business. This role works closely with the DPO and Senior Privacy Counsel to ensure personal data is handled in accordance with GDPR.

You will advise on processing activities, DPIAs, records of processing, privacy notices, and cross-border transfers, manage data subject rights requests, and assist with regulatory inquiries.

Qualifications

• Qualified lawyer with strong experience in data protection and privacy matters.
• Demonstrated ability to advise on GDPR, ePrivacy, and cross-border data transfers.
• Experience communicating complex legal concepts to non-legal stakeholders.

Responsibilities

• Provide practical, risk-based legal advice on privacy matters across the business.
• Support GDPR compliance, ePrivacy, consumer privacy requirements, and other privacy laws.
• Assist with DPIAs, records of processing, privacy notices, and governance documents.
• Review privacy provisions in commercial agreements, DPAs, and data transfer clauses.
• Handle data subject rights requests and responses to regulatory inquiries in a timely manner.

Skills

GDPR knowledge

Privacy law

Legal drafting

Regulatory compliance

English fluency

Education

Qualified lawyer in EU jurisdiction

Job description

We are seeking a motivated and commercially minded Privacy Lawyer to support day-to-day data protection and privacy compliance across our EU-based online commerce business. This role is ideal for a lawyer with experience in data protection and privacy law who is keen to develop expertise in a fast-paced digital business.The successful candidate will work closely with the Data Protection Officer (DPO), Senior Privacy Counsel, and other business teams. They will help ensure that personal data is handled responsibly and in compliance with applicable privacy laws, with a primary focus on the EU General Data Protection Regulation (GDPR).Experience with privacy and data protection requirements in the Middle East is an advantage.

Day-to-Day Privacy Compliance

• Provide practical, risk-based legal advice on data protection matters arising across the business.
• Support compliance with the GDPR, ePrivacy rules, consumer privacy requirements, and other applicable data protection laws.
• Assist with conducting and documenting privacy impact assessments, including Data Protection Impact Assessments where required.
• Support the maintenance of records of processing activities, data inventories, privacy notices, internal policies, and other privacy governance documentation.
• Review and negotiate privacy-related provisions in commercial agreements, including data processing agreements, international data transfer clauses, and vendor terms.
• Handle escalated customer complaints and regulatory inquiries from Supervisroy Authorioties including the Irish DPC and the UK ICO.Advise on responses to data subject rights requests, including access, deletion, correction, objection, and portability requests.
• Support incident response processes, including the assessment, documentation, and escalation of personal data breaches.

Regulatory Investigations and DPO Support

• Support the DPO in responding to enquiries, audits, inspections, investigations, and other requests from data protection authorities and regulators.
• Assist with gathering evidence, coordinating internal stakeholders, preparing regulatory submissions, and maintaining investigation files.
• Help assess legal obligations relating to regulatory notifications and communications.
• Monitor developments in privacy law, regulatory guidance, and enforcement activity, and communicate relevant updates to internal stakeholders.
• Contribute to privacy training, awareness initiatives, and compliance monitoring activities.

International Privacy Matters

• Support privacy compliance issues involving international data transfers and cross-border processing.
• Assist with matters relating to Middle Eastern data protection laws and regulatory requirements, where applicable.
• Work with local advisers and internal stakeholders to help identify and manage jurisdiction-specific privacy risks.

Required Qualifications and Experience

• Qualified lawyer in an EU jurisdiction or eligibility to qualify within a reasonable period.
• Approximately 5-7 years of relevant post-qualification experience, or equivalent experience gained in private practice, in-house, a regulator, or a consultancy.Experience or demonstrable interest in data protection, privacy, technology, digital commerce, consumer law, or regulatory compliance.
• Working knowledge of the GDPR and core privacy compliance concepts, including lawful bases, transparency, processor-controller arrangements, data subject rights, breach management, and international transfers.
• Strong legal drafting, research, organisational, and project-management skills.Ability to communicate legal requirements clearly and pragmatically to non-legal colleagues.
• Professional fluency in English.

Desirable Skills and Experience

• Experience in an online commerce, marketplace, digital platform, technology, payments, retail, or consumer-facing business.
• Experience assisting with regulatory investigations, audits, or interactions with supervisory authorities.Knowledge of privacy laws and regulatory practices in one or more Middle Eastern jurisdictions.
• Privacy qualifications or certifications, such as CIPP/E, CIPM, or equivalent.
• Additional European, Middle Eastern or Mandarin Chinese language skills.

Personal Attributes

• Curious, proactive, and eager to develop as a privacy specialist.
• Commercially aware and capable of balancing legal risk with business objectives.
• Detail-oriented, reliable, and comfortable managing multiple priorities.
• Collaborative and confident working with cross-functional teams.
• Calm and professional when handling sensitive or time-critical matters.