EHR Privacy Analyst

UPMC Ireland; Kilkenny; Hybrid; EUR 90,000 - 130,000; Full time

Benefits offered by this job

Fully paid maternity and paternity

Competitive Pension Plan

Critical Illness cover

Job summary

UPMC Ireland is seeking a senior privacy advisor to provide specialist GDPR and data protection guidance for the Cúram programme. You will support privacy governance artefacts and ensure privacy by design across design, build, testing, and deployment in a hybrid Ireland/Dublin 9 and Kilkenny environment.

The role requires a Masters of Law and at least eight years of legal or data protection experience, with strong advisory and stakeholder-management skills.

Qualifications

• Specialist privacy advisory and data protection expertise expected.
• Experience supporting governance artefacts like DPIAs and records managements tooling.

Responsibilities

• Provide specialist advice on data protection and information governance for the programme.
• Support development and review of privacy documentation (DPIAs, Records of Processing Activities, etc.).
• Advise on GDPR compliance and privacy by design throughout design, build, testing, deployment.
• Review contracts for data protection requirements including DPAs.
• Assess data flows and ensure privacy controls are documented.
• Collaborate with Records Manager to embed lifecycle management in processes.
• Review policies and governance documents for data protection requirements.
• Map processes for Data Subject Rights requests.
• Update privacy notices and consent materials as needed.
• Identify and document privacy risks in the risk register.
• Assist with privacy issues during go-live and post-implementation.

Skills

Privacy by design

GDPR compliance

Legal analysis

Stakeholder management

Regulatory advisory

Education

LLM

8+ years Legal/Data Protection experience

Job description

Location: Swift Square, Dublin 9 and Kilkenny (Hybrid)

Job type: Fixed-Term (6 months)

Hours: 39 hours per week

Closing Date: 19/11/2026

Overview Of Role

To provide specialist privacy advice to the Cúram programme, ensuring that GDPR, regulatory, and organisational requirements are considered and embedded throughout the design, implementation, and deployment of the EHR solution and its associated processes, integrations, and data flows.

Primary Duties And Responsibilities

• Provide specialist advice and guidance on data protection, privacy, and information governance matters associated with the Cúram programme.
• Support the development, maintenance, and review of programme privacy documentation, including Records of Processing Activities, Data Protection Impact Assessments, Legitimate Interest Assessments, Transfer Impact Assessments, and related governance artefacts.
• Advise project teams on GDPR compliance, privacy by design principles, and information governance considerations throughout the design, build, testing, deployment, and implementation phases of the programme.
• Review supplier contracts to identify data protection requirements, including Data Processing Agreements.
• Support the assessment and documentation of data flows between the EHR and integrated systems, ensuring appropriate privacy and information governance controls are considered and documented.
• Collaborate with the Records Manager and programme stakeholders to ensure records retention, archiving, disposal, and information lifecycle management requirements are incorporated into the EHR solution and supporting processes.
• Review new and updated programme policies, procedures, standards, operational processes, and governance documents to identify and incorporate relevant data protection, privacy, records management, and information governance requirements.
• Map the process for Data Subject Rights requests, ensuring EHR related procedures and system capabilities support compliance with GDPR requirements for access, rectification, erasure, restriction, objection, and data portability requests.
• Support the review and update of privacy notices, consent materials, and other transparency documentation to ensure processing activities introduced through the EHR programme are accurately documented and communicated.
• Identify, assess, and document privacy and data protection risks arising from programme activities, ensuring risks are appropriately recorded within the Data Protection Risk Register, assigned to relevant risk owners, and supported by proportionate mitigation actions.
• Support the investigation and resolution of privacy, confidentiality, and information governance issues arising during programme delivery, including testing, data migration, go-live, and post-implementation activities.

Qualifications & Experience

Required

• Masters of Law (LLM)
• Minimum of 8 years Legal and/or Data Protection experience

Preferred

• Second Language is Desirable

Equal Opportunity Statement And Benefits

UPMC is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees.

Benefits

• Fully paid maternity and paternity leave for new parents.
• Competitive Pension Plan, company funded Death in Service Benefit x 3 times.
• Critical Illness cover for all employees up to the age of 66.

Performance and Recognition

Rewards for performance that supports the goals and mission of UPMC through our annual ACES programme.

Work-Life Balance

Enhanced annual leave up to a maximum of 27 days. Flexible working opportunities to support you to work around external family commitments.

Development and Career Opportunities

Opportunities for each employee to reach their career goals through continued learning and/or advancement.

About UPMC

UPMC is a renowned multinational academic medical centre committed to delivering people-focused care that’s close to home. Headquartered in Pittsburgh and affiliated with the University of Pittsburgh Schools of the Health Sciences, UPMC shapes the future of health through clinical and technological innovation, research and education. UPMC expands its expertise globally, bringing world‑class care across continents through its UPMC International division — an owned and operated network of hospitals and ambulatory care centres in Italy, Ireland and Croatia. UPMC International brings new access to the signature specialty services of UPMC Hillman Cancer Centre, UPMC Sports Medicine and others to more people in more places around the world.

In Ireland UPMC has provided high-quality healthcare in the South East since 2006. UPMC’s operations in Ireland now include UPMC Whitfield Hospital in Waterford, UPMC Sports Surgery Clinic in Dublin, UPMC Kildare Hospital in Clane, and UPMC Aut Even Hospital in Kilkenny. Outpatient care is available at the UPMC Carlow Outreach Centre, UPMC Hillman Cancer Centre radiotherapy locations in Waterford and Cork, UPMC The 4th Practice in Mallow, and across UPMC Sports Medicine Clinics in Dublin, Waterford, Limerick, Tipperary, Cork, and Mayo. UPMC has also established a nationwide Concussion Network. UPMC's Global Technology Operation Centre is based in Kilkenny.