Associate Director, Privacy Law & Compliance

Bristol-Myers Squibb; Warszawa; Hybrid; PLN 327,000 - 397,000; Full time

Benefits offered by this job

Hybrid work model

Job summary

Bristol Myers Squibb is seeking an experienced Associate Director, Privacy Law & Compliance (Regional Privacy Counsel) based in Warsaw to guide privacy strategy across Europe, the Middle East and Africa. The role sits in the Global Privacy Law & Compliance team and will collaborate closely with regional business partners.

The ideal candidate has a law degree and 5–8 years of legal experience focused on data privacy in the EMEA region, with deep knowledge of multiple regimes and cross-border

Qualifications

• Law degree with bar admission in at least one EMEA jurisdiction.
• 5–8 years of legal experience, with ≥5 years in data privacy in EMEA.
• Expertise across GDPR, UK GDPR and at least one additional regime.
• Experience advising on cross-border data transfers and vendor contracts.

Responsibilities

• Advise on EU, UK, and regional data privacy laws across EMEA.
• Counsel business partners on privacy risks for initiatives.
• Support regional privacy program alignment with global standards.
• Conduct PIAs/DPIAs and maintain RoPA for EMEA entities.
• Monitor regulatory developments and update policies and controls.
• Advise on cross-border data transfer mechanisms and DPAs with partners.
• Develop and deliver region-specific privacy training.

Skills

Data privacy expertise

Cross-border transfers

Contract negotiation

English fluency

Education

Law degree (LLB/JD) and bar license

Job description

At Bristol Myers Squibb, our employees often ask, \"Who are you working for?\"-a question that fuels collaboration, accountability, and urgency in our work. Our purpose-driven culture inspires us to discover, develop, and deliver innovative medicines to prevail over serious diseases. We offer uniquely interesting and meaningful work, opportunities for growth, and a supportive environment that values inclusion, wellbeing, flexibility, and comprehensive benefits. This is work that transforms the lives of patients, and the careers of those who do it.

Bristol Myers Squibb is seeking an experienced and strategic Associate Director, Privacy Law & Compliance (Regional Privacy Counsel) - based in Warsaw - for Europe, the Middle East and Africa (EMEA) to join our Global Privacy Law & Compliance team.

Key Responsibilities

• EMEA Privacy Legal Advisor. Serve as the subject matter expert on data privacy laws across EMEA jurisdictions, including the EU (GDPR), UK (UK GDPR/DPA 2018), Switzerland (FADP), Turkey (KVKK), the Gulf states (UAE Federal PDPL, UAE DIFC/ADGM data protection regimes, Saudi Arabia PDPL, Qatar PDPL, Bahrain PDPL), Israel (Privacy Protection Law), and Sub-Saharan and North Africa (South Africa POPIA, Nigeria NDPA, Kenya DPA, Egypt PDPL, and other emerging frameworks).
• Business Stakeholder Advisory. Advise business partners on privacy risks and legal obligations associated with new and existing initiatives across the region.
• Compliance Program Advice. Work with Director, Global Privacy Compliance to ensure accurate and actionable regional privacy compliance program in alignment with global privacy standards and policies.
• Privacy Impact Assessments. Conduct PIAs and DPIAs for EMEA-specific initiatives and maintain records of processing activities (RoPA) for EMEA entities.
• Regulatory Monitoring. Track regulatory developments across EMEA and ensure timely updates to internal policies, procedures, and controls.
• Cross-Border Data Transfers. Advise on applicable transfer mechanisms (including EU Standard Contractual Clauses, UK IDTA/Addendum, Binding Corporate Rules, and adequacy decisions) and review/negotiate DPAs, vendor contracts, and data sharing arrangements with EMEA partners.
• Training & Awareness. Develop and deliver region-specific privacy training programs for EMEA employees, contractors, and third parties; foster a culture of privacy accountability.
• Incident Response. Support, as needed, EMEA privacy incident triage, investigation, notification, and remediation efforts (including breach notification timelines) in coordination with IT department.

Qualifications

• Education: Law degree (LLB, JD, or equivalent); license to practice law in at least one EMEA jurisdiction (EU member state, UK, or other EMEA jurisdiction).
• Experience: Minimum 5-8 years of legal experience, with at least 5 years focused on data privacy and protection law in the EMEA region.
• Deep expertise in at least three or more EMEA data privacy regimes (e.g., GDPR, UK GDPR, POPIA, UAE PDPL, Saudi PDPL).
• Demonstrated experience advising on cross-border data transfer mechanisms and international privacy frameworks.
• Prior experience in the life sciences, pharmaceutical, or healthcare sector strongly preferred.
• Proven ability to navigate complex, multi-jurisdictional privacy issues with business pragmatism.
• Strong negotiation skills for data processing and vendor agreements.
• Excellent communication skills in English; proficiency in at least one additional EMEA language (French, German, Arabic, or Portuguese) highly desirable.

Please note that this position is not a remote working opportunity and is based in the local BMS office, following a hybrid work model with at least 50% onsite attendance at your assigned facility. #LI-HYBRID

Compensation Overview

Warsaw - PL: zł327,250 - zł396,550 The starting compensation range(s) for this role are listed above for a full-time employee (FTE) basis. Additional incentive cash and stock opportunities (based on eligibility) may be available. The starting pay takes into account characteristics of the job, such as required skills, where the job is performed, the employee’s work schedule, job-related knowledge, and experience. The final compensation will be determined based on demonstrated experience and in accordance with pay equity principles and applicable employment laws.

How We Work

Where you work matters - because collaboration, innovation and patient impact happen in many settings. Our roles are structured across four work models: site-essential, site-by-design, field-based and remote-by-design. The model assigned to this role is based on its core responsibilities. Learn more at https://careers.bms.com/ways-of-working.

Supporting People with Disabilities

BMS is dedicated to ensuring that people with disabilities can excel through a transparent recruitment process, reasonable workplace accommodations/adjustments and ongoing support in their roles. Applicants can request a reasonable workplace accommodation/adjustment prior to accepting a job offer. If you require reasonable accommodations/adjustments in completing this application, or in any part of the recruitment process, direct your inquiries to [e-mail].

Equal Employment Opportunity Statement

Visit careers.bms.com/eeo-accessibility to access our complete Equal Employment Opportunity statement.

Candidate Rights

BMS will consider qualified applicants with arrest and conviction records, pursuant to applicable laws in your area.

Additional Information for Los Angeles County Applicants

If you live in or expect to work from Los Angeles County if hired for this position, please visit this page for important additional information: https://careers.bms.com/california-residents/.

Data Protection

We will never request payments, financial information, or social security numbers during our application or recruitment process. Learn more about protecting yourself at https://careers.bms.com/fraud-protection.

If this posting is missing required information required by local law or incorrect, contact BMS at [e-mail] with the Job Title and Requisition number. Do not send application-related inquiries to this email. To check your application status, please login to your Candidate Home Account.

R1606359 : Associate Director, Privacy Law & Compliance Data Privacy Link

We’re creating innovative medicines for patients fighting serious diseases. We’re also nurturing our own diverse team with inspiring work and challenging career options. No matter the role, each one of us makes a contribution. And that makes all the difference.