Director, Privacy and Data Protection

UMG Recordings; Santa Monica (CA); On-site; USD 180,000 - 240,000; Full time

Job summary

UMG Recordings is seeking a Director, Privacy & Data Protection to lead the global privacy program, working with Legal, IT, Marketing, and business teams. The role involves drafting and negotiating data protection terms, guiding incident response, and ensuring compliance with U.S.

and international privacy laws as UMG scales its platforms and fan experiences. The ideal candidate is a privacy attorney with strong drafting skills, practical business judgment, and the ability to manage a high

Qualifications

• The ideal candidate will combine strong privacy law fundamentals with excellent drafting and negotiation skills.
• Experience advising on privacy and data protection across commercial arrangements is preferred.
• Ability to manage day‑to‑day privacy matters within established frameworks and escalate when needed.

Responsibilities

• Draft, review and negotiate privacy terms in agreements, including DPAs and data transfer provisions.
• Advise internal teams on privacy requirements for websites, apps, platforms, and marketing activities.
• Support incident response and handling of data subject rights requests with coordination across teams.
• Provide practical guidance on online tracking technologies, consent, and GDPR/commercial privacy compliance.
• Stay updated on privacy law developments and provide actionable guidance for business units.

Job description

We are UMG, the Universal Music Group. We are the world's leading music company. In everything we do, we are committed to artistry, innovation and entrepreneurship. We own and operate a broad array of businesses engaged in recorded music, music publishing, merchandising, and audiovisual content in more than 60 countries. We identify and develop recording artists and songwriters, and we produce, distribute and promote the most critically acclaimed and commercially successful music to delight and entertain fans around the world.

Director, Privacy & Data Protection

Job Category: Business & Legal Affairs

How We LEAD:

The Director, Privacy & Data Protection will be an experienced privacy attorney supporting Universal Music Group's global privacy and data protection program. Working closely with the Senior Vice President, Privacy & Data Protection, this role will provide practical, hands‑on legal support across privacy contracting, data subject rights, cybersecurity incidents, digital marketing and other matters involving the collection, use, sharing and protection of personal data.

As the world leader in music‑based entertainment, UMG operates across a broad range of labels, artist businesses, digital platforms, e‑commerce experiences, marketing initiatives and fan‑facing services. The Director will work with colleagues across Legal, Information Security, Technology, Digital, Marketing, E‑Commerce and the business to help UMG use data responsibly while supporting artists, creators and fans around the world.

The ideal candidate will combine strong privacy law fundamentals with excellent drafting and negotiation skills, sound judgment and a practical, business‑oriented approach. This role requires an attorney who is comfortable managing a significant volume of day‑to‑day matters, can independently handle work within established frameworks, and recognizes when novel, sensitive or higher‑risk issues require escalation.

How You’ll CREATE:

• Draft, review and negotiate data protection and privacy terms in commercial agreements, including data processing agreements, data-sharing arrangements, international data transfer provisions, information security terms and other privacy‑related contractual provisions.
• Partner with UMG's Business & Legal Affairs teams on privacy issues arising in artist, vendor, technology, platform, licensing, e‑commerce, marketing and other commercial arrangements involving personal data.
• Handle UMG's day‑to‑day legal work relating to data subject and consumer privacy rights requests, including assessing request scope and applicable legal requirements, advising on exemptions and response obligations, coordinating with privacy operations and relevant business teams, reviewing and drafting responses, and escalating complex or sensitive matters as appropriate.
• Support the privacy‑law aspects of cybersecurity and data security incidents, working closely with Information Security, Legal and other stakeholders to assess incident facts and affected data, analyze applicable notification and regulatory requirements, document legal assessments, and draft or review incident‑related communications.
• Assist with investigations of potential privacy and data security issues, including gathering relevant facts, evaluating legal obligations and coordinating with outside counsel where appropriate.
• Advise business and legal teams on privacy requirements affecting UMG's websites, applications, digital platforms, artist and fan experiences, e‑commerce operations, advertising and marketing activities.
• Provide practical guidance on online advertising and tracking technologies, marketing communications, consent and preference management, and related privacy and consumer protection requirements.
• Advise on compliance with U.S. federal and state privacy laws, GDPR and other applicable international privacy and data protection requirements.
• Support privacy reviews of new and evolving business initiatives, technologies, vendors, products and uses of data, including privacy impact assessments where appropriate.
• Assist with third‑party privacy and data protection matters, including vendor diligence, data‑transfer requirements, privacy questionnaires and remediation of identified issues.
• Help maintain and improve privacy policies, procedures, templates, playbooks and other resources that support consistent and scalable privacy practices across UMG's labels, territories and business units.
• Work with privacy operations, Information Security and business teams to identify recurring issues and improve processes for contract review, rights requests, incident response and other recurring privacy matters.
• Support responses to regulatory inquiries, audits and other privacy or data protection matters as needed.
• Monitor relevant developments in privacy, data protection, cybersecurity, digital marketing and consumer protection law and provide clear, practical guidance regarding developments relevant to UMG's businesses.
• Provide privacy