Director, Privacy & Data Protection

ROSTR, Inc.; Santa Monica (CA); On-site; USD 90,000 - 180,000; Full time

Benefits offered by this job

Medical, dental, vision coverage

Wellbeing reimbursements (fitness/spa)

Job summary

Universal Music Group seeks a Director, Privacy & Data Protection to support global privacy and data protection programs. You will draft and negotiate privacy terms in contracts, handle data-subject rights requests, and assist with privacy aspects of cybersecurity incidents and regulatory compliance across businesses worldwide.

The role requires a J.D., 8+ years of experience, and strong drafting/negotiation skills, with the ability to provide practical, business-oriented privacy advice across

Qualifications

• J.D. from an accredited law school and state bar admission.
• 8+ years of relevant legal experience in privacy, data protection, cybersecurity or related field.
• Experience drafting and negotiating data processing agreements and privacy/security provisions.
• Strong knowledge of U.S. federal and state privacy laws (CCPA/CPRA, etc.) and familiarity with GDPR.

Responsibilities

• Draft, review and negotiate data privacy terms in commercial agreements (DPA, data-sharing, transfer provisions).
• Advise on privacy rights requests and related regulatory obligations.
• Support privacy aspects of cybersecurity incidents and investigations.
• Provide guidance on privacy for websites, digital marketing, e‑commerce and consumer data practices.
• Assist with vendor due diligence and data transfer requirements.

Skills

Privacy law

Drafting & negotiation

Regulatory compliance

Education

J.D. degree

Job description

We are UMG, the Universal Music Group. We are the world’s leading music company. In everything we do, we are committed to artistry, innovation and entrepreneurship. We own and operate a broad array of businesses engaged in recorded music, music publishing, merchandising, and audiovisual content in more than 60 countries. We identify and develop recording artists and songwriters, and we produce, distribute and promote the most critically acclaimed and commercially successful music to delight and entertain fans around the world.

How We LEAD:

The Director, Privacy & Data Protection will be an experienced privacy attorney supporting Universal Music Group's global privacy and data protection program. Working closely with the Senior Vice President, Privacy & Data Protection, this role will provide practical, hands-on legal support across privacy contracting, data subject rights, cybersecurity incidents, digital marketing and other matters involving the collection, use, sharing and protection of personal data.

As the world leader in music-based entertainment, UMG operates across a broad range of labels, artist businesses, digital platforms, e-commerce experiences, marketing initiatives and fan-facing services. The Director will work with colleagues across Legal, Information Security, Technology, Digital, Marketing, E-Commerce and the business to help UMG use data responsibly while supporting artists, creators and fans around the world.

The ideal candidate will combine strong privacy law fundamentals with excellent drafting and negotiation skills, sound judgment and a practical, business-oriented approach. This role requires an attorney who is comfortable managing a significant volume of day-to-day matters, can independently handle work within established frameworks, and recognizes when novel, sensitive or higher-risk issues require escalation.

How You'll CREATE:

• Draft, review and negotiate data protection and privacy terms in commercial agreements, including data processing agreements, data-sharing arrangements, international data transfer provisions, information security terms and other privacy-related contractual provisions.
• Partner with UMG's Business & Legal Affairs teams on privacy issues arising in artist, vendor, technology, platform, licensing, e-commerce, marketing and other commercial arrangements involving personal data.
• Handle UMG's day-to-day legal work relating to data subject and consumer privacy rights requests, including assessing request scope and applicable legal requirements, advising on exemptions and response obligations, coordinating with privacy operations and relevant business teams, reviewing and drafting responses, and escalating complex or sensitive matters as appropriate.
• Support the privacy-law aspects of cybersecurity and data security incidents, working closely with Information Security, Legal and other stakeholders to assess incident facts and affected data, analyze applicable notification and regulatory requirements, document legal assessments, and draft or review incident-related communications.
• Assist with investigations of potential privacy and data security issues, including gathering relevant facts, evaluating legal obligations and coordinating with outside counsel where appropriate.
• Advise business and legal teams on privacy requirements affecting UMG's websites, applications, digital platforms, artist and fan experiences, e-commerce operations, advertising and marketing activities.
• Provide practical guidance on online advertising and tracking technologies, marketing communications, consent and preference management, and related privacy and consumer protection requirements.
• Advise on compliance with U.S. federal and state privacy laws, GDPR and other applicable international privacy and data protection requirements.
• Support privacy reviews of new and evolving business initiatives, technologies, vendors, products and uses of data, including privacy impact assessments where appropriate.
• Assist with third-party privacy and data protection matters, including vendor diligence, data-transfer requirements, privacy questionnaires and remediation of identified issues.
• Help maintain and improve privacy policies, procedures, templates, playbooks and other resources that support consistent and scalable privacy practices across UMG's labels, territories and business units.
• Work with privacy operations, Information Security and business teams to identify recurring issues and improve processes for contract review, rights requests, incident response and other recurring privacy matters.
• Support responses to regulatory inquiries, audits and other privacy or data protection matters as needed.
• Monitor relevant developments in privacy, data protection, cybersecurity, digital marketing and consumer protection law and provide clear, practical guidance regarding developments relevant to UMG's businesses.
• Provide privacy guidance and training to Legal, business and operational teams as needed.
• Support privacy issues arising from emerging technologies and new uses of data as appropriate.
• Collaborate effectively with colleagues across UMG's labels, business units and territories, handling routine and moderately complex matters independently and escalating novel, sensitive or significant matters as appropriate.

Bring Your VIBE:

• J.D. from an accredited law school and active membership in good standing in at least one U.S. state bar.
• 8+ years of relevant legal experience, with substantial experience in privacy, data protection, cybersecurity, technology transactions or a closely related field, gained at a law firm, in-house legal department or a combination of both.
• Experience drafting and negotiating data processing agreements and privacy, data use and security provisions in commercial agreements.
• Strong working knowledge of U.S. federal and state privacy laws, including CCPA/CPRA and other comprehensive state privacy laws, and meaningful familiarity with GDPR and international data protection requirements.
• Experience advising on data subject and consumer privacy rights requests, including access, deletion, correction and related requests.
• Experience advising on privacy issues arising from websites, digital advertising, online tracking technologies, e-commerce, marketing and other consumer-facing data practices.
• Familiarity with consumer protection and marketing requirements relevant to digital and direct-to-consumer activities.
• Meaningful experience supporting cybersecurity or data security incident response, including familiarity with breach-notification requirements and experience working with information security or technical teams during investigations.
• Strong legal research, analytical, drafting and negotiation skills, with the ability to identify the issues that matter and provide clear, practical and business-oriented advice.
• Ability to understand technical and operational facts sufficiently to identify relevant privacy, cybersecurity and digital marketing legal issues.
• Sound judgment and the ability to handle a significant volume of matters independently while recognizing when an issue warrants escalation.
• Strong organizational skills and the ability to manage multiple matters and competing priorities in a fast-moving, global and highly collaborative environment.
• Excellent communication and collaboration skills, including the ability to explain complex privacy and data protection requirements clearly to lawyers and non-lawyers.
• CIPP/US, CIPP/E or another relevant privacy certification preferred.
• Experience in entertainment, music, digital media, technology, e-commerce, advertising or another consumer-facing and data-intensive industry is a plus.

Disclaimer:

This job description only provides an overview of job responsibilities that are subject to change.

Perks Playlist:

Join an entrepreneurial, global organization where authenticity, boldness, creativity, connection, drive, and insight aren’t just values—they’re how we work every day. Here are some of the ways we support you along the way (and just a few of the benefits we offer):

• Comprehensive medical, dental, and vision coverage
• Including 100% coverage for out-patient in-network mental health services
• Fertility coverage for eligible medical plan participants
• Wellbeing reimbursements for fitness classes, spa treatments, meal services, travel, and so much more (up to $720/year)
• Student Loan Repayment Assistance and Tuition Reimbursement
• 401(k) with 100% immediate vesting on the first 5% of your contributions, plus an additional UMG contribution

A variety of ways to prioritize much-needed time away from work including:

• Flexible Paid Time Off (PTO) for exempt employees
• 3-weeks PTO for non-exempt employees
• 2-weeks paid Winter Break
• 10 Company Holidays (including Juneteenth and Wellbeing Day)
• Summer Fridays (between Memorial Day and Labor Day)
• Generous paid parental leave for every type of parent

Check out our full overview of benefits on the Perks Playlist page of the career site.

Disclaimer: This job description only provides an overview of job responsibilities that are subject to change.

Universal Music Group is an Equal Opportunity Employer

We are an E-Verify employer in Alabama, Arizona, Georgia, Mississippi, North Carolina, South Carolina, Tennessee, and Utah.

Please note, UMG is not enrolled in E-Verify in California and New York, and cannot support employment of candidates whose employer must enroll in E-Verify, for example candidates on STEM-OPT.

For more information, please click on the following links.

E-Verify Participation Poster: English / Spanish

E-Verify Right to Work Poster: English|Spanish

Job Category: Business & Legal Affairs

Salary Range: $89,700 - $180,000

The actual base salary offered depends on a variety of factors, which may include, as applicable, the qualifications of the individual applicant for the position, years of relevant experience, specific and unique skills, level of education attained, certifications or other professional licenses held, and the location in which the applicant lives and/or from which they will be performing the job.All candidates are encouraged to apply.