Privacy Counsel

Smartsuite; Newport Beach (CA); On-site; USD 180,000 - 230,000; Full time

Job summary

Capitolis is seeking a Privacy Counsel to oversee governance, risk and compliance for data processing, contracts and regulatory interpretation. You will verify lawful bases, review privacy clauses and data handling terms, and manage legal aspects of privacy incidents and investigations.

The role focuses on establishing structured review processes, linking processing activities with legal review, and coordinating with the Privacy Program Manager and DPO to ensure regulatory alignment across

Qualifications

• Advise on lawful bases and regulatory interpretation for processing.
• Review data processing agreements and privacy clauses.
• Oversee legal aspects of privacy incidents and notifications.

Responsibilities

• Provide governance, risk and compliance oversight for data processing activities.
• Ensure DPIAs, privacy notices and policies reflect current laws and internal controls.
• Coordinate with privacy, security and legal teams to respond to regulatory inquiries and data subject disputes.
• Maintain records of processing activities and evidence of legal review for processing activities.

Job description

Governance, risk and compliance

SmartSuite for the Privacy Counsel

Privacy Counsel provides legal oversight of data processing, contracts and regulatory interpretation. They verify lawful bases, review privacy clauses and third‑party data handling terms, and oversee the legal aspects of privacy incidents and investigations.

What you own

Privacy Counsel provides legal oversight of data processing, contracts and regulatory interpretation.

• Advise on lawful bases and regulatory interpretation for processing
• Review data processing agreements and privacy clauses
• Oversee legal aspects of privacy incidents and notifications
• Support regulatory inquiries and data subject disputes
• Review privacy notices and policies
• Track privacy law developments across jurisdictions

At a glance

The GRC processes this role owns, touches and depends on.

Owns

accountable for the process

Touches

contributes or approves

Depends on

consumes its output

How the GRC processes connect

Three lines of defence set the frame; the chain shows where each process hands off to the next. Colours follow the Privacy Counsel: navy is owned, blue is touched, grey is depended on.

1. First line - The business and its control owners: Run the processes, own the controls, fix the issues
2. Second line - Risk, compliance and the domain programmes: Set the frameworks, assess, monitor and advise
3. Third line - Internal audit: Independent assurance to the board and audit committee

Reporting lines

Who this role reports to, who reports to them, and the peers they work with most.

Reports to

General Counsel

Works closely with

Data Protection Officer

Privacy Program Manager

Legal Operations Manager

Compliance Counsel

How SmartSuite supports the Privacy Counsel

Privacy Counsel provides the legal oversight behind data processing, contracts and incidents, and the General Counsel, the Chief Privacy Officer and supervisory authorities expect every lawful basis, clause and notification decision documented. SmartSuite links processing activities, vendor records and incident cases to their legal review, so counsel's advice is on the record, not in an inbox.

Give legal oversight a structured record

Lawful bases documented against each activity. Legal basis and control linkage records the lawful basis, the controls and the supporting evidence for every processing activity, so your advice on why processing is permitted is attached to the activity rather than to an email thread.

Assessments that reach counsel when they must

Automated review routing sends a DPIA to legal, security and risk reviewers automatically, so you see the assessments that raise a legal question and the Privacy Program Manager handles the ones that do not.

Transfers mapped across regions

End-to-end data mapping shows data flows across processes, systems, vendors and regions, so an international transfer that needs Standard Contractual Clauses or the Data Privacy Framework is visible on the map before the contract is signed.

Stay connected to the DPO, vendors and legal operations

Vendors tiered by the data they touch

Tiering and criticality scoring segments vendors on data access, geography and inherent risk, so a processor handling special category data reaches your review queue as a high-tier vendor rather than as one line in procurement's list.

DPAs stored with the vendor they bind

Document and evidence management keeps attestations, certifications and compliance artifacts against the vendor with version control, so the Data Protection Officer and the Legal Operations Manager find the executed DPA on the vendor record, not in a contract folder.

Privacy and security reviewing the same vendor

Cross-functional vendor transparency gives Legal, Security, Risk and Compliance one view of each vendor's obligations and performance, so your privacy review and the security assessment happen on the same record rather than in parallel.

Defend decisions to regulators and in disputes

Records that hold up in an inquiry

Communications, decisions and artifacts are stored centrally, so a supervisory authority's question or a data subject dispute is answered with the lawful basis, the review and the sign-off as recorded at the time.

Due diligence briefs drafted with the AI Assistant

Use the AI Assistant in a SmartDoc field to generate vendor risk summaries and due diligence briefs from the vendor record, so the briefing you give the General Counsel on a processor's risk starts from the assessment data rather than from a blank page.

Reassessment when the law or the processing changes

Recurring assessment cycles schedule re-assessments as processing evolves, so when a new state privacy law or a changed transfer mechanism lands, the activities it affects are re-reviewed on a schedule you set rather than when someone remembers.

Privacy. Standardizes processing reviews, evidence collection and legal sign-off workflows with document logs.

Third‑party risk. Reviews privacy clauses and third‑party data handling terms against the vendor record.

Issues and actions. Oversees the legal workstream of privacy incidents as tracked cases.

Reporting. Provides counsel a view of open processing reviews, incidents and contract approvals.

Products this role uses most

Privacy Risk Management - Manage privacy risks with data inventories, PIAs and DPIAs, control tracking, and dashboards that show exposure against GDPR, CCPA, and HIPAA requirements.

Contract Lifecycle Management (CLM) - Manage contracts across their full lifecycle in one platform for drafting, approvals, renewals, and compliance.

Legal Matter Management - Track and manage legal matters, cases, and workflows with real‑time visibility across legal operations.

Incident Management - Capture and resolve incidents with structured workflows, real‑time visibility, and integrated response across risk, compliance, and operations.

Industry reference

GDPR, the UK GDPR and the growing set of US state privacy laws led by CCPA/CPRA set the questions counsel answers: lawful basis, controller and processor terms, data subject rights and breach notification. Cross‑border transfers rely on the EU's Standard Contractual Clauses, the UK's International Data Transfer Agreement and the EU-US Data Privacy Framework.

Sector law adds layers: GLBA and state insurance privacy rules for financial firms; HIPAA business associate agreements and state health-data laws for healthcare; the Privacy Act for federal agencies; COPPA, ePrivacy and platform‑specific rules for technology companies. The IAPP's CIPP body of knowledge covers the field.

Related roles

General Counsel

Frequently asked questions

Privacy Counsel provides the legal oversight of the privacy program: advising on lawful bases and regulatory interpretation for processing, reviewing data processing agreements and privacy clauses, overseeing the legal aspects of privacy incidents and notifications, supporting regulatory inquiries and data subject disputes, reviewing privacy notices and policies and tracking privacy law developments across jurisdictions. The Data Protection Officer and Privacy Program Manager run the program; counsel decides what the law requires of it.

Privacy Risk Management standardizes processing reviews, evidence collection and legal sign-off workflows with document logs, so a new processing activity goes through the same review with the same evidence requested, and counsel's sign-off, with the lawful basis relied on, is recorded against it. The document log holds what was reviewed and when, which is what a regulator asks for in an inquiry, and the Privacy Program Manager sees which reviews are waiting on legal.

Privacy clauses and third‑party data handling terms are reviewed against the vendor record, so counsel's review of a data processing agreement, the Standard Contractual Clauses or a HIPAA business associate agreement sits with the vendor it concerns rather than in a separate contract folder. Contract Lifecycle Management (CLM) runs the contract workflow, with the Legal Operations Manager routing the review and Privacy Counsel approving the privacy terms inside it, so the approved terms are on the contract.

The legal workstream of a privacy incident is tracked as a case, so counsel's decisions on notification, privilege and regulatory contact are recorded against the incident with their timing. Incident Management holds the incident itself and Legal Matter Management holds the matter if a dispute or inquiry follows, so the Data Protection Officer's notification work and counsel's legal assessment refer to the same record when the 72‑hour GDPR clock or a state breach law is running.

SmartSuite provides counsel a view of open processing reviews, incidents and contract approvals, so Privacy Counsel can see what is waiting on legal across the program in one place rather than across the Privacy Program Manager's list, the contracts queue and the incident log. The General Counsel or Chief Privacy Officer sees the same view when asking what is outstanding, and the Compliance Counsel sees where privacy and compliance reviews overlap.

New customers can start with SmartSuite Onboarding, a guided four‑week program around one or two priority workflows. For counsel the first workflow is the processing review: agree the review template and evidence counsel requires for a processing activity, load the reviews and contract approvals currently in progress, and link the active vendor agreements to their vendor records. Open incidents with a legal workstream are loaded as cases so nothing is lost in transition, and from then on counsel's decisions accumulate as the program's legal record.