Director, Privacy and Data Protection

Universal Music•New York, NY

About The Position

The Director, Privacy & Data Protection is an experienced privacy attorney supporting Universal Music Group’s global privacy and data protection program. Working closely with the Senior Vice President, Privacy & Data Protection, the Director provides practical, hands-on legal support across privacy contracting, data subject rights, cybersecurity incidents, digital marketing, and other matters involving the collection, use, sharing, and protection of personal data. UMG operates across labels, artist businesses, digital platforms, e-commerce experiences, marketing initiatives, and fan-facing services in more than 60 countries. The Director collaborates with Legal, Information Security, Technology, Digital, Marketing, E-Commerce, and business colleagues to support responsible data use for artists, creators, and fans worldwide. The role calls for strong privacy-law fundamentals, drafting and negotiation skills, sound judgment, and a practical, business-oriented approach. The attorney manages a significant volume of day-to-day matters independently within established frameworks and escalates novel, sensitive, or higher-risk issues when appropriate.

Requirements

J.D. from an accredited law school and active membership in good standing in at least one U.S. state bar.
At least 8 years of relevant legal experience, with substantial experience in privacy, data protection, cybersecurity, technology transactions, or a closely related field, gained at a law firm, in-house legal department, or both.
Experience drafting and negotiating data processing agreements and privacy, data use, and security provisions in commercial agreements.
Strong working knowledge of U.S. federal and state privacy laws, including CCPA/CPRA and other comprehensive state privacy laws, and meaningful familiarity with GDPR and international data protection requirements.
Experience advising on data subject and consumer privacy rights requests, including access, deletion, correction, and related requests.
Experience advising on privacy issues involving websites, digital advertising, online tracking technologies, e-commerce, marketing, and other consumer-facing data practices.
Familiarity with consumer protection and marketing requirements relevant to digital and direct-to-consumer activities.
Meaningful experience supporting cybersecurity or data security incident response, including familiarity with breach-notification requirements and experience working with information security or technical teams during investigations.
Strong legal research, analytical, drafting, and negotiation skills, with the ability to identify key issues and provide clear, practical, business-oriented advice.
Ability to understand technical and operational facts sufficiently to identify relevant privacy, cybersecurity, and digital marketing legal issues.
Sound judgment and ability to handle a significant volume of matters independently while recognizing when escalation is warranted.
Strong organizational skills and ability to manage multiple matters and competing priorities in a fast-moving, global, collaborative environment.
Excellent communication and collaboration skills, including ability to explain complex privacy and data protection requirements clearly to lawyers and non-lawyers.

Nice To Haves

CIPP/US, CIPP/E, or another relevant privacy certification.
Experience in entertainment, music, digital media, technology, e-commerce, advertising, or another consumer-facing and data-intensive industry.

Responsibilities

Draft, review, and negotiate privacy and data protection terms in commercial agreements, including data processing agreements, data-sharing arrangements, international data transfer provisions, and information security terms.
Partner with Business & Legal Affairs teams on privacy issues in artist, vendor, technology, platform, licensing, e-commerce, marketing, and other commercial arrangements involving personal data.
Handle day-to-day legal work relating to data subject and consumer privacy rights requests, including evaluating requests and legal requirements, advising on exemptions and response obligations, coordinating with privacy operations and business teams, reviewing and drafting responses, and escalating complex matters.
Support the privacy-law aspects of cybersecurity and data security incidents, including assessing facts and affected data, analyzing notification and regulatory requirements, documenting legal assessments, and drafting or reviewing communications.
Assist with investigations of potential privacy and data security issues by gathering facts, evaluating legal obligations, and coordinating with outside counsel where appropriate.
Advise business and legal teams on privacy requirements affecting websites, applications, digital platforms, artist and fan experiences, e-commerce, advertising, and marketing activities.
Provide practical guidance on online advertising and tracking technologies, marketing communications, consent and preference management, and related privacy and consumer protection requirements.
Advise on compliance with U.S. federal and state privacy laws, GDPR, and other applicable international privacy and data protection requirements.
Support privacy reviews of new business initiatives, technologies, vendors, products, and uses of data, including privacy impact assessments where appropriate.
Assist with third-party privacy and data protection matters, including vendor diligence, data-transfer requirements, privacy questionnaires, and remediation of identified issues.
Help maintain and improve privacy policies, procedures, templates, playbooks, and other resources supporting consistent privacy practices across UMG labels, territories, and business units.
Work with privacy operations, Information Security, and business teams to identify recurring issues and improve processes for contract review, rights requests, incident response, and other recurring privacy matters.
Support responses to regulatory inquiries, audits, and other privacy or data protection matters as needed.
Monitor developments in privacy, data protection, cybersecurity, digital marketing, and consumer protection law and provide practical guidance relevant to UMG businesses.
Provide privacy guidance and training to Legal, business, and operational teams as needed.
Support privacy issues arising from emerging technologies and new uses of data as appropriate.
Collaborate across UMG labels, business units, and territories; handle routine and moderately complex matters independently and escalate novel, sensitive, or significant matters as appropriate.

Benefits

Comprehensive medical, dental, and vision coverage, including 100% coverage for out-patient in-network mental health services.
Fertility coverage for eligible medical plan participants.
Wellbeing reimbursements for fitness classes, spa treatments, meal services, travel, and other expenses, up to $720 per year.
Student Loan Repayment Assistance and Tuition Reimbursement.
401(k) with 100% immediate vesting on the first 5% of contributions, plus an additional UMG contribution.
Flexible Paid Time Off for exempt employees and three weeks of PTO for non-exempt employees.
Two-week paid Winter Break.
Ten Company Holidays, including Juneteenth and Wellbeing Day.
Summer Fridays between Memorial Day and Labor Day.
Generous paid parental leave for every type of parent.