GDPR Compliance Consultant

RSI Security•, (Multiple States)

7d•$100 - $125

About The Position

The GDPR Compliance Consultant serves as a trusted advisor responsible for helping organizations achieve and maintain compliance with the European Union General Data Protection Regulation (EU GDPR) and UK GDPR. Working directly with executive leadership, legal counsel, privacy teams, IT, security, HR, and business stakeholders, this consultant conducts privacy assessments, develops compliance programs, prepares required documentation, and implements practical privacy governance processes. The ideal candidate possesses deep knowledge of international privacy regulations, strong consulting experience, and the ability to translate complex legal requirements into actionable business controls.

Requirements

Bachelor's degree in Information Security, Privacy, Law, Business, Computer Science, Healthcare Administration, or a related field (or equivalent professional experience).
Five (5) or more years of GDPR consulting or privacy compliance experience.
Demonstrated experience implementing GDPR compliance programs.
Experience conducting GDPR readiness assessments and gap analyses.
Experience preparing and maintaining ROPA documentation.
Experience performing DPIAs, LIAs, and TIAs.
Experience drafting and reviewing Data Processing Agreements.
Experience developing privacy governance programs.
Experience advising executive leadership and client stakeholders.
Strong working knowledge of EU GDPR
Strong working knowledge of UK GDPR
Strong working knowledge of Records of Processing Activities (ROPA)
Strong working knowledge of Data Protection Impact Assessments (DPIAs)
Strong working knowledge of Legitimate Interest Assessments (LIAs)
Strong working knowledge of Transfer Impact Assessments (TIAs)
Strong working knowledge of Data Subject Rights (DSAR)
Strong working knowledge of Data Processing Agreements (DPAs)
Strong working knowledge of International Data Transfers
Strong working knowledge of EU Standard Contractual Clauses (SCCs)
Strong working knowledge of UK IDTA/Addendum
Strong working knowledge of EU-U.S. Data Privacy Framework
Strong working knowledge of Vendor Risk Management
Strong working knowledge of Privacy by Design
Strong working knowledge of Privacy Governance Frameworks
Strong working knowledge of Article 27 Representative Requirements
Strong working knowledge of Consent Management
Strong working knowledge of Privacy Notices
Strong working knowledge of Data Mapping
Strong working knowledge of Data Retention
Strong working knowledge of Special Category Data Processing
Excellent written and verbal communication skills.
Ability to work directly with executive-level clients.

Nice To Haves

Experience supporting multinational organizations is preferred.
Previous consulting experience strongly preferred.
Experience supporting organizations within one or more of the following industries is highly desirable: Healthcare, Life Sciences, Biotechnology, Clinical Research, Pharmaceutical, Medical Device, SaaS, Technology.
Knowledge of ICH-GCP is preferred.
Knowledge of Clinical Trial Regulations is preferred.
Knowledge of Informed Consent Requirements is preferred.
Knowledge of HIPAA is preferred.
Knowledge of Processing of Special Category Health Data is preferred.
One or more of the following certifications is preferred: CIPP/E, CIPM, CIPT, ISO/IEC 27701 Lead Implementer, ISO/IEC 27701 Lead Auditor, ISO/IEC 27001 Lead Implementer, ISO/IEC 27001 Lead Auditor, Equivalent IAPP Privacy Certification.

Responsibilities

Conduct GDPR and UK GDPR readiness assessments and gap analyses.
Develop and implement GDPR compliance programs and remediation roadmaps.
Prepare and maintain Records of Processing Activities (ROPA).
Perform Data Protection Impact Assessments (DPIAs), Legitimate Interest Assessments (LIAs), and Transfer Impact Assessments (TIAs).
Draft, review, and negotiate Data Processing Agreements (DPAs).
Review privacy notices, consent mechanisms, cookie disclosures, and privacy documentation.
Design and implement Data Subject Rights (DSAR) processes.
Advise clients on international data transfer requirements including EU Standard Contractual Clauses (SCCs), UK IDTA/Addendum, and the EU-U.S. Data Privacy Framework.
Assess third-party privacy risks and support vendor due diligence activities.
Develop privacy policies, governance documentation, and operational procedures.
Support organizations processing special category data, including healthcare and clinical research information.
Provide guidance regarding Article 27 representative requirements and supervisory authority interactions.
Deliver client workshops, executive presentations, and privacy awareness training.
Collaborate with cybersecurity consultants to align privacy and security controls.
Remain current on GDPR guidance, enforcement actions, and evolving privacy regulations.