Privacy Counsel

Nova Biomedical • Waltham, MA

1d • Hybrid

About The Position

Nova Biomedical is seeking a Privacy Counsel to provide legal oversight, risk assessment, and strategic guidance on privacy, data protection, and data-management matters across the company and its subsidiaries. The role supports compliance with applicable U.S. and global privacy laws by developing and implementing policies and procedures, reviewing contracts, conducting training, and advising business and technology teams on privacy and data-protection risks. It works closely with Governance, Risk and Compliance, Information Technology, Information Security, Legal, and business functions. In partnership with the Vice President of Governance, Risk and Compliance, the Privacy Counsel will develop short- and long-term plans to manage privacy-related legal matters and reduce business risk. A near-term priority is operationalizing and maturing the global privacy program following Nova Biomedical’s combination with Advanced Instruments.

The Privacy Counsel will lead and develop enterprise-wide privacy processes, including data-subject-rights request handling, privacy notices, consumer health-data compliance, cookie governance, data retention and destruction, impact assessments, vendor due diligence, breach response, and privacy documentation. The role also supports privacy matters associated with commercial agreements, healthcare-industry requirements, and strategic transactions, including mergers and acquisitions.

The position is hybrid in Waltham, Massachusetts, with work scheduled Monday through Thursday. The targeted annual salary range is $175,000 to $215,000; actual compensation may vary based on experience and individual factors.

Requirements

• Juris Doctor degree from an accredited law school.
• Active membership in good standing with a U.S. state bar.
• At least eight years of relevant legal experience in a law firm, corporate legal department, or comparable environment.
• Extensive knowledge of global privacy, data-protection, data-management, and cybersecurity laws and regulations.
• In-depth knowledge of the General Data Protection Regulation and applicable U.S. federal and state privacy laws.
• Practical experience developing, operationalizing, and maturing global privacy programs.
• Experience managing Records of Processing Activities, data-subject-rights requests, breach response, impact assessments, retention schedules, cookie and consent management, vendor privacy reviews, and Data Processing Agreements.
• Experience drafting, reviewing, and negotiating privacy notices, Data Processing Agreements, data-transfer agreements, Business Associate Agreements, and related privacy documentation.
• Experience translating privacy requirements into practical business processes.
• Experience advising on privacy issues involving products, technology, security, data management, digital platforms, vendors, and business initiatives.
• Experience partnering with IT, Information Security, Governance, Risk and Compliance, and business teams.
• Experience identifying, assessing, documenting, and escalating privacy and data-protection risks.
• Strong understanding of enterprise risk-management principles and practices.
• Ability to evaluate privacy incidents and guide personal data-breach response and notification decisions.
• Experience working with international organizations and addressing differences in legal requirements, business practices, and approaches across jurisdictions.
• Ability to balance legal rigor and regulatory compliance with business agility and practical operational needs.
• Strong business acumen and understanding of legal processes supporting a growing global organization.
• Strong leadership, collaboration, negotiation, and influencing skills.
• Excellent written and verbal communication skills, including policy drafting, legal analysis, presentations, training, and stakeholder communications.
• Ability to build relationships and collaborate with employees, executives, outside counsel, regulators, vendors, and other external stakeholders.
• Strong change-leadership skills and ability to assess complex challenges, develop practical plans, and implement effective solutions.
• Strong analytical, research, organizational, and problem-solving skills.
• Ability to manage multiple legal matters, privacy initiatives, deadlines, and stakeholder priorities.
• High level of judgment, professionalism, discretion, and integrity.
• Proficiency with standard business and legal technology, including word-processing, spreadsheet, database, presentation, and internet-based software.
• Comfort working at a computer for extended periods.
• Ability to lift and carry up to 25–50 pounds as required.
• Ability to communicate effectively by phone, video, and in writing.
• Occasional ability to move about the office to access meetings or resources.

Nice To Haves

• Admission to the Massachusetts Bar.
• Experience supporting commercial contracting, compliance programs, mergers and acquisitions, healthcare-industry matters, and strategic transactions.
• Certified Information Privacy Professional certification or a comparable privacy credential.
• Demonstrated thought leadership in privacy and data-protection law.

Responsibilities

• Provide legal oversight and strategic guidance for privacy, data-management, and information-security programs in accordance with applicable U.S. and global laws.
• Advise business, technology, and legal stakeholders on privacy, data protection, security, and compliance matters.
• Interpret and apply the General Data Protection Regulation and applicable U.S. federal and state privacy laws.
• Implement, maintain, and enforce privacy policies, procedures, data-protection agreements, and related legal documentation; ensure they reflect evolving requirements and relevant industry practices.
• Draft, review, negotiate, and manage Records of Processing Activities, Data Protection Impact Assessments, Privacy Impact Assessments, privacy notices, Data Processing Agreements, data-transfer agreements, Business Associate Agreements, and Inter-Affiliate Data Transfer Agreements.
• Analyze products, services, technologies, projects, and business initiatives for privacy risks; conduct impact assessments and recommend mitigations.
• Develop and deliver role-based, new-hire, and annual privacy training, and maintain completion records.
• Identify, assess, document, and escalate material privacy and data-protection risks; contribute to risk assessments, registers, executive reporting, and governance activities.
• Coordinate privacy and information-security matters across IT, Information Security, Legal, Governance, Risk and Compliance, and business functions.
• Monitor legal and regulatory changes, assess their impact, and communicate developments to Nova Biomedical.
• Collaborate with global teams, particularly EU stakeholders, to promote consistent privacy practices and risk mitigation.
• Research complex privacy matters and provide practical legal advice and recommendations.
• Serve as the primary legal point of contact for personal data breaches; lead the legal aspects of the breach process and coordinate with IT, Information Security, and other stakeholders.
• Establish breach-determination criteria, jurisdiction-specific notification requirements, escalation paths, responsibilities, and a centralized breach register.
• Serve as the primary interface with the Data Protection Officer and support interactions with regulators and outside counsel when required.
• Provide privacy-related legal support for strategic transactions, including privacy due diligence and integration for mergers and acquisitions.
• Provide legal guidance on commercial agreements, compliance programs, and healthcare-industry requirements as needed.
• Own and operationalize an enterprise-wide data-subject-rights program covering request intake, response procedures, documentation, and centralized tracking for applicable rights and opt-outs.
• Develop and maintain external privacy notices, a U.S. employee privacy notice, and streamlined website and California privacy policies with defined ownership and review cycles.
• Bring applicable consumer-facing channels into compliance with consumer health-data laws; develop and publish a standalone Consumer Health Data Privacy Policy where required and establish appropriate consent processes.
• Establish recurring cookie-governance processes, periodic scanning and inventory practices, and region-appropriate consent configurations across web properties.
• Implement required Do Not Sell or Share mechanisms and recognition of Global Privacy Control signals.
• Establish, publish, and enforce a centralized data-retention and destruction policy and schedule, including retention periods, legal or business bases, deletion and anonymization protocols, and legal-hold exceptions; align these with processing records and privacy notices.
• Develop operational privacy procedures and standard operating procedures across applicable jurisdictions.
• Build a Data Protection Impact Assessment and Privacy Impact Assessment framework, including triggers, templates, ownership, review processes, and workflows; integrate assessments into project planning, product development, procurement, and vendor onboarding.
• Establish documented vendor privacy due-diligence procedures, develop standardized Data Processing Agreement templates, and maintain a centralized agreement register.
• Review and update the Inter-Affiliate Data Transfer Agreement.
• Establish governance, documentation, metrics, and reporting to measure the maturity and effectiveness of the global privacy program.

Benefits

• Flexible medical, dental, and vision coverage.
• Competitive 401(k) company match.
• Bonus program.
• Generous paid time off and paid holidays.
• Tuition reimbursement.
• Hybrid and flexible work arrangements.
• Professional development, engagement, and events.
• Company marketplace for lunch and snacks at the Norwood, Billerica, and Westbrook offices.
• Company-subsidized cafeteria at the Waltham office.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: Ph.D. or professional degree