Privacy Officer

Privacy Officer - Insurance

Where you will work

Our client is a listed specialty insurance group that runs a data-driven risk exchange. Founded in 2018, it connects a selected network of MGAs with the insurers, reinsurers and institutional investors that provide the underwriting capital. The focus is on small and medium-sized businesses and their niche commercial risks, in the US, UK, Canada and Europe. In Europe our client has its own EU-regulated insurance company, authorised to write business across the EEA.

Our client is moving towards an agentic way of working, where AI agents take over a growing part of the work in underwriting, operations and data processing. Personal data passes through a lot of hands in this setup: MGAs, carriers, reinsurers, vendors and group entities in several countries. To keep a grip on that, our client is adding a Privacy Officer to the team.

What you will do

You are the person the business, Legal, Compliance and IT go to when personal data is involved. In practice that means a lot of contract work and assessments, and keeping the privacy framework up to date as our client and its technology change. You work together with our client's DPO and with colleagues in other countries, and you have a real say in how privacy is organised.

Contract reviews

• Review and negotiate data processing agreements, data sharing agreements and the privacy clauses in MGA, vendor and reinsurance contracts.
• Check the roles of the parties (controller, joint controller, processor) and whether the contract matches how the data is actually used.
• Maintain the clause library and fallback positions, so colleagues can handle standard cases without you.

DPIAs & DTIAs

• Carry out DPIAs for new products, systems and AI use cases, including agentic AI where agents process personal data or support decisions.
• Perform transfer impact assessments for data leaving the EEA, for example to the US, the UK and Bermuda, and advise on the transfer mechanism (SCCs, adequacy decisions).
• Follow up on the risks you find with the owners until they are actually resolved.

Policies & controls

• Update the existing privacy policies, procedures and controls, and write the ones that are missing.
• Keep the record of processing activities current.
• Check whether controls are being followed and report gaps to the DPO.
• Support the handling of data breaches, data subject requests and questions from regulators and business partners.

Who you are

• 3 to 5 years of experience as a privacy officer, privacy counsel or in a similar role (must-have). Experience in insurance, financial services or another regulated sector is a plus.
• You have carried out DPIAs and transfer impact assessments yourself and are comfortable reviewing DPAs and SCCs.
• Good working knowledge of the GDPR, and some knowledge of the EU AI Act and how it interacts with the GDPR.
• Fluent English, written and spoken.
• You can explain a legal point to someone who is not a lawyer in a few sentences, and give a clear answer.
• You work independently and are comfortable in a remote team spread across countries.
• A certification such as CIPP/E or CIPM is a plus.

What you can expect

• A salary of up to €90,000 gross per year, depending on your knowledge and experience.
• A yearly bonus of 10%.
• A fully remote role.
• Collective health insurance.
• A pension fund.
• Training and development opportunities.
• Real influence on how privacy is set up while our client introduces AI agents.