Junior Legal Counsel – (Privacy & Data Protection)
Location: Hybrid – Swindon (Wiltshire) or Paddington (London)
Salary: Up to £94,000
About Edenred PayTech
Edenred PayTech is part of the global Edenred group and a leader in prepaid and payment solutions, including virtual cards, debit/credit processing and banking services. We combine strong governance with fast‑paced product development to deliver secure, compliant payment experiences at scale. You will join a pragmatic, cross‑functional legal team that partners closely with Product, Engineering, Security and Commercial teams to embed privacy‑by‑design and prepare the business for emerging regulation such as the EU AI Act.
Role overview
We are recruiting a Junior Legal Counsel to support GDPR and global privacy obligations, data governance and emerging AI regulation. You will provide hands‑on operational privacy support, draft and maintain privacy documentation, lead DPIAs and data subject rights processes, and help translate regulatory developments into practical controls and guidance for product teams.
Key responsibilities (expanded & actionable)
- Lead and advise on DPIAs / Data Protection Impact Assessments: draft, coordinate stakeholders, document mitigation measures and track remediation to completion.
- Manage Data Subject Access Requests and other data subject rights end‑to‑end: triage, evidence collection, redaction checks, timing and communications.
- Draft, negotiate and manage privacy/legal documentation: Data Processing Agreements (DPAs), Standard Contractual Clauses (SCCs), vendor assessments, and AI‑specific clauses.
- Maintain and improve records of processing activities (ROPA) and data inventories; perform regular data mapping and classification exercises.
- Support incident and breach response: evidence gathering, breach assessment under GDPR/UK GDPR, draft notifications and support regulator/subject communications.
- Translate legal/regulatory change (GDPR, ePrivacy, EU AI Act, guidance) into practical internal policies, playbooks and product‑level guidance.
- Provide day‑to‑day operational legal support to Product, Engineering, Security and Commercial teams: pragmatic risk assessments, lawful basis reviews, and privacy‑by‑design advice.
- Collaborate with the DPO(s) and regional stakeholders to ensure consistent global approaches and support audits and regulatory inquiries.
- Develop and deliver privacy awareness and training for non‑legal stakeholders and support adoption of privacy controls and processes.
- Assist with governance and audit readiness for internal and third‑party reviews.
Essential experience & qualifications (expanded)
- Law degree (UK or European institution). Solicitor or equivalent legal qualification preferred.
- Practical experience in roles with substantial data protection responsibilities (e.g., law firm privacy practice, in‑house legal privacy role, regulator).
- Certification in data protection/privacy (CIPP/E or equivalent) and/or demonstrable experience in technology/new‑law matters.
- Strong, practical working knowledge of GDPR/UK GDPR and experience applying data protection law to product development and operations.
- Experience conducting DPIAs, maintaining ROPA, managing DSARs, drafting DPAs/SCCs and advising on cross‑border transfers.
- Comfortable advising technical teams—able to translate legal risk into concrete engineering or product mitigations.
- Excellent written and verbal communication skills and strong stakeholder management.
- High integrity, collaborative approach and commitment to responsible data use.
- Experience in payments, fintech or regulated financial services (understanding of payment data flows, PCI‑DSS context is a plus).
- Familiarity with the EU AI Act, AI governance frameworks, or practical experience reviewing ML/AI models for privacy risks.
#J-18808-Ljbffr…