About the position

The Data Trust Office is an enablement-first function. We believe in embedding data and privacy into our products and services to build customer loyalty and trust, which ensures compliance by default. In this role, you will be supporting the delivery and ongoing maturity of data and privacy advisory services, providing strategic direction, senior oversight, and practical guidance to support Loblaw and its subsidiaries. This role reports to the Director, Data & Privacy.

Responsibilities

• Lead the implementation and ongoing maturity of enterprise data and privacy program components (e.g. data privacy assessments, vendor assessments, contract reviews, advisory consults, reporting, and program governance) in a way that is fit for purpose for our health businesses.
• Perform risk assessments and provide recommendations regarding data and privacy controls, applying sound judgement, design-thinking, and a practical balance between business enablement and compliance.
• Drive innovation and enterprise strategy to build data governance and privacy into the agile technology development lifecycle and culture at Loblaw and its subsidiaries.
• Lead the optimization and evolution of data and privacy processes, standards, tools, and guidance based on changes to privacy laws, industry standards, business objectives, and emerging privacy risks.
• Manage and deliver data and privacy training and awareness across Loblaw and its subsidiaries to strengthen privacy culture and accountability.
• Oversee third party data and privacy risk management activities, including reviewing and advising on agreements and statements of work, conducting vendor risk assessments, and providing senior escalation support on complex matters.
• Establish and produce periodic metrics and reporting, providing insights into program performance, key risks, trends, compliance status, and areas for continuous improvement for senior management and governance forums.
• Provide senior support on privacy incidents and inquiries, including access requests and complaints, supporting investigation, risk assessment, escalation, remediation, and timely and accurate responses in accordance with applicable privacy laws, regulations, and policies.
• Partner with Legal, Information Security, Risk, Compliance, Technology, Product, and business stakeholders to provide integrated, business-oriented data and privacy advice.
• Provide guidance, coaching, and quality review to team members and stakeholders to promote consistent, scalable, and practical data and privacy advisory outcomes.

Requirements

• Significant experience applying privacy laws and principles, including Privacy by Design, in complex business and technology environments.
• Privacy experience within a complex healthcare environment, and knowledge of Canadian health privacy laws is preferred.
• Demonstrated ability to provide strategic advice, exercise sound judgement, and independently manage and escalate complex privacy, data governance, and business issues.
• A self-starter who is proactive, takes initiative, and consistently drives complex projects and program priorities forward with minimal supervision.
• Strong ability to grasp complex and ambiguous problems and distill them into clear, practical, and scalable requirements, recommendations, and decision points.
• Collaborative and influential leader who can build trusted relationships, negotiate effectively, constructively challenge assumptions, and achieve practical, balanced outcomes across multi-stakeholder groups.
• Experience embedding privacy requirements through technical delivery programs, including through policy development, training and education, advocacy, and scalable privacy-by-design practices.
• Strong interpersonal, communication, organizational, facilitation, and presentation skills, including the ability to present succinctly and effectively to senior leaders and varying levels of management.

Nice-to-haves

• International Association of Privacy Professionals (IAPP) certification (i.e. CIPP/C or equivalent certification) preferred.
• Experience in corporate retail, digital health, or other direct-to-consumer industries is also an asset.
• Experience developing or improving privacy and data governance processes, playbooks, standards, controls, metrics, or reporting is an asset.
• Experience working in data governance, information security, risk management, compliance, technology, or digital product environments is an asset.

Benefits

• progressive careers
• comprehensive training
• flexibility
• competitive benefits