Data & Privacy Attorney

A growing law firm is seeking a seasoned Privacy Attorney to join its team and further expand its privacy and data protection practice. The ideal candidate will bring deep subject matter expertise in data privacy and security regulations, along with a small portable book of business and the ability to counsel sophisticated clients on complex and evolving regulatory issues.

This practice advises clients across diverse industries, including healthcare, financial services, SaaS providers, and consumer-facing businesses. Matters often involve both regulatory compliance and litigation, including government investigations, breach response, and disputes concerning mishandled data and trade secrets.

Representative areas of work include:

• Data privacy compliance tailored to industry-specific needs, including healthcare, financial services, and technology
• Advising on advertising, marketing, and SaaS/subscription services
• Government contracting data rights and markings
• CAN-SPAM compliance for marketing practices
• Payment Card Industry (PCI) standards for credit card data
• Gramm-Leach-Bliley Act (GLB) compliance for financial institutions
• HIPAA guidance for healthcare providers
• FTC investigations and enforcement actions
• EU General Data Protection Regulation (GDPR)
• Consumer opt-out, privacy rights, and right-to-be-forgotten requests
• Data breach reporting, incident response, and recordkeeping obligations

Ideal Candidate Profile:

• Minimum of 7+ years of experience in privacy and data security law
• Demonstrated expertise advising clients on U.S. and international privacy frameworks
• Experience handling investigations, compliance, and litigation matters related to data privacy and security
• A portable book of business (small to mid-sized) to complement an established practice
• Strong client management and business development skills

This role offers the opportunity to integrate into a growing practice, collaborate with a diverse client base, and play a key role in shaping the direction of a firm's privacy and data protection offering.