The Senior Director, Data Privacy is a newly created, attorney-held role responsible for building and personally owning Savara's global data privacy program across GDPR, UK GDPR, and the U.S. federal and state privacy landscape (including CCPA/CPRA, HIPAA, and comparable state consumer health and comprehensive privacy laws). Reporting to the Chief Legal Officer, this individual will serve as Savara's substantive privacy counsel and program owner, working hand-in-hand with the Data Protection Officer, IT, Clinical Operations, Pharmacovigilance, Patient Advocacy, HR, Finance, and Commercial to design, implement, and maintain the governance, documentation, and controls needed to meet Savara's obligations as it scales from a clinical-stage to a commercial-stage biopharmaceutical company.
This role will be accountable for building forward-looking privacy infrastructure to support the U.S. commercial launch of molgramostim, including HCP and patient-facing digital properties, hub and patient-support services, and healthcare-professional transparency reporting. The Senior Director, Data Privacy will be the central point of accountability so that privacy risk is identified and addressed proactively.
Responsibilities
- Own and mature Savara's global privacy program, serving as the primary in-house legal advisor on GDPR, UK GDPR, and applicable U.S. federal and state privacy laws, and as the escalation point for privacy questions raised by any function.
- Oversee and conduct enterprise-wide Data Protection Impact Assessments (DPIAs), partner with the external Data Protection Officer to build and maintain Records of Processing Activities (ROPAs) across all functional areas, and support audits and regulatory requests.
- Draft, implement, and periodically refresh Savara's core privacy policies and procedures, ensuring internal consistency (e.g., aligned breach-notification timelines) and alignment with current law.
- Own the end-to-end data subject/consumer rights program (access, rectification, erasure, restriction, portability, opt-out, and 'limit the use of sensitive personal information' requests), including intake channels, identity verification, statutory deadline tracking, and coordination with processors and vendors.
- Build and maintain a vendor privacy compliance program: a central vendor register, a risk-based due diligence and questionnaire process, and a Data Processing Agreement (and, where applicable, Business Associate Agreement) portfolio with all critical and non-critical processors, prioritizing vendors that process special-category or patient data.
- Review and negotiate privacy and data protection terms in contracts, including data processing agreements (DPAs), clinical trial agreements, master services agreements, vendor agreements, standard contractual clauses (SCCs), and related provisions, and ensure consistent and appropriate privacy language across all contractual forms and third-party engagements
- Evaluate and document controller, joint-controller, and processor relationships across Savara's business (HR employer-of-record arrangements, clinical trial sites and CROs, patient advocacy and expanded access partners, and commercial media/analytics partners) and put in place Article 26-compliant joint-controller arrangements where needed.
- Map Savara's cross-border data transfer flows and implement appropriate transfer mechanisms (Standard Contractual Clauses, UK IDTA/Addendum, or successor mechanisms), including Transfer Impact Assessments and supplementary measures where required, and lead remediation of any legacy or outdated transfer documentation.
- Serve as the business owner for Savara's incident and breach response program, ensuring a single, internally consistent breach-notification procedure that meets GDPR/UK GDPR, HIPAA, FTC, and applicable state-law timelines, and personally leading or co-leading breach investigations and regulator/notification decisions.
- Advise Clinical Operations and Pharmacovigilance on privacy aspects of sponsored trials, expanded access/named-patient programs, and safety data flows, including legal basis, informed consent form privacy language, investigator and site-staff transparency notices, and vendor/CRO data flows.
- Advise Commercial, Marketing, and Patient Services on privacy-by-design for HCP and patient-facing digital properties, hub and patient-support programs, CRM/analytics platforms, and any real-world-data or de-identification initiatives, including cookie consent, ad-tech governance, and state consumer health data laws.
- Own Savara's readiness for HCP transfers-of-value reporting (Sunshine Act/Open Payments) from a privacy perspective, working with Finance, Compliance, and Commercial to ensure appropriate notices and data-handling practices are in place ahead of go-live.
- Design and roll out a role-based data protection training and awareness program for all employees and contractors aligned with compliance initiatives, with tailored modules as needed, and track completion.
- Coordinate with IT/the Managed Service Provider on privacy-relevant security controls (access management, encryption, data classification, and vendor contracts) to ensure technical and organizational measures are documented and defensible.
- Track and advise on emerging and evolving privacy obligations relevant to Savara's operations, including new U.S. state privacy laws, evolving FTC and state enforcement priorities, and cross-border transfer developments, and periodically refresh Savara's data protection gap analysis and the associated remediation roadmap.
- Prepare periodic privacy program metrics and status updates (open data subject requests, breach notifications, vendor compliance status, training completion, DPIA/ROPA coverage) for the Chief Legal Officer and, as appropriate, the Audit Committee of the Board of Directors.
- Promote a culture of privacy, ethics, and accountability across all geographies.
- Manage contractors, vendors, and/or outside counsel engaged to support the privacy program.
- Other duties and projects as assigned.
Required Qualifications
- Juris Doctor (JD) from an accredited law school.
- Admission to a state bar and active license to practice law.
- Minimum of 8 years of relevant legal experience, with substantial hands-on experience building or operating a privacy program, preferably in-house at a life sciences, pharmaceutical, or biotechnology company, or in a law firm or consultancy advising such companies.
- Deep working knowledge of GDPR and UK GDPR, including practical experience with Records of Processing Activities, DPIAs, cross-border transfer mechanisms, and data subject rights programs.
- Strong working knowledge of the U.S. privacy landscape applicable to biopharmaceutical companies, including HIPAA, the FTC Act and Health Breach Notification Rule, and state comprehensive and consumer-health privacy laws (e.g., CCPA/CPRA, Washington MHMDA, Connecticut CTDPA, Nevada SB 370).
- Familiarity with clinical trial and pharmacovigilance data flows and applicable regulatory frameworks (ICH-GCP, EU Clinical Trials Regulation, FDA regulations), and with life sciences transparency reporting (Sunshine Act/Open Payments).
- Privacy certification(s) such as CIPP/E and/or CIPP/US strongly preferred.
- Demonstrated ability to translate legal requirements into practical, risk-based operational programs and to drive cross-functional remediation work to completion, rather than only identifying gaps.
- Excellent verbal and written communication skills, with the ability to communicate clearly and persuasively with both technical and non-technical stakeholders and with professionals outside the organization.
- Strong project-management skills, with the ability to build and drive a multi-year remediation roadmap and to prioritize across competing demands.
- Proactive, self-directed, and comfortable operating with a high degree of ownership and minimal supervision in a lean, fast-moving organization.
- Excellent professional judgment, high level of integrity and trustworthiness, and the ability to build collaborative working relationships across all levels of the organization.
- Adaptable and able to pivot to meet changing business needs as Savara transitions from clinical-stage to commercial-stage operations.
Location and Travel
- This role is remote within the US and requires availability to work US Eastern Time Zone.
- Periodic overnight travel within the U.S. is required, including to corporate headquarters in Yardley, PA.
- Occasional international travel may be required to support engagement with Savara ApS (Denmark) and EU/UK stakeholders.
