Director, Privacy Operations R&D and CPO

Role Purpose

The Privacy Operations Director will serve as a key role in coordinating daily activities in the evolving role of data and AIML at GSK.

Working in partnership with R&D Privacy Leaders, Legal, the Data Protection Office, Information Security, Data Governance, business process owners, and external stakeholders, the Privacy Operations Director will help ensure personal data is managed responsibly, ethically, and in accordance with GSK privacy policy, procedures and principles as well as applicable regulatory requirements.

This highly collaborative role requires strong influencing skills, sound judgment, and the ability to translate privacy principles into practical, risk-based solutions that enable scientific innovation while maintaining patient and participant trust.

Key Responsibilities

Privacy Leadership & Advisory

• Support the R&D and CPO privacy strategy and contribute to the continued advancement of privacy-by-design principles across research and patient-focused activities.
• Provide privacy guidance and subject matter expertise to cross-functional teams involved in clinical research, real-world evidence, scientific research, digital health, AI-enabled initiatives, and patient engagement activities.
• Partner with business leaders to identify privacy considerations in data use and reuse, and in system build and development.
• Promote a culture of responsible data use and privacy awareness across R&D and CPO.

Privacy as Code & Governance Engineering

• Operationalise privacy requirements as a core governance product that underpins R&D and CPO digital transformation, grounded in regulatory rigor (UK/EU GDPR, HIPAA, GxP) and designed for usability and scale.
• Translate privacy policy into machine-readable, enforceable controls — consent and lawful-basis logic, purpose limitation, retention and deletion rules, pseudonymisation and access constraints — embedded directly into platforms, pipelines, and data products rather than documented alongside them.
• Modernise privacy delivery by codifying privacy-by-design into engineering workflows and decision points: privacy requirements as reusable patterns in system build, automated checks at data ingestion and model training, and privacy gates in the AI/ML lifecycle.
• Partner with Tech, Data Governance, and AI/ML engineering teams to ensure privacy controls are testable, auditable, and adopted by default, so teams move faster while remaining compliant and ethical by design.
• Measure and communicate effectiveness, defining metrics for control coverage, automation rates, and residual privacy risk, and translating privacy outcomes into business value.

Compliance & Regulatory Support

• Advise teams and support data governance activities on the use and reuse of human biological samples and other sensitive research data.
• Support implementation of privacy requirements in relation to systems and data use under UK GDPR, EU GDPR, US Data Protect and cross boarder data transfer and other relevant global privacy requirements applicable to highly regulated R&D data environments.
• Support initiatives to help ensure data is accessible to support innovation, balancing individual rights and ethical requirements.
• Coordinate data gathering exercises in relation to individual rights requests in accordance with required timelines.
• Support due diligence activities, ensuring that privacy considerations are embedded into the development and purchase of new systems and services.
• Provide privacy and data governance expertise into the review of new and innovative uses of personal data in AI/ML initiatives.
• Monitor proper use of data across the R&D and CPO organization, including cross border data transfers.

Stakeholder Engagement & Capability Building

• Build strong partnerships across R&D, CPO, the R&D/CPO Privacy Lead, Legal, Information Security, Risk, Compliance, and external partners.
• Collaborate with stakeholders at all levels through clear communication and practical problem solving.

• Support, with the Privacy Lead, privacy capability development across the organization through coaching, education, and knowledge sharing.

Basic Qualifications

• Bachelor's degree in Information Governance, Privacy, Computer Science, Life Sciences, or related discipline; or equivalent experience.

• Significant experience in information governance, AI Governance, and privacy operations related disciplines.

• Hand-on experience in genetic/genomic research and pharmacogenomics (PGx).

• Experience of managing operational privacy programmes, including data subject requests (IRRs), third party due diligence, and system privacy monitoring.

• Demonstrated experience operationalising privacy or data governance requirements as code, translating regulatory and policy requirements into automated, enforceable controls embedded in platforms, pipelines, or data products.

• Working knowledge of privacy principles applicable to highly regulated environments.

• Experience influencing stakeholders across a complex matrix organization.

• Strong written, verbal, and presentation skills with the ability to explain complex concepts to non-specialist audiences.

Preferred Qualifications

• Professional privacy certification such as CIPP/E, CIPM, CIPT, or equivalent.
• Experience in AI governance, responsible AI, and machine learning operations (e.g., AI ethics programs, LLMOps/MLOps certificates) strongly preferred.
• Familiarity with privacy-enhancing technologies (pseudonymisation, de-identification, differential privacy, federated analytics) and with governance tooling for automated policy enforcement.
• Experience within R&D pharmaceutical, biotechnology, healthcare, clinical research, or other regulated industries.
• Experience supporting AI, advanced analytics, digital health, or innovative data-driven initiatives.
• Knowledge of governance processes related to clinical trials, real-world evidence, and human biological samples.
• Experience managing data subject/individual rights requests and supporting incident management.

#LI-GSK*

Skills

Business Risk Management, Cross-Functional Leadership, Digital Fluency, Flexible Mindset, Patient Impact

Why GSK?

Uniting science, technology and talent to get ahead of disease together.

GSK is a global biopharma company with a purpose to unite science, technology and talent to get ahead of disease together. We aim to positively impact the health of 2.5 billion people by the end of the decade, as a successful, growing company where people can thrive.

We get ahead of disease by preventing and treating it with innovation in specialty medicines and vaccines. We focus on four therapeutic areas: respiratory, immunology and inflammation; oncology; HIV; and infectious diseases – to impact health at scale.

People and patients around the world count on the medicines and vaccines we make, so we’re committed to creating an environment where our people can thrive and focus on what matters most. Our culture of being ambitious for patients, accountable for impact and doing the right thing is the foundation for how, together, we deliver for patients, shareholders and our people.

GSK is an Equal Opportunity Employer. This ensures that all qualified applicants will receive equal consideration for employment without regard to race, color, religion, sex (including pregnancy, gender identity, and sexual orientation), parental status, national origin, age, disability, genetic information (including family medical history), military service or any basis prohibited under federal, state or local law.

We believe in an agile working culture for all our roles. If flexibility is important to you, we encourage you to explore with our hiring team what the opportunities are.

Please note should your enquiry not relate to adjustments, we will not be able to support you through these channels. However, we have created a Recruitment FAQ guide. Click the Link where you will find answers to multiple questions we receive

Important notice to Employment businesses/ Agencies

GSK does not accept referrals from employment businesses and/or employment agencies in respect of the vacancies posted on this site. All employment businesses/agencies are required to contact GSK's commercial and general procurement/human resources department to obtain prior written authorization before referring any candidates to GSK. The obtaining of prior written authorization is a condition precedent to any agreement (verbal or written) between the employment business/ agency and GSK. In the absence of such written authorization being obtained any actions undertaken by the employment business/agency shall be deemed to have been performed without the consent or contractual agreement of GSK. GSK shall therefore not be liable for any fees arising from such actions or any fees arising from any referrals by employment businesses/agencies in respect of the vacancies posted on this site.

Please note that if you are a US Licensed Healthcare Professional or Healthcare Professional as defined by the laws of the state issuing your license, GSK may be required to capture and report expenses GSK incurs, on your behalf, in the event you are afforded an interview for employment. This capture of applicable transfers of value is necessary to ensure GSK’s compliance to all federal and state US Transparency requirements. For more information, please visit the Centers for Medicare and Medicaid Services (CMS) website at