Privacy & AI Counsel in London

The Privacy & AI Counsel is a senior expert role responsible for designing, implementing, and independently operating Forward Air's global privacy and data governance program, with a strong emphasis on GDPR, U.S. state privacy laws, HIPAA, and emerging international regimes. This role serves as the principal subject-matter expert on data privacy, data protection, and AI-related legal and compliance risks. The position is structured as a hands-on, individual contributor role that requires deep technical and legal fluency, sound judgment, and the ability to operate autonomously while influencing across Legal, IT, Security, HR, and Operations.

Key Responsibilities

• Design, implement, and continuously mature Forward Air's company-wide privacy and data protection program aligned with GDPR, CCPA/CPRA, HIPAA, and emerging global privacy regulations.
• Own the development and maintenance of privacy governance elements, including policies, standards, SOPs, records of processing activities, and internal guidance.
• Independently lead privacy risk assessments, including DPIAs, TIAs, data mapping exercises, DSAR/DSR workflows, and third-party privacy reviews using scalable, programmatic approaches.
• Identify, assess, and mitigate privacy and AI-related risks associated with data flows, analytics, automation, AI-enabled systems, vendors, and cross-border data transfers.
• Advise on responsible AI, automated decision-making, and advanced analytics, translating regulatory and ethical expectations into practical, operational controls.
• Partner with IT, Security, Engineering, HR, Procurement, and business teams to embed privacy-by-design and data minimisation principles into systems, workflows, and product lifecycles.
• Define and mature technical and operational privacy controls covering data retention, access management, consent, classification, and third-party integrations.
• Serve as the primary privacy compliance lead for regulatory inquiries, audits, and certifications (e.g., SOC 2 Privacy, ISO 27701, HIPAA-related reviews), ensuring audit readiness and timely responses.
• Collaborate with Internal Audit, Compliance, and Security to assess control effectiveness, remediate gaps, and track privacy program maturity and risk trends.
• Provide expert legal and compliance guidance on privacy incident preparedness and response, including breach notification considerations and regulatory engagement.
• Act as a trusted advisor to senior leadership on evolving privacy, AI, and data governance risks, translating regulatory developments into actionable business guidance.
• Build and deliver targeted privacy and AI-related training and awareness programs for employees and relevant third parties to promote a culture of ethical data use and accountability.
• Define and implement scalable monitoring, reporting, and evidence-collection mechanisms leveraging privacy and GRC tools, dashboards, and automation.
• Maintain continuous awareness of global regulatory developments, enforcement trends, and emerging risks, proactively advising on their impact on Forward Air's operations.
• Support adjacent compliance and regulatory initiatives as needed, demonstrating flexibility and the ability to pivot in response to evolving business and risk priorities.

Qualifications

• 10+ years of relevant experience in privacy, data protection, compliance, legal, or regulatory advisory roles.
• Deep, hands-on expertise in GDPR, California privacy laws (CCPA/CPRA), HIPAA, and comparable global privacy frameworks.
• Strong understanding of how privacy requirements translate into technical and operational controls, including data flows, access management, retention, and third-party integrations.
• Willingness to travel occasionally as business needs require.
• Privacy or compliance certifications such as CIPP, CIPM, CIPP/E, CCEP, CISA, CISM, or CRISC.
• Experience with GRC and privacy tooling (e.g., OneTrust).
• Exposure to AI, machine learning, automation, or advanced analytics from a governance or risk perspective.
• Background working in regulated, global, or highly data-driven environments.

Skills

• Proven ability to build and operate privacy programs independently, without reliance on large teams.
• Demonstrated ability to identify, prioritise, and resolve complex legal and compliance issues in real time.
• Exceptional judgment, discretion, and integrity when handling sensitive and confidential information.
• Excellent written and verbal communication skills, with the ability to influence across technical and non-technical audiences.
• Self-starter mindset with strong execution discipline, organisational rigor, and comfort operating in ambiguity.