Head of Privacy in London

About Us

the company (formerly TravelPerk) is the intelligent platform for travel and spend management. Built to tackle the time‑saving, manual work that gets in the way of real work, our tools automate everything from travel bookings to expenses, invoice processing, and more. By eliminating this shadow work that wastes hours, erodes morale, and saps innovation, we’re on a mission to power real work, with real impact. We’re trusted by more than 10,000 companies worldwide, including Wise, On Running, Breitling, and Fabletics, and we’re tackling the 7 hours of lost productivity per employee each week, a $1.7 trillion problem. Founded in 2015, the company has grown into a global company of more than 1,800 people across 12 offices globally, with headquarters in London and Boston. We combine innovation, control, and simplicity to transform how businesses work and how people feel at work.

At the company, we’re driven by our values, like being an owner, delivering a 7-star experience, and working as one team. We value curiosity, purpose, and mindset, not just knowledge, to unlock the power in your potential. Our talent team brings together leading minds from the travel and SaaS industries, representing over 70 countries. If you’re excited about having a real impact and shaping how millions of people experience work, we’d love you on the team.

What’s the role?

You’re a leader (or a person looking to lead) with around seven years’ experience developing their specialism in Privacy. You will help to build and scale our customer trust program, and you’ll drive our privacy operations strategy. To help the company win, you will simplify the increasingly complex regulatory landscape of privacy, AI, cybersecurity, and data governance into outcomes that our customers can feel. You will be highly literate in technology to create user‑friendly automated workflows that drive innovation and maintain product development velocity, all while ensuring the best‑in‑class data protection standards our customers and staff expect.

What will your day‑to‑day look like?

This is a “doing” role - with a strong strategic component - where a strong bias to action is critical. You will deliver high‑impact, creative, commercial solutions to improve our privacy posture and scale our privacy program; you will collaborate with and work through teams to keep integrating privacy by design into our products; you’ll also identify and manage the privacy and AI compliance risks that matter most, support key business and product choices, strengthen our culture of privacy, and help other leaders make well‑in‑formed decisions involving the responsible use of data. You will also collaborate closely with the DPO, and build trust continually with the Security, People/HR, Procurement, Product and Engineering, Data, Revenue, and Customer Care teams to ensure alignment on company initiatives involving the processing of personal data. You’ll manage a team of two.

What will the role entail?

• Own and evolve the company’s global privacy program, setting a risk‑based strategy, roadmap, policies and controls aligned with applicable laws, regulatory expectations and customer commitments.
• Contribute to the company’s global AI governance program, working closely with Builders, Security and Legal.
• Advise the CLO, executive team and business leaders on material privacy risks, helping them make practical choices that protect individuals, manage compliance exposure and support the company’s commercial objectives.
• Maintain an accurate view of the company’s personal data and processing activities, including the ROPA, data flows, classification, lawful bases, cross‑border transfer mechanisms and subprocessor transparency.
• Oversee operational privacy controls, including retention and deletion, cookies and tracking, consent and preference management, marketing compliance, privacy notices, and individual rights and complaints (DSR).
• Support data governance protocols, collaborating with the Data, Engineering, and Security teams to acquire the right governance tools.
• Oversee the risk‑based review of new personal data processing initiatives, including PIAs/DPIAs, LIAs, AI inventory and classification, and AI risk and impact assessments. Ensure agreed mitigation actions are tracked through to completion.
• Partner with Security to align on privacy requirements and coordinate the privacy workstream for personal data breaches. Work with AI governance owners on AI incidents, including assessment, escalation, notification and remediation.
• Own privacy risk reporting and assurance, including the privacy risk register, audit‑ready evidence, control testing and meaningful privacy metrics covering material risks, incidents, remediation, patterns, trends and program performance.
• Collaborate with Security, Engineering, and other departments to integrate privacy by design into product development, business operations, and marketing activities, and assist in the implementation and upkeep of privacy‑enhancing technologies (PET).
• Monitor regulatory and enforcement developments across the company’s key jurisdictions, and ensure privacy guidelines, and other knowledge resources are clear, practical, up‑to‑date, and aligned with the latest regulatory updates.
• Create and maintain privacy products and resources, such as our Trust Center, to effectively share privacy knowledge with both internal and external customers.
• Oversee the privacy tooling and automation roadmap, ensuring scalable workflows, reliable data and clear evidence.
• Oversee a risk‑based third‑party privacy program, including due diligence, DPAs, AI‑specific terms, periodic reviews of higher‑risk vendors, and clear remediation and escalation routes.
• Support Revenue and customer‑facing teams on delivering customers’ privacy expectations, due diligence and contractual commitments, helping build trust without creating disproportionate risk.

Where will the role take you?

This role will provide you with exceptional experience of working in a fast scaling, global tech (and specifically SaaS/ fintech) business. You will develop the tools and techniques to deliver internal privacy and AI compliance capability at scale which subverts the expectations of stakeholders regarding law and drives tangible business outcomes - while also reflecting our company’s values of providing seven star service, being ethical and acting responsibly in how we handle personal data.

In terms of promotions, we do not expect to hire “over your head”; instead, we are looking for you to grow and scale capability in your areas of expertise. The company will offer you as much latitude as you want in order to deliver the best possible outcomes for your customers; and micromanagement/ layers of bureaucracy are not part of that process. We are committed to equipping you with the necessary resources to establish a world‑class data privacy culture. Your efforts will contribute to the growth and prominence of your professional profile as a leading expert in the privacy field.

AI Fluency: What We Expect

At the company, AI isn’t a nice‑to‑have - it’s how we work. We expect every lawyer on this team to be curious, capable, and opinionated when it comes to AI.

Specifically, we’re looking for someone who:

• Has genuine curiosity about frontier model capability - you’ll actively follow what’s happening with LLMs, both in terms of their capabilities and risks, and have a view on where they’re heading.
• Is comfortable working in AI tools like Claude as part of their daily practice.
• Has a thoughtful opinion on how the practice of law will evolve - and is excited to be part of shaping that evolution rather than watching it happen.
• Understands (or wants to understand) the regulatory landscape around AI - including the EU AI Act and emerging global frameworks.

You don’t need to be an engineer on day one. But you do need to arrive with curiosity, a willingness to experiment, and the conviction that AI has changed how legal teams operate.

Essentials

In all instances, you must be able to demonstrate:

• AI fluency.
• Experience driving operational outcomes.
• Exceptional storytelling capabilities, as part of an overall package of excellent communication and interpersonal skills, with the ability to communicate and collaborate effectively at all levels of our organisation.
• A willingness to seek growth, in your personal and professional life.
• Experience working with fast‑paced engineering/product development teams.
• Knowledge of global privacy, cybersecurity and AI regulations, such as GDPR, CCPA, EU AI Act, NIS2, DORA, EU Data Act, and other regional laws in those fields.

We encourage curious individuals who possess a genuine passion for learning and growth, even if they do not meet every requirement listed, to apply for this role.

What We Offer

• Receive competitive compensation and equity ownership in the company.
• Rest and recharge with 25 days of annual leave plus bank holidays.
• Take control of your physical health with private medical cover and voluntary dental insurance from Bupa, and discounted gym memberships with GymFlex.
• Plan for your future with our qualifying earnings company pension plan with Aviva.
• Know that your loved ones are protected financially through your Life Insurance if the worst were to happen.
• Rest assured that you’re covered by income protection in case you experience a long‑term sickness or absence.
• Leverage tax‑efficient cycle and electric car schemes with Cycle2Work & Octopus.
• Join our unforgettable the company events, including our spectacular annual summer party.
• Always feel supported with Spring Health, our market‑leading wellbeing partner, providing fast, comprehensive access to 12x therapy and 12x coaching sessions for you and your loved ones.
• Focus on your family with 12-16 weeks’ paid parental leave.
• Contribute to your community with 16 paid hours per year to spend volunteering for your dearest charitable causes.
• Broaden your horizons with up to 20 "Work from Anywhere" days per year.
• Stay savvy with access to a wide variety of discounts and rewards.
• Follow your passions and take a four‑week, fully paid sabbatical once you reach 5 years.
• Let us help you move to one of our hubs with relocation support.

AI at the company

AI is embedded in how we work across every function. The tools you'll use day‑to‑day are AI‑enabled, so you can move faster and spend more time on the work that matters.

We don't expect you to be an AI expert, but we do expect you to be curious and intentional about it. The bar is judgment: knowing when AI makes your work better, when to verify what it produces, and when to rely on your own expertise instead.

How We Work

At the company, we take an IRL‑first approach to work, where our team works together in‑person 3 days a week. As such, this role requires you to be based within commuting distance of our hubs. We fundamentally believe in the value of meeting in real life to improve connectivity, productivity, creativity and ultimately making us a great place to work.

the company is a global company with a diverse customer base, and we want to make sure the people behind our product reflect that. We’re an equal opportunity employer, which means you’re welcome at the company regardless of how you look, where you’re from, or anything else that makes you, well, you.