Job Description
Thomson Reuters is seeking an experienced, commercially minded, and people-focused Assistant General Counsel - Group Data Protection Officer to join our Legal & Privacy function. Reporting directly to the Chief Privacy Officer, this senior leadership role will be integral to advancing Thomson Reuters' global privacy strategy, leading a geographically distributed team of privacy lawyers, and ensuring robust data protection and cybersecurity legal compliance across our worldwide operations.
This is a unique opportunity for a privacy leader who thrives at the intersection of law, technology, and global regulatory complexity — someone who can inspire and develop a high-performing team while shaping strategy and delivering practical, business-enabling legal guidance at scale.
As Thomson Reuters accelerates its investment in AI-powered products and services built to the highest standards of trust and responsibility, this role will be at the forefront of defining how fiduciary-grade AI technology is developed, governed, and deployed in compliance with evolving global data protection and cybersecurity frameworks.
Key Responsibilities
Statutory Data Protection Officer Duties
Serve as the designated Data Protection Officer under UK GDPR and EU GDPR, fulfilling all statutory duties including independent monitoring of compliance, providing advice on DPIAs, and acting as the primary point of contact for supervisory authorities.
Maintain the independence and direct reporting line required of the statutory DPO function, escalating matters directly to the Board or highest level of management where required.
Champion privacy-by-design principles across the business, ensuring privacy considerations are embedded in product, technology, and business strategy decisions at the executive level.
Global Privacy Function Oversight
Provide oversight and accountability for the Privacy Operations Lead function, including the global privacy program’s operational governance, strategic roadmap, cyber incident management coordination, and leadership of privacy operations specialists and privacy engineers.
Provide senior oversight of specialized legal counsel functions reporting into the privacy organization, including Senior Counsel, US Government Privacy Compliance (FedRAMP, CMMC, and federal privacy program advisory) and Senior Counsel, Cyber Security & Privacy (global incident response, breach notification, and EU/APAC cybersecurity regulatory advisory), ensuring consistency of legal position across the organization and clear escalation into DPO-level governance.
Provide executive oversight of the Senior Privacy Operations Analyst and Senior Privacy Operations Engineer functions globally, ensuring the operational and technical backbone of the privacy program (data mapping/ROPA infrastructure, DSAR and assessment automation, KPI and risk reporting) is resourced appropriately and aligns with the DPO’s governance framework and risk appetite.
Establish and maintain a Group-wide escalation framework ensuring that material legal, regulatory, or operational privacy risk identified at any level of the privacy organization - whether in legal counsel, operations, or engineering - is escalated to the DPO in a timely and consistent manner.
Regulatory Relationships & Incident Governance
Serve as primary liaison with data protection authorities, including managing regulatory inquiries, audits, and investigations.
Oversee the company’s response to significant data breaches from a governance and regulatory notification perspective, including final sign-off on regulator and data subject notification strategy for high-severity incidents.
Board & Executive Reporting
Report regularly to Chief Privacy Officer and relevant Board and Audit committees on privacy risk, regulatory developments, and program maturity across all privacy functions.
Provide the Board, Audit Committee and Chief Privacy Officer with a consolidated, enterprise-wide view of privacy risk…