Assistant General Counsel - Group Data Protection Officer

Job Description
Thomson Reuters is seeking an experienced, commercially minded, and people-focused Assistant General Counsel - Group Data Protection Officer to join our Legal & Privacy function. Reporting directly to the Chief Privacy Officer, this senior leadership role will be integral to advancing Thomson Reuters' global privacy strategy, leading a geographically distributed team of privacy lawyers, and ensuring robust data protection and cybersecurity legal compliance across our worldwide operations.
This is a unique opportunity for a privacy leader who thrives at the intersection of law, technology, and global regulatory complexity — someone who can inspire and develop a high-performing team while shaping strategy and delivering practical, business-enabling legal guidance at scale.
As Thomson Reuters accelerates its investment in AI-powered products and services built to the highest standards of trust and responsibility, this role will be at the forefront of defining how fiduciary-grade AI technology is developed, governed, and deployed in compliance with evolving global data protection and cybersecurity frameworks.
Key Responsibilities
Statutory Data Protection Officer Duties
Serve as the designated Data Protection Officer under UK GDPR and EU GDPR, fulfilling all statutory duties including independent monitoring of compliance, providing advice on DPIAs, and acting as the primary point of contact for supervisory authorities.
Maintain the independence and direct reporting line required of the statutory DPO function, escalating matters directly to the Board or highest level of management where required.
Champion privacy-by-design principles across the business, ensuring privacy considerations are embedded in product, technology, and business strategy decisions at the executive level.
Global Privacy Function Oversight
Provide oversight and accountability for the Privacy Operations Lead function, including the global privacy program’s operational governance, strategic roadmap, cyber incident management coordination, and leadership of privacy operations specialists and privacy engineers.
Provide senior oversight of specialized legal counsel functions reporting into the privacy organization, including Senior Counsel, US Government Privacy Compliance (FedRAMP, CMMC, and federal privacy program advisory) and Senior Counsel, Cyber Security & Privacy (global incident response, breach notification, and EU/APAC cybersecurity regulatory advisory), ensuring consistency of legal position across the organization and clear escalation into DPO-level governance.
Provide executive oversight of the Senior Privacy Operations Analyst and Senior Privacy Operations Engineer functions globally, ensuring the operational and technical backbone of the privacy program (data mapping/ROPA infrastructure, DSAR and assessment automation, KPI and risk reporting) is resourced appropriately and aligns with the DPO’s governance framework and risk appetite.
Establish and maintain a Group-wide escalation framework ensuring that material legal, regulatory, or operational privacy risk identified at any level of the privacy organization - whether in legal counsel, operations, or engineering - is escalated to the DPO in a timely and consistent manner.
Regulatory Relationships & Incident Governance
Serve as primary liaison with data protection authorities, including managing regulatory inquiries, audits, and investigations.
Oversee the company’s response to significant data breaches from a governance and regulatory notification perspective, including final sign-off on regulator and data subject notification strategy for high-severity incidents.
Board & Executive Reporting
Report regularly to Chief Privacy Officer and relevant Board and Audit committees on privacy risk, regulatory developments, and program maturity across all privacy functions.
Provide the Board, Audit Committee and Chief Privacy Officer with a consolidated, enterprise-wide view of privacy risk spanning legal, operations, and engineering functions.
Regulatory Horizon Scanning
Monitor global privacy regulatory developments and ensure the organization’s program, operating model, and resourcing evolve to meet new and emerging requirements.
Direct horizon-scanning activity performed across the privacy legal, operations, and engineering functions, ensuring material regulatory developments are translated into updated policy, playbooks, and technical controls at the appropriate level of the organization.
Required Qualifications
Extensive experience (typically 12+ years) in data protection/privacy law or privacy leadership roles, including prior experience serving as a DPO or in a senior privacy leadership capacity at Director level or above.
Deep expertise in UK GDPR and EU GDPR, including the statutory role and independence requirements of the DPO function.
Demonstrated experience managing regulatory relationships and/or investigations with data protection authorities.
Proven Director-level leadership experience building and managing global, multi-region privacy teams spanning multiple disciplines, including legal counsel, privacy operations, and privacy engineering functions.
Demonstrated experience overseeing distinct specialized functions (e.g., government/regulatory legal counsel, cybersecurity incident response counsel, privacy operations, and privacy engineering) within a single, unified governance framework.
Law degree and/or relevant professional qualification preferred; CIPP/E and/or CIPM strongly preferred.
Preferred Qualifications
Experience in a global, multi-jurisdictional organization with complex data flows.
Experience advising on privacy matters related to AI/automated decision-making.
Board-level presentation and reporting experience.
Experience overseeing both legal/compliance and technical/engineering functions within a single organizational structure.
#LI-AB3
What’s in it For You?
Hybrid Work Model: We’ve adopted a flexible hybrid working environment for our office-based roles while delivering a seamless experience that is digitally and physically connected.
Flexibility & Work-Life Balance: Flex My Way is a set of supportive workplace policies designed to help manage personal and professional responsibilities, whether caring for family, giving back to the community, or finding time to refresh and reset. This builds upon our flexible work arrangements, including work from anywhere for up to 8 weeks per year, empowering employees to achieve a better work-life balance.
Career Development and Growth: By fostering a culture of continuous learning and skill development, we prepare our talent to tackle tomorrow’s challenges and deliver real-world solutions. Our Grow My Way programming and skills-first approach ensures you have the tools and knowledge to grow, lead, and thrive in an AI-enabled future.
Industry Competitive Benefits: We offer comprehensive benefit plans to include flexible vacation, two company-wide Mental Health Days off, access to the Headspace app, retirement savings, tuition reimbursement, employee incentive programs, and resour