About this role
At Bristol Myers Squibb, our employees often ask, “Who are you working for?”—a question that fuels collaboration, accountability, and urgency in our work. Our purpose-driven culture inspires us to discover, develop, and deliver innovative medicines to prevail over serious diseases. We offer uniquely interesting and meaningful work, opportunities for growth, and a supportive environment that values inclusion, wellbeing, flexibility, and comprehensive benefits.
This is work that transforms the lives of patients, and the careers of those who do it.
Bristol Myers Squibb is seeking an experienced and strategic Associate Director, Privacy Law & Compliance (Regional Privacy Counsel) - based in Warsaw - for Europe, the Middle East and Africa (EMEA) to join our Global Privacy Law & Compliance team. This role is critical in ensuring BMS' data privacy and protection practices comply with the diverse and evolving regulatory landscape across EMEA jurisdictions, while enabling the business to innovate and operate efficiently. This person will serve as the primary legal advisor on all privacy matters affecting BMS' EMEA operations, working cross-functionally with business units including Commercial, Medical Affairs, IT, and HR.
Key Responsibilities
EMEA Privacy Legal Advisor. Serve as the subject matter expert on data privacy laws across EMEA jurisdictions, including the EU (GDPR), UK (UK GDPR/DPA 2018), Switzerland (FADP), Turkey (KVKK), the Gulf states (UAE Federal PDPL, UAE DIFC/ADGM data protection regimes, Saudi Arabia PDPL, Qatar PDPL, Bahrain PDPL), Israel (Privacy Protection Law), and Sub-Saharan and North Africa (South Africa POPIA, Nigeria NDPA, Kenya DPA, Egypt PDPL, and other emerging frameworks).
Business Stakeholder Advisory. Advise business partners on privacy risks and legal obligations associated with new and existing initiatives across the region.
Compliance Program Advice. Work with Director, Global Privacy Compliance to ensure accurate and actionable regional privacy compliance program in alignment with global privacy standards and policies
Privacy Impact Assessments. Conduct PIAs and DPIAs for EMEA-specific initiatives and maintain records of processing activities (RoPA) for EMEA entities.
Regulatory Monitoring. Track regulatory developments across EMEA and ensure timely updates to internal policies, procedures, and controls.
Cross-Border Data Transfers. Advise on applicable transfer mechanisms (including EU Standard Contractual Clauses, UK IDTA/Addendum, Binding Corporate Rules, and adequacy decisions) and review/negotiate DPAs, vendor contracts, and data sharing arrangements with EMEA partners.
Training & Awareness. Develop and deliver region-specific privacy training programs for EMEA employees, contractors, and third parties; foster a culture of privacy accountability.
Incident Response. Support, as needed, EMEA privacy incident triage, investigation, notification, and remediation efforts (including breach notification timelines) in coordination with IT department along.
Qualifications
Education: Law degree (LLB, JD, or equivalent); license to practice law in at least one EMEA jurisdiction (EU member state, UK, or other EMEA jurisdiction).
Experience: Minimum 5-8 years of legal experience, with at least 5 years focused on data privacy and protection law in the EMEA region.
Deep expertise in at least three or more EMEA data privacy regimes (e.g., GDPR, UK GDPR, POPIA, UAE PDPL, Saudi PDPL).
Demonstrated experience advising on cross-border data transfer mechanisms and international privacy frameworks.
Prior experience in the life sciences, pharmaceutical, or healthcare sector strongly preferred.
Proven ability to navigate complex, multi-jurisdictional privacy issues with business pragmatism.
Strong negotiation skills for data processing and vendor agreements.
Excellent communication skills in English; proficiency in at least one additional EMEA language (French, German, Arabic, or Portuguese) highly desirable.
Please note that this position is not a remote working opportunity and is based in the local BMS office, following a hybrid work model with at least 50% onsite attendance at your assigned facility.
#LI-HYBRID
We hire for skills and capabilities, not just credentials – if this role excites you, but doesn’t perfectly match your resume, we encourage you to apply anyway.
Compensation Overview
Warsaw - PL: zł327,250 - zł396,550
The starting compensation range(s) for this role are listed above for a full-time employee (FTE) basis. Additional incentive cash and stock opportunities (based on eligibility) may be available. The starting pay takes into account characteristics of the job, such as required skills, where the job is performed, the employee’s work schedule, job-related knowledge, and experience.
The final compensation will be determined based on demonstrated experience and in accordance with pay equity principles and applicable employment laws.