Senior Privacy Analyst – DSAR & Risk Management

Job Description
The Senior Privacy Operations Analyst drives the day-to-day execution of the company’s global privacy compliance program, spanning UK/EU, US, APAC, and other regions in which the business operates. This role goes beyond individual task execution to own program-level activities: coordinating data subject rights requests, running and reporting on privacy risk assessments, maintaining data mapping and records of processing activities (ROPA), and using work-management and privacy automation tooling (e.g., Azure DevOps/Jira, OneTrust, Power Automate) to scale the privacy program’s operational cadence and reporting. The role partners closely with the Privacy Operations Lead, Legal, Information Security, and business stakeholders across multiple jurisdictions.

Key Responsibilities

Privacy Program Management & Reporting

• Structure and maintain privacy operations work in Azure DevOps (ADO), Jira, or similar work-management tools, including custom work item types and fields mapped to privacy concepts (jurisdiction, data type, risk tier).

• Build and maintain KPI dashboards and reporting (e.g., DSAR SLA compliance, assessment backlog age, incident response times) for privacy program leadership, using ADO Analytics, Power BI, or similar tools.

• Track cross-functional privacy work items that depend on Legal, Security, and Product teams, and proactively surface bottlenecks and at-risk items.

• Coordinate responses to data subject access requests (DSARs) and other data subject rights requests, ensuring timely resolution within statutory timelines across jurisdictions.

• Track and report on privacy program metrics and KPIs for leadership and relevant stakeholders.

Privacy Risk Assessments

• Conduct and document privacy impact assessments (PIAs), data protection impact assessments (DPIAs), and transfer impact assessments (TIAs) for new products, features, and vendor engagements.

• Support automated assessment workflows that trigger and assign PIAs/DPIAs based on risk-based conditional logic (data type, processing purpose, jurisdiction, vendor risk tier), escalating high-risk triggers for senior review.

• Support efforts to reduce manual effort in assessment scoring and risk rating, applying sound judgment on what can be automated versus what must remain human-reviewed.

Data Mapping & ROPA Maintenance

• Maintain and update the company’s records of processing activities (ROPA), tying outputs directly to data mapping and risk assessment findings.

• Support data discovery and data flow mapping efforts across the organization’s systems, environments, and third-party integrations, leveraging data discovery tooling where available.

• Support an ongoing ownership and maintenance model for the data map/ROPA, including monitoring for drift as systems or vendors change and reconciling against discovery tool outputs.

Privacy Compliance & Risk Management

• Monitor and track changes in privacy regulations across jurisdictions, and support compliance with key regulations including UK GDPR/EU GDPR, CCPA/CPRA, PIPEDA, and other applicable regimes.

• Support privacy incident response and breach notification processes, including incident documentation and breach register maintenance.

• Support privacy audits and assessments of internal processes and third-party vendors.

Privacy-by-Design & Cross-Functional Collaboration

• Support the intake and triage of privacy-related inquiries from internal stakeholders and customers.

• Partner with Legal, Information Security, IT, Product, and Business teams to support the integration of privacy-by-design principles into the product development cycle.

• Assist with privacy training content delivery and tracking across the business.

• Support vendor and partner reviews to ensure contractual privacy obligations are met, and help identify current sub-processors for contractual documentation updates.

Documentation & Governance

• Contribute to internal privacy policy, procedure, and operational playbook documentation.

• Maintain privacy metrics, dashboards, and reports for leadership and relevant stakeholders.

• Provide guidance and quality review to junior privacy operations team members on documentation and process adherence.

Required Qualifications

• 5-7 years of experience in a privacy, compliance, legal operations, or similar role, supporting a global or multi-jurisdictional privacy program.

• Working knowledge of UK GDPR/EU GDPR, CCPA/CPRA, PIPEDA, and other applicable global data subject rights frameworks.

• Hands-on experience with privacy management platforms (e.g., OneTrust, TrustArc) configuring or running DSAR, PIA/DPIA, and data mapping workflows.

• Experience using work-management tools (e.g., Azure DevOps, Jira) to structure and track privacy operations work, including building reporting dashboards and KPIs for leadership.

• Exposure to or experience with automation of privacy workflows (e.g., Power Automate, API integrations between privacy platforms and ticketing systems) to reduce manual effort in DSAR, assessment, and data mapping processes.

• Understanding of data discovery and data mapping tooling and techniques to keep ROPA records current and minimize drift.

• Strong attention to detail and organizational skills; comfortable managing multiple deadlines across time zones.

• Clear written and verbal communication skills, including the ability to brief stakeholders on program status and risk.

Preferred Qualifications

• CIPP/E, CIPP/US, or CIPM certification, or actively pursuing.

• Experience building ADO/Jira custom work item types, boards, and Power BI or analytics dashboards for privacy KPI reporting.

• Experience with data discovery/classification tools (e.g., OneTrust Data Discovery, BigID, Collibra).

• Prior experience in a shared services, global operations, or multinational organization.

• Familiarity with basic scripting or low-code automation (e.g., Power Automate) to support privacy workflow automation.

Skills & Competencies

• Strong analytical and problem-solving capabilities

• Ability to work independently and collaboratively across global teams and time zones

• Adaptability to changing regulatory landscapes

• Cultural sensitivity for working in a global environment

• Technical aptitude for understanding data flows, systems, and automation tooling

#LI-KP1

What’s in it For You?

• Hybrid Work Model: We’ve adopted a flexible hybrid working environment for our office-based roles while delivering a seamless experience that is digitally and physically connected.
• Flexibility & Work-Life Balance: Flex My Way is a set of supportive workplace policies designed to help manage personal and professional responsibilities, whether caring for family, giving back to the community, or finding time to refresh and reset. This builds upon our flexible work arrangements, including work from anywhere for up to 8 weeks per year, empowering employees to achieve a better work-life balance.
• Career Development and Growth: By fostering a culture of continuous learning and skill development, we prepare our talent to tackle tomorrow’s challenges and deliver real-world solutions. Our Grow My Way programming and skills-first approach ensures you have the tools and knowledge to grow, lead, and thrive in an AI-enabled future.
• Industry Competitive Benefits: We offer comprehensive benefit plans to include flexible vacation, two company-wide Mental Health Days off, access to the Headspace app, retirement savings, tuition reimbursement, employee incentive programs, and resources for mental, physical, and financial wellbeing.
• Culture: Globally recognized, award-winning reputation for inclusion and belonging, flexibility, work-life balance, and more. We live by our values: Obsess over our Customers, Compete to Win, Challenge (Y)our Thinking, Act Fast / Learn Fast, and Stronger Together.
• Social Impact: Make an impact in your community with our Social Impact Institute. We offer employees two paid volunteer days off annually and opportunities to get involved with pro-bono consulting projects and Environmental, Social, and Governance (ESG) initiatives.
• Making a Real-World Impact: We are one of the few companies globally that helps its customers pursue justice, truth, and transparency. Together, with the professionals and institutions we serve, we help uphold the rule of law, turn the wheels of commerce, catch bad actors, report the facts, and provide trusted, unbiased information to people all over the world.

About Us

Thomson Reuters informs the way forward by bringing together the trusted content and technology that people and organizations need to make the right decisions. We serve professionals across legal, tax, accounting, compliance, government, and media. Our products combine highly specialized software and insights to empower professionals with the data, intelligence, and solutions needed to make informed decisions, and to help institutions in their pursuit of justice, truth, and transparency. Reuters, part of Thomson Reuters, is a world leading provider of trusted journalism and news.

We are powered by the talents of 26,000 employees across more than 70 countries, where everyone has a chance to contribute and grow professionally in flexible work environments. At a time when objectivity, accuracy, fairness, and transparency are under attack, we consider it our duty to pursue them. Sound exciting? Join us and help shape the industries that move society forward.

As a global business, we rely on the unique backgrounds, perspectives, and experiences of all employees to deliver on our business goals. To ensure we can do that, we seek talented, qualified employees in all our operations around the world regardless of race, color, sex/gender, including pregnancy, gender identity and expression, national origin, religion, sexual orientation, disability, age, marital status, citizen status, veteran status, or any other protected classification under applicable law. Thomson Reuters is proud to be an Equal Employment Opportunity Employer providing a drug-free workplace.

We also make reasonable accommodations for qualified individuals with disabilities and for sincerely held religious beliefs in accordance with applicable law. More information on requesting an accommodation here.

Learn more on how to protect yourself from fraudulent job postings here.

More information about Thomson Reuters can be found on thomsonreuters.com.