General Counsel & DPO

Our client is the Barcelona digital hub of a large European healthcare group. It works as a tech company with a business mindset: it designs, builds and scales the group's new digital businesses, including large consumer-facing health products rolled out in several European markets.

This is a confidential search. We will share the company's name with shortlisted candidates at the right stage of the process.

About the role

We are looking for a senior legal and privacy leader to build and head the Legal, Privacy & Compliance function. You will report directly to the Managing Director, sit on the leadership team and hold the formal Data Protection Officer designation.

You will be the company's reference on data protection, consumer law and digital regulation, working closely with Product, Tech and the business, and with the legal and compliance teams of the parent group. What matters most here is someone who has already built and scaled privacy and legal functions in tech, consumer-facing businesses, and who can turn complex regulation into practical answers that let the company grow fast across Europe with risk under control.

• Build and lead the Legal, Privacy & Compliance function: its operating model, priorities and budget, and grow the team as the business scales.
• Act as the designated Data Protection Officer under the GDPR, with the independence the role requires: own the privacy programme end to end (records of processing, DPIAs, LIAs, data subject rights, international transfers, breach management) and be the main contact with supervisory authorities in the markets where the company operates.
• Steer multi-country compliance for digital products launched in several European markets, coordinating local counsel and aligning with the group's legal, compliance and data protection teams, including intra-group data sharing and controller/processor arrangements.
• Embed privacy by design in products and technology, working with Product, Engineering and Information Security so new features launch quickly and compliantly.
• Oversee the processing of health data and other special categories of personal data, which are central to the company's consumer health products.
• Ensure compliance with consumer protection, e-commerce and marketing law: loyalty programmes, B2C mobile apps, promotions, digital marketing and consent management.
• Lead compliance with EU digital regulation, including the Digital Services Act, the Data Act, ePrivacy and cookie rules, NIS2 and the European Accessibility Act, as applicable.
• Define the AI governance framework in line with the EU AI Act and advise on the legal and ethical use of data and AI features.
• Design and maintain compliance programmes, policies, controls and training, and report on legal and regulatory risk to the leadership team.
• Draft, negotiate and oversee commercial and technology contracts (SaaS, cloud, software development, DPAs, partnerships, vendors), protect the company's intellectual property and build scalable playbooks and templates.
• Advise on corporate governance and support strategic corporate transactions when needed.
• Bring efficiency through legal tech and the automation of legal and compliance workflows.

• Law degree.
• 10+ years of legal experience, with significant in-house time at tech, digital or consumer-facing companies.
• Deep expertise in the GDPR across several EU member states, with a proven track record leading privacy programmes and/or acting as DPO.
• Solid experience in EU consumer law, e-commerce and digital marketing regulation.
• Experience advising on products or services deployed across several European jurisdictions.
• Proven experience building and leading legal teams.
• Strong business sense and the ability to turn complex legal requirements into clear actions for non-legal teams.
• Excellent spoken and written English and Spanish.
• Hands-on and practical: comfortable with strategy and with day-to-day execution in a fast-paced environment.

Nice to have

• Experience with health data, health tech, e-health or pharmaceutical and healthcare regulation, including rules on advertising to consumers.
• Privacy certifications such as CIPP/E or CIPM.
• Hands-on experience with the AI Act and AI governance.
• Experience with loyalty programmes, B2C mobile apps, CRM or customer data platforms.
• Background in a high-growth startup or scale-up, ideally combined with experience inside a large corporate group.

• Competitive salary
• Flexible compensation plan: transport, meal and childcare vouchers
• Private health insurance
• Hybrid working and flexible hours
• Summer intensive schedule
• 24 days of holiday per year
• Office in central Barcelona