Data Privacy and AI Governance Lead

My client is looking for a Legal Specialist. This role is hybrid with 2-3 days onsite in London.

The Role You will own how my client handles legal across its CRM work. The core of the job is the data side of lifecycle marketing: GDPR, consent capture and proof, lawful basis, data processing across the client base, and the deliverability and compliance rules that sit underneath every campaign they ship in Braze. When an account team needs to know whether a segment is built on a defensible basis, or a client asks how their consent flow holds up, you are the person who answers and can show the reasoning.

You will also run their own legal requirements: client contracts, data processing agreements, supplier terms, and the contractual work that comes with a company adding headcount, clients, and entities. You will work directly with leadership to keep the commercial side moving without taking on risk we cannot defend, and you will set the standards the wider team follows rather than reviewing every document yourself.

The reason this is a Lead role is AI. Legal exposure from AI in CRM is moving from a future concern to a live one; automated decisioning, training data, model providers handling client data, and the consent and transparency questions that follow. We want a genuine expert who can read where the regulation is going, turn it into clear internal policy, and give clients confidence that my client uses AI responsibly.

You will work across the Solutions, Client, and Operations teams.

Key Responsibilities Own GDPR compliance across my client's CRM work, including lawful basis, consent capture, and the records that prove it. Advise account and strategy teams on whether specific segments, triggers, and data uses are defensible, and document the reasoning. Draft, review, and negotiate client contracts, data processing agreements, and supplier terms. Set and maintain my client's data processing and retention standards, and keep them current as clients and tooling change.

Lead their position on AI in CRM: automated decisioning, model providers handling client data, and the transparency and consent obligations that follow. Turn incoming regulation, including the EU AI Act and ICO guidance, into clear internal policy the delivery teams can follow. Support contractual and entity work as they grow, working with leadership and external counsel where needed. Run a practical review process so legal sign-off speeds work up rather than holding it up.

Be the point of contact for client legal and data protection questions, and brief teams before they reach the client.

Skills and Qualifications Deep working knowledge of UK and EU data protection law, particularly GDPR as it applies to marketing and CRM. Hands-on experience with consent, lawful basis, and data processing in a lifecycle or direct marketing context. Strong contract drafting and negotiation across client agreements, DPAs, and supplier terms. A real grasp of the legal questions AI raises in CRM, and the judgement to advise on them before the rules are fully settled.

Comfortable translating regulation into policy that non-lawyers can actually apply. Able to give a clear answer under commercial pressure and stand behind it. Confident working directly with leadership and clients. Bonus: familiarity with Braze or comparable CRM platforms. Bonus: experience advising on the EU AI Act or equivalent emerging AI regulation.