Principal Associate - Commercial - Data, Privacy & Cybersecurity

Job Description

Browne Jacobson is proud to have been awarded National Law Firm of the Year in the Chambers & Partners Awards 2025 last year and also is fast growing with revenue growth of 16% over its last financial year, as published in its 2024/25 annual results – see here for further details.

With offices in Birmingham, Cardiff, Dublin, Exeter, London, Manchester and Nottingham, we’re a UK & Ireland based law firm with an international reach. Our key industry sectors include technology, health/life sciences; real estate and construction; education; energy and infrastructure; financial services; government; insurance; manufacturing and industrials; and retail, consumer and logistics.

Our firm has also been one of the leaders in adopting AI technology and we announced early on, last year, that we had invested in Legora, one of the two leading legal industry tools (along with Harvey) to drive innovation in legal service delivery. As part of this, we are investing heavily in training our lawyers and operations teams to leverage Legora (and comparable technologies) to innovate and develop new digital solutions and AI‑related tools, products and services to optimise client service delivery and deliver service excellence.

We are recruiting for a Principal Associate to join our Data, Privacy & Cybersecurity team. In this role, you will advise clients on complex data protection matters across multiple sectors, support junior team members, and contribute to the firm’s reputation for excellence in legal and professional services. The role offers hybrid/flexible working in support of a good work‑life balance.

You will provide clear, pragmatic and operationally focused guidance on UK and EU data protection regulations. Your responsibilities include developing and implementing data protection policies, DPIAs, TRA/TIAs, managing compliance initiatives, and supporting robust privacy frameworks. You will draft, review, amend and negotiate data‑related contracts and commercial documentation, as well as lead and oversee complex DSAR and automated decision‑making request projects.

The role involves handling strategic and programmatic data protection work, including emerging legal issues relating to advanced technologies such as AI. You will conduct risk assessments for innovative technologies, including profiling, biometrics and AI‑driven systems, and demonstrate understanding of international data transfer rules and regulations. Managing local and international compliance programmes, briefing local counsel, preparing estimates, scopes and assumptions, and supporting supervision of Corporate DD are also key aspects of the position.

You will support organisations responding to cyberattacks and personal data breaches, maintain strong relationships with key clients, and contribute to and lead business development (and drive forward your own client relationships to develop as lead counsel for your own key clients). Supervising and mentoring senior and junior associates and trainees is expected, and you will work independently with maturity in people skills, guided by and mentored by a Legal Director or Partner.

We require a qualified solicitor with significant experience in a leading data protection team and up-to-date knowledge of UK/EU data protection law, including UK/EU GDPR, EU Data Act, UK DPA, PECR, Data (Use and Access) Act, ePrivacy and associated cybersecurity frameworks. You should have proven experience advising on a broad range of data protection and privacy matters across multiple sectors, either deep or a working knowledge of freedom of information law and (if possible) EIR regulations, together with excellent drafting, analysis and communication skills, and familiarity with emerging technologies including AI and digital risk frameworks.

We are also looking, wherever possible for experience in cybersecurity incident response and data breach management. Strong commercial awareness, sound judgement, leadership capability, and confidence in managing stakeholders at all levels are required.

Desirable attributes include knowledge of Online Safety and Age Verification laws,…