Data Privacy Director, Europe

ABOUT GREYSTAR

Greystar is a leading, fully integrated global real estate platform offering expertise in property management, investment management, development, and construction services in institutional-quality rental housing. Headquartered in Charleston, South Carolina, Greystar manages and operates over $300 billion of real estate in over 260 markets globally with offices throughout North America, Europe, South America, and the Asia‑Pacific region. Greystar is the largest operator of apartments in the United States, managing more than one million units/beds globally.

Across its platforms, Greystar has over $79 billion of assets under management, including approximately $36 billion of development assets and over $30 billion of regulatory assets under management. Greystar was founded by Bob Faith in 1993 to become a provider of world‑class service in the rental residential real estate business.

To learn more, visit

As a data privacy director, you will lead Greystar’s European privacy and data protection strategy while also taking an active, hands‑on role in its day‑to‑day implementation. You will develop, implement, and ope rationalise policies, procedures, and controls to ensure ongoing compliance with applicable European and national data protection laws. Working closely with senior leadership, business teams, and external counsel, you will embed privacy requirements into business operations, support regulatory and commercial decision‑making, and ensure the EU privacy programme remains aligned with both business objectives and regulatory expectations.

• Define and oversee the organization’s data protection strategy, ensuring compliance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity and confidentiality.
• Establish, maintain, and govern records of personal data processing activities, including data mapping of data flows, categories of personal data and data subjects, purposes of processing, lawful bases, recipients, international transfers, retention periods, and applied technical and organisational measures.
• Monitor and ensure compliance with GDPR and related EU data and information protection laws across all processing activities, including the implementation and effectiveness of appropriate technical and organisational measures.
• Advise and report to senior management and business functions on data protection obligations, including privacy by design and by default, lawful bases for processing, and the use of personal data in new products, services, and technologies.
• Oversee data protection impact assessments for processing operations likely to result in high risk to the rights and freedoms of data subjects, ensuring risks are identified, assessed, mitigated, and documented.
• Lead on the advice on and response to any European data protection breach (working with the current DPO and external lawyers as necessary) and take responsibility for reporting to the business.
• Have an active role in the review of contracts/agreements to ensure appropriate data processing terms are embedded in contracts/agreements and other legal acts involving the processing of personal data, in line with GDPR requirements.
• Take responsibility for horizon scanning data protection and privacy legislative and regulatory developments and lead data protection awareness, training, and internal communication programs, promoting a culture of data protection and ensuring employees and relevant stakeholders understand their responsibilities regarding the processing of personal data and the handling of personal data breaches.

• Updating and developing new policies, procedures, and guidance documents as needed across markets, divisions, and functional areas.
• Providing input on vendor strategy, working with legal on review of contract terms related to privacy.
• Oversee data protection registrations and regulatory engagement, including maintaining required registrations and managing communication with European supervisory authorities such as the UK Information…