Director, Legal Counsel, Data & Privacy

Come make your difference in communities across Canada, where authenticity, trust and making connections is valued – as we shape the future of Canadian retail, together. Our unique position as one of the country's largest employers, coupled with our commitment to positively impact the lives of all Canadians, provides our colleagues a range of opportunities and experiences to help Canadians Live Life Well®.

At Loblaw Companies Limited, we succeed through collaboration and commitment and set a high bar for ourselves and those around us. Whether you are just starting your career, re-entering the workforce, or looking for a new job, this is where you belong.

Director, Legal Counsel, Data & Privac y | Brampton

The Data Trust Office is an enablement-first function. We embed privacy and data governance into products and services to build customer trust and loyalty, ensuring compliance by design.

As Director, you will play a pivotal role in shaping and driving Loblaw's enterprise privacy and data governance program. You will be accountable for executing the Data Trust strategy, overseeing risk management and compliance activities, developing policy, managing breaches, and fostering stakeholder engagement across the business.

As Legal Counsel, you will serve as a key partner to the commercial legal team, providing privacy, data and cybersecurity subject matter expertise on complex commercial arrangements and supporting the development, review and negotiation of appropriate contractual protections.

In both functions you will provide strategic, practical and business-oriented legal advice on privacy, data governance, CASL and related regulatory matters to the business, helping them navigate complex legal requirements while enabling the responsible use of data and innovation.

This role reports to the Enterprise Privacy Officer.

WHAT YOU'LL DO:

• •Champion privacy as a business enabler by driving stakeholder engagement and embedding privacy and data governance into products and services.
• •Provide strategic legal advice on privacy, data governance, CASL and related regulatory matters across the business, including in connection with new products, services, technologies, digital initiatives, data uses, artificial intelligence, marketing and other strategic projects and transactions.
• •Advise on the interpretation and application of privacy laws, CASL, related regulatory requirements and regulator guidance, translating legal requirements into practical, business-oriented advice.
• •Conduct Data and Privacy Impact Assessments (DPIAs), identify and evaluate legal, regulatory, data and privacy risks, and provide practical, risk-based recommendations on appropriate controls and mitigation strategies.
• •Partner with commercial legal counsel as the privacy, data and cybersecurity subject matter expert on commercial agreements involving personal information, data sharing, technology, vendors, artificial intelligence or access to Loblaw systems and data. Provide practical legal advice and support the negotiation and resolution of complex or escalated privacy, data and cybersecurity issues.
• •Provide legal advice on consent and transparency requirements, data governance and lifecycle matters, and the responsible use of data, including in connection with artificial intelligence and emerging technologies.
• •Oversee privacy breach, complaint and investigation management activities, including intake, escalation, investigation and response, and provide legal advice on notification obligations, regulatory risk, remediation and response strategy.
• •Advise on privacy and CASL regulatory matters and engage with regulators, as appropriate, in connection with regulatory inquiries, investigations, complaints and other regulatory matters, including engagement and management of external legal counsel as appropriate.
• •Recruit, lead, and develop a high-performing data and privacy team, including coaching and developing privacy professionals and fostering strong legal and risk judgment across the team.
• •Stay ahead of evolving national privacy and health privacy laws, global regulatory developments, privacy-enhancing technologies, and emerging innovations (e.g., AI/LLMs), CASL and related regulatory developments, and advise on their legal, regulatory and business implications.
• •Partner cross-functionally across the enterprise to continuously improve privacy-related policies, templates, guidance, processes and controls and create efficiencies while maintaining appropriate legal, cybersecurity and regulatory safeguards.

WHAT YOU BRING:

• •Law degree and member in good standing with the Law Society of Ontario, with 7-10 years of relevant experience in an in-house legal department and/or compliance function, including significant experience advising on privacy and related regulatory matters. Experience at a leading law firm is also considered an asset.
• •Practical, solutions-oriented and agile, with strong legal and business judgment and a demonstrated ability to navigate complexity and ambiguity, move beyond identifying risk, and develop creative, pragmatic solutions that enable business objectives while appropriately managing legal, privacy and data risk.
• •A supportive and engaged people leader who invests in the development of their team and creates an inclusive, high-performing environment where people are empowered, supported and accountable.
• •Thrives in a fast-paced, dynamic environment, with the agility to manage competing priorities, make sound decisions and drive matters forward.
• •Strong collaborator and trusted advisor who builds effective relationships, influences stakeholders and facilitates practical solutions across the enterprise.
• •Excellent communication, organizational and presentation skills, with the ability to distill complex legal, technical and privacy issues into clear, concise and actionable advice for stakeholders at all levels of the organization.
• •Demonstrated leadership experience delivering privacy and data programs and advising on complex privacy, data and regulatory matters within large, matrixed organizations.
• •Significant experience interpreting and applying Canadian federal and provincial privacy laws, CASL and related regulatory requirements to complex business and technology initiatives, including digital products and services, analytics, artificial intelligence, marketing and other data-driven activities.
• •Demonstrated experience conducting Data and Privacy Impact Assessments (DPIAs), evaluating risk and developing practical controls and mitigation strategies.
• •Proven experience managing regulatory risk and engaging directly with privacy regulators, including in connection with inquiries, investigations, complaints or other regulatory matters.
• •Experience drafting, reviewing and negotiating privacy and cybersecurity provisions in complex commercial agreements, including data processing, data sharing, technology and vendor arrangements.
• •Experience advising on privacy incidents and breach response, including assessing legal and regulatory obligations and supporting cross-functional response and remediation efforts.
• •Experience in corporate retail, direct-to-consumer or other complex, highly regulated environments is an asset.
• •CIPP-C or equivalent privacy certification preferred; AIGP and DCAM certifications are considered an asset.

Our commitment to Sustainability and Social Impact is an essential part of the way we do business, and we focus our attention on areas where we can have the greatest impact. Our approach to sustainability and social impact is based on three pillars – Environment, Sourcing and Community – and we are constantly looking for ways to demonstrate leadership in these important areas. Our CORE Values – Care, Ownership, Respect and Excellence – guide all our decision-making and come to life through our Blue Culture. We offer our colleagues progressive careers, comprehensive training, flexibility, and other competit