Job Description
Role Title: GDPR Compliance Consultant
Department / Seat Name: TAC
Reports To (LMA): TBD
Type: Contractor/1099/Project Based
Pay Range: $100-$125/hr
—
About RSI Security
RSI Security is a leading cybersecurity and compliance consulting firm helping organizations navigate complex regulatory and security requirements. Our consultants partner with clients across healthcare, life sciences, financial services, technology, manufacturing, and other regulated industries to build practical, scalable compliance programs that reduce risk while enabling business growth.
Position Summary
The GDPR Compliance Consultant serves as a trusted advisor responsible for helping organizations achieve and maintain compliance with the European Union General Data Protection Regulation (EU GDPR) and UK GDPR.
Working directly with executive leadership, legal counsel, privacy teams, IT, security, HR, and business stakeholders, this consultant conducts privacy assessments, develops compliance programs, prepares required documentation, and implements practical privacy governance processes.
The ideal candidate possesses deep knowledge of international privacy regulations, strong consulting experience, and the ability to translate complex legal requirements into actionable business controls.
Primary Responsibilities
● Conduct GDPR and UK GDPR readiness assessments and gap analyses. ● Develop and implement GDPR compliance programs and remediation roadmaps. ● Prepare and maintain Records of Processing Activities (ROPA).
● Perform Data Protection Impact Assessments (DPIAs), Legitimate Interest Assessments (LIAs), and Transfer Impact Assessments (TIAs).
● Draft, review, and negotiate Data Processing Agreements (DPAs). ● Review privacy notices, consent mechanisms, cookie disclosures, and privacy documentation.
● Design and implement Data Subject Rights (DSAR) processes.
● Advise clients on international data transfer requirements including EU Standard Contractual Clauses (SCCs), UK IDTA/Addendum, and the EU-U.S. Data Privacy Framework.
● Assess third-party privacy risks and support vendor due diligence activities. ● Develop privacy policies, governance documentation, and operational procedures. ● Support organizations processing special category data, including healthcare and clinical research information.
● Provide guidance regarding Article 27 representative requirements and supervisory authority interactions.
● Deliver client workshops, executive presentations, and privacy awareness training. ● Collaborate with cybersecurity consultants to align privacy and security controls. ● Remain current on GDPR guidance, enforcement actions, and evolving privacy regulations.
Required Qualifications
Education
Bachelor's degree in Information Security, Privacy, Law, Business, Computer Science, Healthcare Administration, or a related field (or equivalent professional experience).
Professional Experience
● Five (5) or more years of GDPR consulting or privacy compliance experience. ● Demonstrated experience implementing GDPR compliance programs. ● Experience conducting GDPR readiness assessments and gap analyses. ● Experience preparing and maintaining ROPA documentation.
● Experience performing DPIAs, LIAs, and TIAs.
● Experience drafting and reviewing Data Processing Agreements. ● Experience developing privacy governance programs.
● Experience advising executive leadership and client stakeholders. ● Experience supporting multinational organizations is preferred.
● Previous consulting experience strongly preferred.
Technical Knowledge
Strong working knowledge of:
● EU GDPR
● UK GDPR
● Records of Processing Activities (ROPA)
● Data Protection Impact Assessments (DPIAs)
● Legitimate Interest Assessments (LIAs)
● Transfer Impact Assessments (TIAs)
● Data Subject Rights (DSAR)
● Data Processing Agreements (DPAs)
● International Data Transfers
● EU Standard Contractual Clauses (SCCs)
● UK IDTA/Addendum
● EU-U.S. Data Privacy Framework
● Vendor Risk Management
● Privacy by Design
● Privacy Governance Frameworks
● Article 27 Representative Requirements
● Consent Management
● Privacy Notices
● Data Mapping
● Data Retention
● Special Category Data Processing
Preferred Industry Experience
Experience supporting organizations within one or more of the following industries is highly desirable:
● Healthcare
● Life Sciences
● Biotechnology
● Clinical Research
● Pharmaceutical
● Medical Device
● SaaS
● Technology
Knowledge of the following is preferred:
● ICH-GCP
● Clinical Trial Regulations
● Informed Consent Requirements
● HIPAA
● Processing of Special Category Health Data
Preferred Certifications
One or more of the following certifications is preferred:
● CIPP/E
● CIPM
● CIPT
● ISO/IEC 27701 Lead Implementer
● ISO/IEC 27701 Lead Auditor
● ISO/IEC 27001 Lead Implementer
● ISO/IEC 27001 Lead Auditor
● Equivalent IAPP Privacy Certification
Core Competencies
● Privacy Consulting
● Regulatory Interpretation
● Risk Assessment
● Executive Communication
● Client Relationship Management
● Documentation Development
● Problem Solving
● Project Management
● Cross-functional Collaboration
● Presentation Skills
● Critical Thinking
● Attention to Detail
Success Measures
Success in this role will be measured by the consultant's ability to:
● Deliver GDPR consulting engagements on time and within scope. ● Produce high-quality compliance documentation requiring minimal revisions. ● Successfully guide clients toward GDPR compliance.
● Maintain high client satisfaction ratings.
● Identify privacy risks and recommend practical remediation strategies. ● Build trusted advisor relationships with executive stakeholders.
● Stay current with evolving privacy regulations and enforcement guidance.
Top Roles & Responsibilities
● Conduct GDPR and UK GDPR gap assessments and compliance reviews. ● Develop client privacy compliance programs and remediation roadmaps. ● Create and maintain GDPR documentation including ROPA, DPIAs, LIAs, TIAs, and DPAs.
● Advise clients on international data transfers and cross-border privacy requirements. ● Design processes supporting Data Subject Rights Requests (DSARs) and privacy governance.
● Review privacy notices, consent mechanisms, vendor agreements, and third-party privacy risks.
● Deliver consulting, training, and executive guidance while translating regulatory requirements into practical business controls.
Non-Negotiables
● Demonstrated GDPR consulting experience.
● Strong working knowledge of EU GDPR and UK GDPR.
● Experience conducting DPIAs, LIAs, TIAs, and preparing ROPA.
● Experience drafting and reviewing Data Processing Agreements.
● Excellent written and verbal communication skills.
● Ability to work directly with executive-level clients.
● Professional privacy certification (CIPP/E, CIPM, CIPT, or equivalent) strongly preferred
Skills Required
- Bachelor's degree in Information Security, Privacy, Law, Business, Computer Science, Healthcare Administration, or related field (or equivalent professional experience).
- Five (5) or more years of GDPR consulting or privacy compliance experience.
- Demonstrated experience implementing GDPR compliance programs and remediation roadmaps.
- Experience conducting GDPR readiness assessments and gap analyses.
- Experience preparing and maintaining Records of Processing Activities (ROPA).
- Experience performing Data Protection Impact Assessments (DPIAs), Legitimate Interest Assessments (LIAs), and Transfer Impact Assessments (TIAs).
- Experience drafting, reviewing, and negotiating Data Processing Agreements (DPAs).
- Strong working knowledge of EU GDPR and UK GDPR.
- Experience advising executive leadership and client stakeholders and working directly with executive-level clients.
- Excellent written and verbal communication skills.
- Professional privacy certification (CIPP/E, CIPM, CIPT, or equivalent IAPP certification).
- Previous consulting experience (project-based/consulting environment).
- Experience supporting multinational organizations and advising on international data transfers (SCCs, UK IDTA, Data Privacy Framework).
- Experience supporting processing of special category health data, HIPAA, ICH-GCP, or clinical research data.
What We Do
RSI Security is a cybersecurity-focused technology company that helps private and public sector organizations in highly regulated industries effectively manage risk. RSI Security provides cyber engineering, assessment, advisory services, and technical testing to amp up clients' security posture while mitigating business risk. We have experts for every cybersecurity and compliance need– PCIDSS, CMMC and NIST, MSSP, IT Security, HITRUST, HIPAA / HITECH, CCPA, GDPR, threat detection, security awareness training, and much more. Our team members come from diverse backgrounds and specialties. Our team members include published authors, open-source developers, industry researchers, and conference presenters. For more information, visit rsisecurity.com
