Director, Privacy Operations R&D and CPO

Role Purpose The Privacy Operations Director will serve as a key role in coordinating daily activities in the evolving role of data and AIML at GSK. Working in partnership with R&D Privacy Leaders, Legal, the Data Protection Office, Information Security, Data Governance, business process owners, and external stakeholders, the Privacy Operations Director will help ensure personal data is managed responsibly, ethically, and in accordance with GSK privacy policy, procedures and principles as well as applicable regulatory requirements. This highly collaborative role requires strong influencing skills, sound judgment, and the ability to translate privacy principles into practical, risk-based solutions that enable scientific innovation while maintaining patient and participant trust. Key Responsibilities Privacy Leadership & Advisory • Support the R&D and CPO privacy strategy and contribute to the continued advancement of privacy-by-design principles across research and patient-focused activities. • Provide privacy guidance and subject matter expertise to cross-functional teams involved in clinical research, real-world evidence, scientific research, digital health, AI-enabled initiatives, and patient engagement activities. • Partner with business leaders to identify privacy considerations in data use and reuse, and in system build and development. • Promote a culture of responsible data use and privacy awareness across R&D and CPO. Privacy as Code & Governance Engineering • Operationalise privacy requirements as a core governance product that underpins R&D and CPO digital transformation, grounded in regulatory rigor (UK/EU GDPR, HIPAA, GxP) and designed for usability and scale. • Translate privacy policy into machine-readable, enforceable controls — consent and lawful-basis logic, purpose limitation, retention and deletion rules, pseudonymisation and access constraints — embedded directly into platforms, pipelines, and data products rather than documented alongside them. • Modernise privacy delivery by codifying privacy-by-design into engineering workflows and decision points: privacy requirements as reusable patterns in system build, automated checks at data ingestion and model training, and privacy gates in the AI/ML lifecycle. • Partner with Tech, Data Governance, and AI/ML engineering teams to ensure privacy controls are testable, auditable, and adopted by default, so teams move faster while remaining compliant and ethical by design. • Measure and communicate effectiveness , defining metrics for control coverage, automation rates, and residual privacy risk, and translating privacy outcomes into business value. Compliance & Regulatory Support • Advise teams and support data governance activities on the use and reuse of human biological samples and other sensitive research data. • Support implementation of privacy requirements in relation to systems and data use under UK GDPR, EU GDPR, US Data Protect and cross boarder data transfer and other relevant global privacy requirements applicable to highly regulated R&D data environments. • Support initiatives to help ensure data is accessible to support innovation, balancing individual rights and ethical requirements. • Coordinate data gathering exercises in relation to individual rights requests in accordance with required timelines. • Support due diligence activities , ensuring that privacy considerations are embedded into the development and purchase of new systems and services. • Provide privacy and data governance expertise into the review of new and innovative uses of personal data in AI/ML initiatives. • Monitor proper use of data across the R&D and CPO organization, including cross border data transfers. Stakeholder Engagement & Capability Building • Build str