Legal Counsel, Data Privacy

Medison offers hope to patients suffering from rare and severe diseases, by forming partnerships with emerging biotech companies to accelerate access to highly innovative therapies in international markets.

As the creator and leader of the global partnership category in the pharma industry, we strive to be Always Ahead, and work relentlessly to bring therapy to patients in need, no matter where they live.

Our values are at the core of every action we take, and we are committed to going above and beyond for the benefit of the patients we serve.

We are a dynamic, fast-paced company, operating in over 25 countries on 5 continents. We are looking for out-of-the-box thinkers, people who are passionate, caring, agile and adaptive, to join us on our mission. If you are looking to make a difference in people's lives, we invite you to join us!

The Legal Counsel holds end-to-end strategic and operational ownership of Medison's global privacy, data protection and technology legal matters.

The role is responsible for proactively shaping, leading and embedding a global privacy program across all Medison entities and regions, owning cross-functional initiatives (with IBT, HR, Commercial, Medical, Regulatory and Tech Ops) and ensuring lawful, secure and ethical processing of personal data across the partner, patient, employee and HCP data lifecycles. The role partners closely with the Data Security functions to enable business growth, geo-expansion and AI-driven transformation while safeguarding the company.

The role also includes hands-on legal management of the company's technology procurement agreements with enterprise platform vendors (including SaaS, AI tools, and cybersecurity), from drafting and negotiation through ongoing contract lifecycle management, while also providing legal advice to the company’s departments on various legal issues.

(*Please note, the internal title for this role is Legal Counsel)

Responsibilities

• Global Privacy Program Ownership: Lead the design, implementation and continuous improvement of Medison's global privacy program, including establishing cross-border data transfer framework; owning the Global Privacy Playbook & Repository and ensuring consistent application across all markets; and building and maintaining data protection documentation such as ROPA and retention policies.
• Technology Procurement Agreements: Drive drafting and negotiation of technology procurement agreements – SaaS, licensing, IT services, AI tools, DPAs, and security vendor contracts.
• Information Security Partnership: Build and maintain close working relationships with the relevant stakeholders in the IBT department, ensuring Legal involvement in planning and execution of technology projects.
• AI Governance: Serve as the legal owner of Medison's AI Usage Policy and AI governance, including review of GenAI features for privacy, confidentiality and data-flow implications.
• Geo-Expansion Privacy Readiness: Lead privacy work-streams for market entry.
• Training, Awareness & Culture: Own the Privacy Training Program and embed privacy as part of Medison's organizational DNA.
• Risk Management: Deliver privacy & data-security risk assessments, propose mitigation strategies, and drive prioritization based on business and regulatory impact.
• Business Partnering & Proactive Leadership: Act as a strategic, proactive business partner to the company’s stakeholders, leading processes end-to-end and influencing cross-functional outcomes.
• Corporate and Commercial Legal Support: Provide legal consultation to company departments on a wide range of legal matters.

Requirements

Required education and experience

• A Bachelor's law degree (LL.B.) from a leading academic faculty.
• A valid license to practice law in the country of residence.
• 5-10 years of relevant legal experience, with a substantial portion focused on privacy / data protection / technology, gained in a leading law firm and/or in-house at a multinational company.
• Proven hands-on experience leading global privacy programs and projects.
• In-depth knowledge of privacy regulation, including GDPR;
• Advantage: familiarity with the Pharma / Life-Sciences industry.

Required qualification

• High professional fluency in English (written and verbal).
• Strategic and proactive mindset: ability to own and drive a global function rather than execute tasks reactively.
• Strong leadership, ownership and accountability for cross-functional, organization-wide processes.
• Strong analytical, drafting and risk-balancing skills, with attention to detail and precise legal language.
• Capable of working independently, prioritizing under pressure and managing multiple parallel matters across jurisdictions.
• High professional ethics, integrity and discretion when handling sensitive personal data.

*Kindly submit your CV in English*