Specialist, Legal Services

Our Purpose

Mastercard powers economies and empowers people in 200+ countries and territories worldwide. Together with our customers, we’re helping build a sustainable economy where everyone can prosper. We support a wide range of digital payments choices, making transactions secure, simple, smart and accessible. Our technology and innovation, partnerships and networks combine to deliver a unique set of products and services that help people, businesses and governments realize their greatest potential.

Title and Summary

Specialist, Legal Services

Privacy Operations (OneTrust Support, Marketing Promotions & Sub-Processor Management)

Position Summary

Specialist is responsible for supporting global privacy compliance activities through operational management of the OneTrust platform, privacy review of marketing promotions and campaigns, and maintenance of organizational records relating to sub-processors. This role partners with Privacy Attorneys, Marketing teams, Product teams, Procurement, and other stakeholders to ensure compliance with applicable privacy laws, internal policies, and Privacy by Design requirements. The role requires strong attention to detail, stakeholder management, process governance, and privacy compliance knowledge.

Key Responsibilities
1. OneTrust Platform Support
• Provide day-to-day operational support for the OneTrust platform.
• Manage and respond to user inquiries, troubleshooting requests, and platform-related issues.
• Support privacy workflow administration including:
o Data Intake Forms (DIF)
o Privacy Impact Assessments (PIA)
o Data Protection Impact Assessments (DPIA)
o Records of Processing Activities (ROPA)
o Data Mapping and Inventory activities
• Maintain data quality, platform records, and governance controls.
• Coordinate with technical teams and business stakeholders to resolve platform issues.
• Monitor assessment queues and follow up on pending actions.
• Generate metrics, dashboards, reports, and audit evidence from OneTrust.
• Support testing and implementation of platform enhancements and workflow changes.
• Maintain process documentation, work instructions, and user guides.

2. Marketing Promotions Privacy Reviews
• Review marketing and promotional materials from a privacy compliance perspective.
• Assess and provide guidance on:
o Privacy Notices
o Terms & Conditions
o Consent language
o Consent forms
o Promotional campaign content
o Contractual privacy provisions
• Identify privacy risks and recommend mitigations.
• Collaborate with Marketing, Business teams, and Privacy Attorneys to address review comments.
• Track review requests and ensure timely completion within agreed SLAs.
• Maintain review records and document approvals.
• Support regional marketing privacy initiatives and campaigns.
• Monitor shared mailboxes and respond to stakeholder inquiries regarding marketing promotions reviews.

3. Sub-Processor List Management
• Maintain and update organizational sub-processor inventories.
• Review vendor and processor information for completeness and accuracy.
• Coordinate with Procurement, Legal, Vendor Management, and Privacy teams to collect required information.
• Track additions, modifications, and removals of sub-processors.
• Ensure sub-processor records remain current and audit-ready.
• Conduct periodic reviews and reconciliations of sub-processor data.
• Support publication and maintenance of externally-facing sub-processor lists, where applicable.
• Assist with stakeholder responses related to sub-processor inquiries and reporting requirements.
• Prepare metrics and reporting related to sub-processor governance activities.

Additional Responsibilities
• Assist with privacy compliance monitoring and reporting activities.
• Support process improvement and automation initiatives.
• Identify opportunities to improve operational efficiency and data quality.
• Participate in knowledge-sharing and training activities.
• Prepare management reports, dashboards, and status updates.
• Support internal and external audit requests.

Required Qualifications
• Bachelor's degree in Law.
• 2–5 years of experience in Privacy Operations, Compliance, Legal Operations, Risk Management, or Data Governance.
• Experience working with OneTrust or other privacy management platforms preferred.
• Understanding of global privacy and data protection principles.
• Strong analytical and problem-solving skills.
• Excellent written and verbal communication skills.
• Strong stakeholder management and organizational skills.
• Proficiency in Microsoft Excel, PowerPoint, and Microsoft 365 tools.
Preferred Qualifications
• Experience with privacy impact assessments, records of processing, or vendor privacy reviews.
• Knowledge of GDPR, UK GDPR, DPDP Act, CCPA, PDPA, or similar privacy frameworks.
• Experience managing privacy operations mailboxes and workflow-based processes.
• Familiarity with privacy reporting, metrics, and dashboard creation.
• Experience with process automation or AI-enabled workflow improvements.

Corporate Security Responsibility

All activities involving access to Mastercard assets, information, and networks comes with an inherent risk to the organization and, therefore, it is expected that every person working for, or on behalf of, Mastercard is responsible for information security and must:

• Abide by Mastercard’s security policies and practices;

• Ensure the confidentiality and integrity of the information being accessed;

• Report any suspected information security violation or breach, and

• Complete all periodic mandatory security trainings in accordance with Mastercard’s guidelines.