Associate Director, EU Data Protection Officer (DPO)

PTC Therapeutics is a global commercial biopharmaceutical company. For over 25 years our team has been deeply committed to a unified purpose: Extending life’s moments for children and adults living with a rare disease. At PTC, we cultivate an inclusive culture where everyone feels valued, respected, and empowered. We welcome candidates from all backgrounds to join our team , fostering a strong sense of belonging. Visit our website to learn more about our company and culture! Site: www.ptcbio.com Job Description Summary: The role of Associate Director, EU Data Protection Officer (EU DPO) is an integral part of PTC’s global privacy and data protection office, contributing to consistent governance, privacy and data protection risk management, and operational execution across Europe and ensuring that Europe-specific regulatory requirements and supervisory expectations are met. The EU DPO helps to ensure compliance with the EU General Data Protection Regulation (GDPR), applicable national (local) data protection laws across PTC’s European operations, and other jurisdictions as required. The role is highly collaborative and deliberately business-facing and hands-on; providing practical, risk-based guidance that enables business objectives while ensuring safeguards for personal data in a highly regulated biopharmaceutical environment. This role is expected to operate within and reinforce PTC’s established global privacy practices and program elements (e.g., policies, standards, templates, training frameworks, risk assessment methodologies, and governance routines), partnering with cross-functional teams to embed privacy-by-design and strengthen accountability in day-to-day execution. This position reports to the Executive Director, Global Privacy and Data Protection Officer (Global DPO) & Head of Privacy and Data Protection and partners closely with stakeholders including Legal, Information Security, Compliance, HR, Pharmacovigilance, Clinical Operations, Commercial, Digital/IT, Procurement, and other business functions. Job Description: Primary duties/responsibilities: Support Global Privacy Officer with governance, program execution, and oversight Operationalize GDPR compliance and broader privacy obligations across Europe, in alignment with PTC’s global privacy policies, standards, procedures, and governance model. Apply and promote existing program controls, tools, and templates to drive consistent ways of working across functions and countries. Provide ongoing, risk-based assessments of privacy obligations and program effectiveness; identify opportunities to enhance controls, processes, and program maturity. Maintain strong operating cadence with the Global Privacy & Data Protection Office; escalate material risks, incidents, and non-compliance in a timely manner. Cross-functional business partnering and advisory Serve as a trusted advisor to the business, process owners, and employees by providing clear, practical, business-oriented guidance on GDPR and related requirements, including handling of special category data and data relating to vulnerable populations where relevant. Support privacy-by-design and privacy-by-default in business initiatives e.g., clinical development operations, vendor-enabled processing, and adoption of emerging technologies etc. Partner with cross-functional stakeholders to ensure privacy requirements are embedded into end-to-end processes proactively. Escalate to the Global Privacy Office as appropriate. Help enable compliant outcomes by helping teams interpret requirements and implement workable solutions, balancing regulatory expectations with business needs and understanding business risk. Risk assessments and privacy assurance Lead and/or oversee privacy risk assessments, including Data Protection Impact Assessments (DPIAs), Legitimate Interest Assessments (LIAs), and/or Fundamental Rights Impact Assessment (FRIA) as appropriate and using PTC’s established methodology. Collaborate with the Global Privacy Office to identify, assess, monitor, and track privacy risks and mitigation measures in coordination with business and control owners. Support privacy controls testing, compliance monitoring, and audit readiness activities, including follow-up on remediation actions. Data subject rights, inquiries, and external engagement Coordinate with Global Privacy Office responses to data subject rights requests and privacy inquiries in line with statutory timelines and established PTC processes and procedures. In collaboration with the Global Privacy Office, provide support for engagement with relevant supervisory data protection authorities, including coordinating inputs, tracking actions, and helping ensure quality and timeliness of responses. Records, documentation, and contractual compliance Maintain and continuously improve privacy documentation (policies, procedures, standards, guidance, templates, and required internal records), in coordination with the Global Office. Maintain the Record of Processing Activities (RoPA) for relevant European data. As needed, review and validate privacy terms in agreements (e.g., DPAs, data sharing agreements, and vendor contracts), ensuring appropriate safeguards, data transfer considerations, and security requirements are addressed. Incident and breach management Strictly follow established internal procedures, advise and support management of data incidents and personal data breaches, including triage, documentation, risk assessment, containment/mitigation support, and notification decision support. Training, awareness, and culture-building In collaboration with the Global Privacy Office, support PTC’s privacy training strategy, including delivering and creating role-based training by jurisdictions for key functions and targeted refreshers. Provide hands-on enablement to cross-functional teams by reinforcing good practices and helping stakeholders apply program requirements in daily operations. Help build and sustain a network of privacy champions/local points of contact to embed privacy capabilities across European functions. Regulatory horizon scanning and enforcement updates Monitor developments in privacy, cybersecurity, and technology regulation (including EU and national guidance and evolving AI/digital governance expectations). In collaboration with Global Privacy Office prepare periodic external enforcement and regulatory update summaries for internal stakeholders, translating developments into practical impacts and recommended actions. Perform other tasks and assignments as needed and specified by management. KNOWLEDGE/SKILLS/ABILITIES REQUIRED Law degree (e.g., JD, LLB, or equivalent qualification recognized in the relevant jurisdiction)). 6–8 years of relevant professional experience in privacy/data protection roles within complex and/or international organizations (life sciences/ pharma experience strongly preferred). CIPP/E or other equivalent DPO EU-specific training/certification. Demonstrated expertise in practical GDPR implementation, including DPIAs, vendor/privacy contract review, RoPA governance, and data subject rights ma