Head of Compliance & Data Privacy

About Avalere Health
United by one profound purpose: to reach EVERY PATIENT POSSIBLE. At Avalere Health, we ensure every patient is identified, treated, supported, and cared for. Equally. Our Advisory, Medical, and Marketing teams come together – powerfully and intentionally – to forge unconventional connections, building a future where healthcare is not a barrier and no patient is left behind. 
Achieving our mission starts with providing enriching, purpose-driven careers for our team that empower them to make a tangible impact on patient lives. We are committed to creating a culture where our employees are empowered to bring their whole selves to work and tap into the power of diverse backgrounds and skillsets to play a part in making a difference for every patient, everywhere. 
Our flexible approach to working allows our global teams to decide where they want to work, whether in-office or at home based on team and client need. Major city hubs in London, Manchester, Washington, D.C., and New York, and smaller offices globally, serve as collaboration hubs allowing our teams to come together when it matters. Homeworkers are equally supported, with dedicated social opportunities and resources.  
Our inclusive culture is at the heart of everything we do. We proudly support our employees in bringing their whole selves to work with our six Employee Network Groups – Diverse Ability, Family, Gender, LGBTQ+, Mental Health, and Race/Ethnicity. These groups provide opportunities to promote diversity, equity, and inclusion and to connect, learn, and socialise through regular meetings and programs of activity. We are an accredited Fertility Friendly employer with our Fertility Policy, enhanced parental leave, and culture of flexibility ensuring every employee feels supported across their family planning journey and can work in a way that suits their family’s needs. 
We are deeply invested in supporting professional growth for our employees through day-to-day career experiences, access to thousands of on-demand training sessions, regular career conversations, and the opportunity for global, cross-capability career moves.  
We take pride in being part of the Disability Confident Scheme. This helps make sure you can be interviewed fairly if you have a disability, long term health condition, or are neurodiverse. If you'd like to apply and need adjustments made, you can let us know in your application.

The role

The Head of Compliance & Data Privacy leads the day-to-day operation and continuous development of Avalere Health’s global compliance and data privacy programmes. The role helps the business manage regulatory, client and reputational risk through pragmatic, business-enabling advice and effective controls. 

Reporting and collaboration. Reporting to the GC, the role works with senior leaders and relevant functions across the business, escalates material risks, and applies group standards while addressing applicable laws, regulations and business needs across relevant jurisdictions. 

Lead by Example: Promote a positive, ethical culture across the business and model the standards expected of others. 

 

Compliance programme 

• Lead and develop Avalere Health’s global compliance programme. 

• Provide pragmatic compliance advice, assess new business initiatives, and escalate material risks to the General Counsel with clear options and business implications. 

• Monitor regulatory developments and support the implementation of proportionate controls and governance processes. 

Data privacy 

• Manage privacy compliance and risk across the organisation in line with applicable global privacy requirements, escalating significant matters to the General Counsel as appropriate. 

• Advise on responsible data use, privacy by design, safeguards and proportionate controls, and assess privacy risks arising from new products, systems, suppliers, services and data uses, including international transfers and third-party processing. 

• Manage or support key privacy processes, including DPIAs, DSRs, privacy notices, ROPAs and personal data incident assessment. 

AI compliance 

• Monitor applicable AI legislation, regulatory guidance, industry expectations and client requirements and translate requirements into proportionate, practical compliance processes and controls for Avalere Health’s services, internal use of AI, suppliers and business development activity. 

• Support assessment of AI use cases, including risk identification, documentation, human oversight, data protection considerations, vendor due diligence and approval requirements, working with the AI governance team, Legal, Information Security, Technology and business stakeholders to embed AI compliance requirements. 

Anti-bribery, conflicts and third-party due diligence 

• Advise on and support the effective operation of anti-bribery and anti-corruption controls, including conflicts of interest, gifts, hospitality and interactions with third parties.  

• Oversee proportionate, risk-based due diligence on clients, suppliers and other third parties. Identify, document and escalate due diligence concerns, ensure required mitigations and approvals are in place, and refer matters outside delegated authority. 

• Complete relevant sections of client questionnaires and due diligence materials and support KYC and KYV processes. 

Policies, training, assurance and reporting 

• Maintain and evolve compliance, privacy and AI compliance policies, procedures, guidance and governance frameworks. Manage training, completion monitoring, records and targeted awareness activity. 

• Coordinate compliance, privacy and AI compliance monitoring, control reviews and assurance activity. Prepare clear reporting and insights on material risks, incidents, trends, outstanding actions and lessons learnt for senior leadership and relevant governance forums. 

Incidents, investigations and external requests 

• Manage reported compliance, privacy and AI compliance concerns, incidents and investigations. 

• Work with stakeholders and SMEs to preserve records, document findings, identify root causes, track remediation and coordinate compliance and privacy responses to regulators, auditors and substantive client requests as applicable. 

Leadership and stakeholder engagement 

• Provide clear direction, supervision and development support to direct reports. 

• Build effective working relationships with senior and non-specialist stakeholders, adapting communication to the audience and securing engagement with compliance, privacy and AI compliance requirements. 

• Work closely with Information Security, Technology, People and other functional teams to ensure compliance, privacy and AI compliance input supports fair, consistent and commercially practical outcomes. 

• Translate complex compliance and privacy issues into clear, actionable advice that supports informed decisions and balances commercial objectives, risk and ethical standards. 

• Substantial compliance and data privacy experience gained in-house, in professional services or in a regulated environment, including hands-on experience operating or improving compliance programmes. 

• Global data privacy experience: Practical experience of DPIAs, DSR requests, personal data breaches, privacy notices and records of processing activities (ROPAs), with strong knowledge of UK and EU GDPR, an understanding of HIPAA, and awareness of other global privacy requirements relevant to an international business. 

• AI compliance experience: Working knowledge of the EU AI Act and experience assessing AI use cases, advising on implementation, risks and applying compliance controls within a wider governance framework. 

• Due diligence and ABAC: Experience of third-party due diligence, anti-bribery and anti-corruption controls, and conflicts-of-interest processes. 

• Confidentiality and accountability: Strong ownership, follow-through, integrity and discretion when handling sensitive matters, with sound judgement about when to escalate for approval. 

• Senior stakeholder advisory: Ability to advise senior leaders on sensitive compliance and privacy matters and translate material risks into practical business options. 

• Leadership accountability: Experience setting expectations, reviewing work, managing performance and coaching team members to build capability.