Senior Managing Counsel, Privacy, AI & Data Responsibility

Our Purpose

Mastercard powers economies and empowers people in 200+ countries and territories worldwide. Together with our customers, we’re helping build a sustainable economy where everyone can prosper. We support a wide range of digital payments choices, making transactions secure, simple, smart and accessible. Our technology and innovation, partnerships and networks combine to deliver a unique set of products and services that help people, businesses and governments realize their greatest potential.

Title and Summary

Senior Managing Counsel, Privacy, AI & Data Responsibility

Our Purpose

We work to connect and power an inclusive, digital economy that benefits everyone, everywhere by making transactions safe, simple, smart, and accessible. Using secure data and networks, partnerships and passion, our innovations and solutions help individuals, financial institutions, governments, and businesses realize their greatest potential. We cultivate a culture of inclusion for all employees that respects their individual strengths, views, and experiences.

We believe that our differences enable us to be a better team, one that makes better decisions, drives innovation and delivers better business results.

Overview

Mastercard’s Commercial and New Payment Flows (CNPF) privacy, regulatory, and technology team supports the businesses building the next generation of payment rails and solutions, including Commercial Payments, Global SME Solutions, Transfer Solutions, and Digital Assets. These businesses span B2B and cross-border payments, account-to-account money movement, regulated money transmission, and stablecoin and digital asset businesses, including recently acquired entities.

We are seeking a VP, Senior Managing Counsel, Privacy, AI & Data Responsibility to serve as the global privacy and AI legal lead for CNPF. Reporting to the Assistant General Counsel, Privacy, Regulatory & Technology – CNPF, the role leads a global team of privacy counsel and is accountable for end-to-end privacy, data protection, and AI legal support across the CNPF portfolio. The ideal candidate is a seasoned privacy and AI lawyer and people leader who enables innovation at speed while keeping Mastercard compliant with privacy, AI, and data-related laws worldwide and aligned with Mastercard’s Privacy by Design and AI governance principles.

Role

The VP, Senior Managing Counsel will set the privacy and AI legal strategy for CNPF, act as the senior advisor to CNPF business and product leadership on privacy and AI matters, and build a high-performing, globally distributed team. The role requires the ability to think and act both strategically and tactically, translate complex legal requirements into practical product and operating solutions, and partner closely with the global and regional Privacy, Regulatory, and Technology team, Compliance, Security, and Data & Engineering teams.

Core Responsibilities

Leadership and strategy

• Lead, develop, and manage a team of global privacy counsel across multiple jurisdictions, guiding business strategy, establishing priorities, coaching team members, and ensuring consistent, high-quality privacy support for CNPF businesses globally.
• Define and execute the CNPF privacy and AI legal strategy, aligned with Mastercard’s enterprise Privacy, AI & Data Responsibility programs and CNPF business objectives.
• Serve as a trusted advisor to CNPF executives, product leaders, and law department leadership, escalating material risks and recommending pragmatic solutions aligned to defined risk appetite.
• Represent CNPF in enterprise privacy and AI governance forums and drive consistency of positions across businesses and regions.

Privacy and data protection

• Oversee Privacy by Design reviews, data protection impact assessments, and data flow analysis for new and existing CNPF products, including commercial cards and B2B payments, SME solutions, cross-border and account-to-account transfers, and regulated money transmission.
• Advise on global privacy and data protection laws, including the GDPR and UK GDPR, and equivalent regimes in the Americas, Asia Pacific, and the Middle East and Africa, together with financial privacy, banking secrecy, and data localization requirements.
• Guide international data transfer strategy, including transfer mechanisms, transfer risk assessments, and localization constraints affecting cross-border payment flows.
• Advise on the data protection implications of digital asset and stablecoin activities, including blockchain data processing, travel rule and AML data sharing, and reconciling distributed ledger design with data subject rights.
• Develop contract structures and negotiate privacy, data protection, and AI terms with customers, partners, vendors, and acquired entities, and support integration of acquired businesses into Mastercard’s privacy program.

Artificial intelligence

• Lead legal support for AI governance across CNPF, including AI risk and impact assessments, model and training data use reviews, and implementation of requirements under the EU AI Act and other emerging AI laws and frameworks.
• Advise on AI-enabled products and capabilities embedded in CNPF products, including any initiatives involving agentic commerce, AI-driven fraud and risk models, automated decision-making, and generative AI use cases, ensuring responsible and lawful data use.
• Partner with product, data science, and engineering teams to design practical controls for data responsibility, transparency, and explainability.

Regulatory engagement and horizon scanning

• Monitor and assess legislative and regulatory developments in privacy, AI, and data, and brief business and legal leadership on impacts to CNPF operations, customers, and partners.
• Support engagement with data protection authorities and financial regulators, including regulatory inquiries, examinations, and incident and breach response.
• Manage outside counsel effectively and within budget.

All About You

• Law degree and qualified to practice in specified jurisdiction (IAPP AIGP preferred).
• Experience in privacy and data protection, gained in a leading law firm, in-house at a global financial services or technology company, or both.
• Demonstrated, substantive experience advising on AI legal and governance matters, including the EU AI Act, AI risk assessment, and data use for model development and deployment.
• Proven experience leading and developing teams of lawyers, including across geographies, and influencing senior executives.
• Deep expertise in the GDPR and UK GDPR and strong working knowledge of global privacy regimes and international data transfer frameworks.
• Experience engaging with the ICO, EU data protection authorities, or other privacy regulators.
• Experience in payments, financial services, or digital assets, and comfort working with regulated entities, is strongly preferred.
• Ability to understand complex technical architectures and data flows and to explain legal concepts clearly to business, technical, and executive audiences.
• Sound judgment, a pragmatic and solutions-oriented approach, and the ability to balance innovation with risk in a fast-moving environment.
• Excellent written and oral communication, analytical, and interpersonal skills.
• CIPP/E, AIGP, or equivalent certification preferred.

Corporate Security Responsibility

All activities involving access to Mastercard assets, information, and networks come with an inherent risk to the organization and, therefore, it is expected that every person working for, or on behalf of, Mastercard is responsible for information security and must:

• Abide by Mastercard’s security policies and practices;
• Ensure the confidentiality and integrity of the information being accessed;
• Report any suspected information security violation or breach; and
• Complete all periodic mandatory security trainings in accordance with Mastercard’s guidelines.

Corporate Security Responsibility

All activities involving access to Mastercard assets, information, and networks comes with an inherent risk to the organization and, therefore, it is expected that every person working for, or on behalf of, Mastercard is responsible for information security and must:

Abide by Mastercard’s security policies and practices;

Ensure the confidentiality and integrity of the information being accessed;

Report any suspected information security violation or breach, and

Complete all periodic mandatory security trainings in accordance with Mastercard’s guidelines.