Senior Privacy Advisor (AI Act and GDPR)

Project overview

Job description

For our end client Gemeente Haarlemmermeer, we are looking for a Senior Privacy Advisor (AI Act and GDPR).

For the AI "sprint," we are looking for an experienced Senior Privacy Advisor who will be responsible for ensuring privacy and data protection within the development and implementation of an AI solution in the municipal context for four weeks.

The AI "sprint" aims to deliver a working prototype in a short period, including the necessary elaboration in the areas of privacy, information security, management, and governance. The focus is not only on functionality but also on how the solution can be used lawfully, transparently, and responsibly within the municipality's existing information provision.

The Senior Privacy Advisor fulfills an important independent review and advisory role. They will assess privacy risks, advise on appropriate privacy measures, and ensure the solution complies with the requirements of the GDPR, municipal policy frameworks, and other relevant laws and regulations.

Additionally, the Senior Privacy Advisor will explicitly assess the solution against the privacy and governance requirements arising from the European AI Act, including transparency obligations, risk classification, human oversight, data quality, responsible use of AI systems, and the required documentation and accountability.

The Senior Privacy Advisor actively contributes to the execution of the DPIA, the creation of the risk log, the assessment of data processing activities, the substantiation of design choices, and decision-making regarding privacy risks and residual risks.

Responsibilities

As a Senior Privacy Advisor, you are responsible for identifying, assessing, and managing privacy risks within the AI "sprint." You will work in a multidisciplinary team using an agile methodology and collaborate closely with the TISO, Technical Security Engineer, product owner, and other specialists.

Your primary focus is on ensuring privacy, data protection, and compliance throughout the development of the AI prototype. You will ensure that privacy-by-design, transparency, lawfulness, and the requirements of the GDPR and the AI Act are integral parts of the solution from day one.

You will contribute to privacy risk analyses, the execution of the DPIA, the elaboration of control measures, the risk log, and the assessment of architecture, design, and data processing choices. You will also advise on appropriate privacy measures and review the solution against relevant laws and regulations, municipal frameworks, and the requirements of the AI Act. Structured working, documenting privacy risks, decisions, and residual risks, and documenting processing activities and control measures are essential parts of the assignment.

This will result not only in a working solution but also in a prototype whose privacy risks are understood, appropriate measures have been taken, and which can be responsibly further developed in a potential follow-up phase.

The Senior Privacy Advisor will be engaged for the duration of the AI "sprint" and the directly related preparation and follow-up activities.

Given the nature, complexity, and short turnaround time of the assignment, there is an explicit search for one senior professional who will be responsible for identifying, assessing, and managing privacy risks and ensuring the privacy frameworks around the solution throughout the entire assignment. Continuity, rapid decision-making, and consistent privacy considerations are essential.

The assignment consists of three phases:

· Preparation phase: the week prior to November 23, 2026, focusing on privacy risk analysis, compliance alignment, DPIA preparation, drafting the initial risk log, and defining privacy frameworks.

· AI "sprint": the week of November 23, 2026, during which the multidisciplinary team will develop, test, and demonstrate a working prototype over five working days. The Senior Privacy Advisor will assess privacy risks, advise on control measures, and support decision-making on GDPR and AI Act issues.

· Post-preparation phase: the weeks following the "sprint," focusing on finalizing the DPIA, updating the risk log, documenting residual risks, advising on implementation, and transferring privacy advice and documentation.

During the "sprint" week, the Senior Privacy Advisor is expected to be fully available and physically present at the municipal work location Beukenhorst in Hoofddorp.

Job requirements

As a Senior Privacy Advisor, you have demonstrable experience with privacy and data protection issues within complex organizations. You are capable of identifying and assessing privacy risks and translating them into practical and proportionate control measures. You are also familiar with agile working and know how to collaborate effectively in multidisciplinary teams where development, information security, privacy, compliance, and management come together.

In addition to the above competencies, we would like to see the following on your CV:

You are capable of making privacy risks transparent and translating them into concrete control measures. You will also actively contribute to the DPIA, risk log, privacy frameworks, risk acceptances, and the decision-making that takes place during the AI "sprint." You will ensure that privacy considerations are demonstrably recorded and that the solution can be managed and further developed responsibly, lawfully, and transparently.

Company information

Haarlemmermeer is one of the largest municipalities in the Netherlands with 162,000 inhabitants. 18,500 hectares of land, made up of 32 cores, create an area full of exciting contrasts. We have vast landscapes and agricultural land, and impressive urban architecture and high-tech multinationals. Not to mention Schiphol. We are a young municipality, but at the same time, we have a rich history, partly reflected in the Stelling van Amsterdam with its 19th-century pumping stations. Haarlemmermeer is constantly developing. It is a dynamic place where people want to live, work, and recreate.

It is green and urban at the same time.

Building Haarlemmermeer and managing our organization requires drive. If you have that, combined with a results-oriented approach, you will fit in well with us. And with our ambition to become one of the best service municipalities in the Netherlands. We need professional people for that, who are involved in society. We offer you every opportunity for broad development, have attractive employment conditions, and offer a different work environment every day.

The municipal organization is divided into 5 domains. One of the domains, Business Operations, includes several support clusters that handle support for the entire municipal organization in the areas of housing, procurement, legal affairs, personnel policy, finance, and ICT.

You will work within the future DIGI cluster (Data, Information, and Digital Innovation), in the Data Team. This cluster is set up to elevate data-driven working within the municipality to a higher level.

Naturally, this vacancy is open to anyone who recognizes themselves in this.

apply via Randstad Professional

contact

Dejano de Meza

[contact removed]

[contact removed]

The application process

This is how applying via Randstad Professional works. Discover how we can help you find a job.

1 of 5

Our consultant Dejano de Meza reviews your profile

We always look further with an eye for your talent and experience

2 of 5

We provide clarity quickly

Within 2 working days, you will know exactly where you stand and what the next steps are

3 of 5

Personal advice

If there's a match, we'll delve into your ambitions, expertise, and career opportunities together

4 of 5

Proposals to top clients

We will introduce you to the client and guide you to the perfect challenge

5 of 5

A tailored offer

Together, we close the deal with an attractive contract for an interim assignment or permanent position

-

print

Send by email

• Impact analysis / quick scan of relevant AI legislation.
• Execution and guidance of privacy risk analyses.
• Identification, assessment, and documentation of privacy risks in the risk log.
• Advising on appropriate technical, organizational, and legal privacy measures.
• Reviewing the AI solution against the GDPR, the AI Act, municipal privacy frameworks, and other relevant laws and regulations.
• Assessing architecture, cloud, integration, and data processing choices from a privacy and data protection perspective.
• Identifying risks related to personal data, AI applications, data minimization, data exchange, and supplier dependencies.
• Drafting and guiding the DPIA and formulating privacy measures.
• Documenting privacy considerations, risk acceptances, and residual risks.
• Advising on transparency, legal bases, retention periods, data subject rights, and human intervention in AI applications.
• Ensuring that the solution is responsible, manageable, and implementable from a privacy and compliance perspective.
• Minimum of 5 years of work experience as a Senior Privacy Advisor, Privacy Officer, Privacy Consultant, Data Protection Officer (not being the FG), or a comparable role.
• Demonstrable experience with privacy legislation, data protection, privacy governance, and compliance.
• Experience with executing and guiding DPIAs, privacy risk analyses, and drafting privacy advice.
• Extensive knowledge of relevant laws and regulations such as the GDPR, the AI Act, and related national and European directives.
• Experience with cloud environments, data exchange, and digital service provision.
• Experience with assessing data processing activities, processor relationships, and supplier risks.
• Experience with AI, data, or automation issues is a plus.
• Experience within the (semi-)public sector or an organization with high demands on compliance, transparency, and data protection is a plus.

Project details

• Start: flexible
• Location: Hoofddorp, NL
• Languages: Dutch