Data Protection Manager

FIFA has established a Local FIFA Subsidiary in Brazil to work together with FIFA Zurich to deliver the biggest women's sporting event in the world, the FIFA Women's World Cup 2027™ (FWWC2027) that for the first time ever, is hosted in South America in Brazil. Reporting organizationally to the Head of Technology, the Data Protection Manager will be a key member of the FIFA27 Technology team and will work in close collaboration with FIFA's Data Protection Office and other key stakeholders to ensure that all data protection and privacy requirements for the FIFA Women's World Cup Brazil 2027™ are implemented in accordance with FIFA policies and applicable privacy legislation. The Data Protection Manager will lead the delivery of the tournament's data protection and privacy programme, providing expert guidance on privacy compliance, embedding privacy by design across operations and projects, and ensuring the secure, lawful, and responsible processing of personal data throughout the tournament lifecycle.

Responsibilities

Serve as the primary privacy and data protection lead for FIFA Women's World Cup Brazil 2027; Ensure compliance with LGPD and other applicable privacy and data protection requirements; Develop, implement, and maintain privacy policies, standards, procedures, and controls aligned with FIFA's global privacy framework and Brazilian legal requirements; Provide practical, risk based privacy guidance to business stakeholders and promote privacy by design across projects, systems, technologies, vendors, and business initiatives; Lead privacy-by-design reviews for projects, technologies, systems, events, products, and business initiatives, ensuring privacy requirements are embedded from inception; Conduct Privacy Impact Assessments (PIAs), Data Protection Impact Assessments (DPIAs), including Relatórios de Impacto à Proteção de Dados Pessoais (RIPD), privacy reviews, and risk assessments; Monitor developments in Brazilian privacy laws and regulations and advise on their impact on business operations; Manage data subject rights requests in accordance with LGPD and support the investigation and management of privacy incidents and personal data breaches; Review and negotiate privacy and data protection provisions in contracts and support third-party privacy risk assessments; Maintain records of processing activities and support privacy compliance reporting and documentation; Develop and deliver privacy training and awareness initiatives; Build strong relationships with internal and external stakeholders and support interactions with regulatory authorities where required; Partner closely with FIFA's global data protection team to ensure consistent implementation of enterprise-wide privacy standards while addressing Brazil specific requirements

Requirements

Bachelor's degree in Law, Compliance, Information Management, Information Security, Business Administration, or a related field; Strong experience in data protection, privacy, compliance, legal, information governance, or a related field; Expert knowledge of Brazilian data protection laws and regulations, particularly the Lei Geral de Proteção de Dados (LGPD), including practical experience advising on compliance, data subject rights, privacy risk assessments, and incident management; Good understanding of international privacy frameworks, including GDPR and cross-border data transfer requirements; Experience conducting PIAs, DPIAs, privacy reviews, and privacy risk assessments; Experience reviewing privacy provisions in contracts and managing third-party privacy risks; Strong analytical, problem-solving, and decision-making skills; Ability to provide pragmatic, business-focused, and risk-based advice; Excellent stakeholder management and communication skills; Strong organizational and project management capabilities; Ability to work independently and manage competing priorities in a fast-paced environment; Collaborative mindset with the ability to work effectively across cultures and functions; Privacy certification(s) such as CIPP, CIPM, CIPT, CDPO/BR, or equivalent; Experience supporting major international events, sports organizations, or large-scale projects; Familiarity with information security and cybersecurity principles; Right to work in Brazil; Fluent in English; Native or Fluent in Portuguese; Willing to travel within Brazil (up to 30%), with some trips with a long duration (15 days or more)

Nice to have

Experience working in multinational or matrixed environments is desirable; Proficiency in any other FIFA language (FR / ES / GER) is an asset