Privacy Counsel and Data Protection Officer Toronto GTA · New York · San Francisco →

About Mecka AI

Mecka AI is building the data infrastructure layer for robotics and embodied AI.
We design and operate global systems for data capture, data labeling, and hardware-enabled workflows used by leading AI labs and robotics companies to train and validate humanoid and embodied AI systems.
We work closely with frontier robotics teams to bridge real-world data, simulation, learning-based systems, and deployed hardware.

About the Role

We collect egocentric video data for AI training through our own capture teams, through commercial partners, and through individual contributors using our mobile app. In each of these models, the questions that decide whether a market can operate are privacy questions: whether valid consent has been obtained, how footage leaves the country where it was recorded, and which registrations, filings, and regulatory appointments each operating entity needs.

As Privacy Counsel and Data Protection Officer, you will own the privacy programme across every market and capture model we run. You will maintain and update the consent standard our teams and partners follow, maintain and build upon the cross-border transfer and registration framework for each operating entity, and work with engineering and operations so that controls such as redaction, retention, deletion, and access limits continue to be considered in product design. You will be the first call for operations teams on privacy questions and will manage outside privacy counsel in each jurisdiction.

In your capacity as Data Protection Officer, you will independently advise the company on its data protection obligations, monitor compliance, and act as the lead point of contact for data subjects and supervisory authorities globally. You will have direct access to senior management, appropriate resources to perform the DPO function, and independence in carrying out your statutory responsibilities.

What You Will Do

• Privacy programme: Maintain and build upon the privacy and data protection programme across all markets and capture models, including records of processing, impact assessments, retention schedules, and policies that operating teams can apply without a legal review of every question. Develop and deliver privacy training for relevant employees, contractors, partners, and other stakeholders.
• Data Protection Officer : Independently advise the company and its personnel on applicable data protection requirements; monitor compliance with applicable laws and internal policies; advise on data protection impact assessments; and report material privacy risk. Serve as the point of contact for data subjects and supervisory authorities and cooperate with regulators where required.
• Consent: Own the consent and transparency framework for contributors, venue owners, and bystanders, maintain the approved consent forms, privacy notices, disclosures, and related records used in every capture model, and continue to update those standards into partner and vendor agreements.
• Cross-border data: Continue to implement and monitor the transfer mechanisms that let footage move from the country of capture to our storage and processing, and manage regulator registrations, local data protection representative appointments, and local filings for each operating entity.
• Privacy by design: Partner with engineering, product, security, and quality teams on redaction, encryption, access controls, data minimization, and deletion, and review new capture models, datasets, and customer deliveries before they go live.
• Incidents and counsel: Advise operations teams on the privacy conditions a market must meet before it opens, lead the response to data incidents, data subject requests, complaints, and regulator inquiries, including assessing notification and remediation obligations, and manage outside privacy counsel against clear scopes and budgets.

What You Bring

• Qualification: Law degree and admission to practice in at least one jurisdiction.
• Experience: 5 to 8+ years of privacy and data protection practice, with time both at a top tier law firm and in-house at a high-growth technology, marketplace, AI, or data company.
• DPO capabilities: Demonstrated ability to perform the DPO function independently and objectively; communicate directly with senior management and regulators .Multi-jurisdiction: Hands-on experience advising on data protection regimes in several countries at once, including consent, cross-border transfers, data protection impact assessments, data breach response, and regulator registration, and managing outside counsel across those countries.
• Technical and operational judgment: Ability to translate complex privacy requirements into practical controls for engineering, operations, and delivery teams.

Even better if you have

• Data type: Experience with video, image, biometric, or location data, or with datasets collected or processed for machine learning training.
• Certification: A privacy certification such as CIPP/E, CIPP/A, or CIPM.
• Industry: In-house experience at a marketplace, delivery, AI, data, or gig platform operating across emerging markets.
• SOC 2 compliance or audit-readiness initiatives is an asset.
• Regulatory engagement: Experience communicating with data protection authorities, responding to regulatory inquiries, and managing multi-jurisdictional personal data incidents.

We strive to create an inclusive work environment for all; we welcome applicants from all backgrounds and are committed to providing equal opportunities. Should you require any accommodations during the recruitment process, we will partner with you to meet your needs.

We may use AI-assisted tools to help evaluate applications against the requirements of this role. These tools support our recruiting team in identifying qualified candidates but do not replace human judgment or limit which applications may be reviewed or considered.