Compliance Manager – Privacy

American Express

. Provide Second Line of Defence oversight and effective challenge of potential privacy and data breach incidents affecting Amex Bank of Canada and Canadian individuals .

Posted 11/2/2026full-timeToronto • CanadaMid-LevelSenior💰 CA$100,000 - CA$150,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in Canadian privacy compliance, including PIPEDA and regulatory requirements, while effectively managing privacy risks and incidents. Strong analytical and communication skills are essential for engaging with stakeholders and providing compliance guidance.

Highest-signal resume keywords

Canadian Privacy CompliancePrivacy Risk ManagementRegulatory Breach NotificationPrivacy Impact AssessmentsStakeholder Management

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Privacy LawRegulatory CompliancePrivacy Risk AssessmentsData Breach AssessmentPrivacy Access RequestsPrivacy Complaints HandlingRegulatory ReportingAnalytical SkillsPrivacy Governance FrameworksPIPEDA Knowledge

Soft Skills

Excellent Communication SkillsStrong Analytical SkillsStakeholder ManagementAbility to Manage Complex MattersCollaboration Skills

Certifications & Qualifications

CIPP/CCIPP/ECIPM

Industry Keywords

Privacy ComplianceData ProtectionOffice of the Privacy Commissioner of CanadaCanadian Financial InstitutionRegulatory Inquiries

About the role

Key responsibilities & impact

Provide Second Line of Defence oversight and effective challenge of potential privacy and data breach incidents affecting Amex Bank of Canada and Canadian individuals
Review incident assessments and independently assess application of Canadian privacy requirements
Assess potential breaches against Canadian notification requirements and recommend whether notification to affected individuals, the OPC, or other authorities is required
Support documentation of regulatory reporting and notification determinations
Oversee and challenge First Line of Defence management of personal information access requests
Review complex or escalated privacy access matters and provide compliance guidance
Review and support responses to escalated privacy complaints, including complaints involving the OPC
Support regulatory inquiries, investigations, and engagement with the OPC
Support execution and oversight of Privacy Risk Assessments for Canadian initiatives, products, processes, technologies, and changes
Partner with Global Privacy Oversight and International Privacy Risk Management to apply enterprise frameworks in the Canadian regulatory context
Identify and escalate Canadian-specific legal, regulatory, and privacy risks
Identify emerging privacy risks, control gaps, and recurring themes and escalate material concerns
Support Canadian privacy risk reporting and governance, including metrics, trends, and insights for senior management and risk committees
Assess Canadian privacy regulatory developments and their impact on policies, controls, and business practices
Partner with Legal, Operational Risk, Information Security, Technology, business, and Compliance teams
Contribute to enhancements of the privacy compliance framework, including policies, procedures, governance, controls, training, and monitoring
Maintain records and evidence supporting privacy oversight, regulatory assessments, and key decisions

Requirements

What you’ll need

5–7 years of relevant experience in privacy compliance, privacy law, regulatory compliance, or privacy risk management, preferably within a Canadian financial institution or other highly regulated organization
University degree in law, business, risk management, privacy, information management, or a related discipline, or equivalent relevant professional experience
CIPP/C, CIPP/E, CIPM, or other recognized privacy certification considered a strong asset
Strong knowledge of Canadian privacy and data protection requirements, particularly PIPEDA, associated regulations, and guidance issued by the Office of the Privacy Commissioner of Canada
Demonstrated experience assessing privacy/data breaches, including regulatory breach notification and reporting requirements
Experience with privacy access requests, privacy complaints, regulatory inquiries, and/or privacy risk or impact assessments
Strong analytical skills and regulatory judgment
Excellent written and verbal communication skills, including communicating complex privacy matters clearly to senior leaders, business partners, and risk stakeholders
Strong stakeholder-management skills and ability to work across Legal, Compliance, Risk, Technology, Information Security, and business teams
Ability to manage multiple complex and potentially time-sensitive matters, including privacy incidents and regulatory deadlines
Experience engaging with or responding to matters involving the Office of the Privacy Commissioner of Canada
Experience conducting or reviewing Privacy Impact Assessments, Privacy Risk Assessments, or similar privacy-by-design assessments
Familiarity with enterprise privacy governance frameworks and global organizations where local regulatory requirements must be integrated with enterprise standards
Employment eligibility to work with American Express; the company will not pursue visa sponsorship

Benefits

Comp & perks

Competitive base salaries
Bonus incentives
Support for financial well-being and retirement
Comprehensive medical, dental, vision, life insurance, and disability benefits (depending on location)
Flexible working model with hybrid, onsite or virtual arrangements depending on role and business need
Generous paid parental leave policies (depending on your location)
Free access to global on-site wellness centers staffed with nurses and doctors (depending on location)
Free and confidential counseling support through the Healthy Minds program
Career development and training opportunities