Legal and Privacy Manager

Who we are 

At Heart & Stroke our mission is to promote health, save lives and enhance recovery. We are committed to a culture that exemplifies our core values: champion health, practice humility, embrace change, drive impact, learn and grow and be heartfelt as we work together to beat heart disease and stroke. 

We believe in equity, diversity and inclusion ― it’s embedded in our values and core mission work to support all people in Canada to lead healthier lives. We are committed to applying this principle to cultivate a welcoming environment that embraces diversity among our employees. Candidates from diverse backgrounds, including but not limited to, Indigenous peoples, racialized communities, 2SLGBTQIA+ communities, women, and people living with disabilities are encouraged to apply. 

To learn more about our mission, values, commitment to EDI, and the difference Heart & Stroke makes in the lives of people in Canada at every age, please visit our website. 

The opportunity 

This is an exciting opportunity to bring your legal, privacy and risk expertise to mission-driven work that makes a difference in the lives of people across Canada. Heart & Stroke offers a flexible remote work environment with the ability to work from anywhere in Canada. From time to time, occasional travel to the Toronto office may be required as well as responsiveness outside regular business hours to support time-sensitive matters, such as privacy incidents.

his role partners with business units to advance mission-driven work by providing practical legal, privacy and compliance guidance that balances operational needs, stakeholder experience, donor trust, regulatory obligations and organizational risk tolerance to support risk-informed decisions.  

 More specifically, this role manages the day-to-day operations of the privacy program, supports contract review and negotiation, and helps maintain the enterprise risk management program.  

Working under the direction of the Legal Counsel & Director, Risk Management, this role also provides operational execution and advisory support, escalating complex or high-risk matters as appropriate. The role also works with external stakeholders, including regulatory bodies and third-party service providers, to support compliance and risk mitigation. 

How you will make an impact every day 

Manage and maintain a national privacy portfolio.  

• Manage a consolidated database of where, how and why personal information collected, used, stored, retained and destructed (where applicable).    

• Manage, oversee, implement and maintain a national retention policy  

• Maintain and update a public facing national privacy policy and terms of use and monitor its ongoing implementation  

• Maintain and update internal privacy policies  

• Oversee internal privacy procedures; identify the necessary procedures and delegate to the appropriate business units.     

• Monitor and negotiate agreements with third parties that host, collect, use, or have any other relationship with HSFC collected personal information  

• Manage privacy inquiries and complaints, including escalation and reporting, both internal and external where required  

• Oversee the maintenance of suppression lists of people that don’t want to be contacted  

• Track and monitor all privacy complaints; collect analytics to track progress over time  

• Support the management of privacy breaches, including ensuring compliance with reporting requirements and communicating with affected individuals, both internal and external, as necessary.   

• Review digital and print materials prior to publishing for compliance with privacy legislation and CASL  

• Conduct privacy reviews of digital initiatives, platforms and third-party engagements  

• Deliver training sessions and refreshers as necessary on privacy procedures  

• Advise nationally on privacy issues  

• Monitor and stay abreast of any new developments in legislation, guidelines and industry standards  

Support enterprise risk management processes   

• Support the maintenance of the enterprise risk management framework  

• Maintain the enterprise risk management risk registrar  

• Support the coordination of the annual and quarterly enterprise risk management cycle  

• Support business units in identifying and documenting operational and regulatory risks  

• Track and monitor mitigation actions and contribute to reporting requirements and trend analysis  

• Promote awareness of risk management practices across the organization 

Support contract review and provide legal advice to business units   

• Review, draft and negotiate low to medium complexity contracts   

• Engage with business early in the process to provide strategic advice and guide negotiations and terms prior to contract drafting  

• Provide guidance and insight to business units on legal obligations and responsibilities and lead contract reviews in a timely fashion   

• Negotiate with third parties on behalf of the Foundation to represent its interests  

• Provide practical, business-oriented legal advice on contractual obligations and risk mitigation to ensure H&S interests are protected   

• Partner with business units to provide practical, solution oriented legal and contract risk support that creatively still enables organizational objectives while helping to identify and assess enterprise and reputational risk  

•  Continuously evaluate and improve training materials, processes, and delivery methods to enhance the efficiency, quality, and consistency of review activities across the organization.  

• Escalate complex or high-risk matters to the Director as appropriate 

Provide regulatory compliance support and legal research   

• Advise stakeholders on regulatory developments and provide business appropriate and practical solutions Conduct legal research and prepare summaries on relevant laws, regulations and guidance  

• Support responses to regulatory inquiries, complaints and investigations 

Support corporate and legal operations   

• Oversee annual renewal of all insurance policies for the Foundation, including D&O insurance, through working with the Foundation’s broker  

• Draft updates for the Board and make recommendations on insurance coverage  

• Negotiate and review contracts to ensure appropriate insurance coverage  

• Liaise with broker as needed to update the policies  

• Lead process of claims as necessary  

• Assist with corporate filings and regulatory compliance tracking 

Who we need 

Education 

• Law Degree (LL.B. or J.D.)  

• Called to the Ontario Bar Association and Member in good standing with the Law Society of Ontario   

Experience 

• 2-4 years professional experience in a firm, private practice, or in-house environment   

• Experience in one or more of the following areas:  

• Privacy and data protection (e.g., PIPEDA, CASL; Quebec Law 25)  

• Commercial contracting  

• In-house or advisory roles supporting business stakeholders 

Skills  

• Critical and analytical thinking is essential  

• Excellent written and verbal communication skills  

• Ability to influence and communicate effectively internally and externally at all levels;   

• Ability to balance and address both business and legal considerations   

• Positive, team player; motivated and proactive   

• Experience with enterprise risk management framework and processes  

• Strong analytical, drafting, influencing and negotiation skills   

• Capable of multi-tasking and managing multiple projects by being flexible, organized and able to prioritize many projects at once and manage own workload independently  

• Strong decision-making / problem solving ability while remaining client focused and solution oriented.   

• competency in Microsoft Word, Excel, Power Point and virtual technologies for communication (ie -MS Teams)   

What we offer 

At Heart & Stroke, we make it a priority to foster a culture of caring by implementing practices and programs that foster respect, compassion, trust and attentiveness to our own and others’ health and well-being. 

This role offers a hiring range of $95,000 to $115,000, aligned with our compensation framework and your professional background. We believe that time off is integral to the personal health and wellness of our employees. We offer a generous paid time-off package including vacation days, personal days, wellness days, and paid company-wide closure between December 25 and January 1. We also provide competitive health, medical, dental and vision benefits, life insurance, disability benefits, an employee assistance program (EAP) and a defined contribution pension plan with employer matching. Our employees also enjoy a flexible hybrid working model and reimbursement for mobile phones and home office setup, as well as opportunities for professional development.  

Apply now 

If you want to join the fight to beat heart disease and stroke, please apply by sending your resume by July 24, 2026. Applicants must be currently residing in Canada and legally entitled to work in Canada. 

Only those candidates that qualify will be selected for an interview. Interviews may be conducted virtually or in-person. Selected candidates will be notified in advance if an in-person interview is required. 

Accommodation 

We are committed to fostering an inclusive, barrier-free and accessible environment. If you have been contacted for an interview and require accommodation to participate in the recruitment and selection process, please let us know and we will do our best to address your needs.