About the Company:
Tools for Humanity (TFH) designs and builds technology behind World. World is building a real human network designed to accelerate people in the age of AI. As bots and autonomous agents reshape the internet, people, institutions, and applications need a trusted way to confirm who is a real human while preserving privacy. The TFH and World tech stacks make this possible: the Orb verifies real, unique people, World ID proves it privately, and World App puts these capabilities, and more, in people’s hands. Together, they add a human layer to an AI-driven internet.
World is already running at a global scale. More than 17 million people across 160 countries have verified with World ID, and more new Orb verifications take place each week. World App is already among the most used wallets globally. Developers are integrating World ID to build safer online experiences and create spaces where real people can participate, earn, and be recognized in ways AI simply can’t replicate.
Founded in 2019, TFH has more than 400 people across hardware, software, AI, cryptography, mobile engineering, and global operations. Our teams come from OpenAI, Tesla, SpaceX, Apple, Google, Stripe, Meta, Coinbase, Palantir and MIT Media Lab. We’re backed by leading investors, including a16z, Khosla Ventures, Bain Capital Crypto, Blockchain Capital, Variant, Tiger Global, and Coinbase Ventures, as well as prominent operators and founders across fintech and AI.
TFH and World have been featured on the cover of TIME Magazine, highlighted in Fast Company’s Next 5 in Fintech, and explored in a Bloomberg deep dive. The New York Times, Bankless and TechCrunch have all recognized our collective progress in identity, cryptography, AI, and global-scale hardware deployment. Our leadership is also named to the Time AI 100. Learn more about the newest product launches from our Liftoff event.
Tools for Humanity is seeking an experienced and pragmatic privacy lawyer to join our Privacy team as Senior Counsel, Privacy & Data Protection Officer (EU/UK), based in Munich, Germany. This is a unique opportunity to help shape the privacy, data governance, and regulatory strategy for a high-profile technology project operating at the intersection of emerging technologies, digital identity, AI, and financial innovation.
Working directly with the Chief Privacy Officer and cross-functional leaders across legal, product, engineering, security, policy, and communications, you will play a critical role in designing and operationalizing scalable privacy and data protection frameworks globally. You will also serve as the designated Data Protection Officer (DPO) for applicable EU and UK entities under the GDPR and UK GDPR, acting as a trusted advisor to leadership, regulators, and internal stakeholders.
Drive the development and execution of the company’s strategies to address evolving global privacy, data governance, and AI regulatory requirements.
Advise on privacy-by-design and data protection-by-design principles across the full range of TFH products, services, and technologies.
Lead drafting, review, and maintenance of privacy notices, policies, disclosures, consent frameworks, and internal governance documentation.
Provide practical and strategic legal guidance on GDPR, UK GDPR, ePrivacy, AI regulation, biometrics, digital identity, cross-border transfers, marketing, cookies, and emerging global privacy frameworks.
Partner closely with product, engineering, security, policy, communications, and business teams to support innovative product development while managing legal and regulatory risk.
Oversee and support Data Protection Impact Assessments (DPIAs), Legitimate Interest Assessments (LIAs), vendor reviews, and records of processing activities (ROPAs).
Respond to and manage privacy-related regulatory inquiries, investigations, audits, and enforcement matters globally.
Support incident response, breach assessment, notification obligations, and remediation efforts in coordination with Security and Compliance teams.
Develop scalable privacy resources, templates, training materials, and operational tools that enable teams across the company to provide consistent and durable guidance.
Serve as the designated Data Protection Officer for relevant EU and UK entities.
Monitor organizational compliance with applicable data protection laws, regulations, policies, and standards.
Advise the company and internal stakeholders on obligations under GDPR, UK GDPR, CCPA and other global data protection frameworks.
Act as the primary point of contact for EU and UK supervisory authorities and cooperate with regulators on data protection matters.
Serve as a contact point for data subjects regarding the exercise of their privacy rights and inquiries relating to personal data processing.
Independently monitor compliance efforts, including audits, risk assessments, training initiatives, and governance processes.
Provide guidance on international data transfer mechanisms, including SCCs, transfer impact assessments, and evolving EU/UK transfer requirements.
Support the ongoing development and maturity of the company’s global privacy governance framework and accountability program.
Deep expertise in privacy, cybersecurity, AI, and technology regulation.
Strong working knowledge of GDPR, UK GDPR, ePrivacy requirements, CCPA LGPD, APAC privacy laws, and other major global privacy frameworks.
Experience supporting privacy compliance programs in multinational organizations.
Hands-on experience with privacy regulatory investigations, incident response management, breach reporting, and operational privacy governance.
Demonstrated understanding of data protection officer obligations and regulatory expectations in the EU and UK.
Ability to balance legal risk with practical business objectives in a fast-moving technology environment.
Strong strategic thinking and judgment with the ability to prioritize effectively amid ambiguity and evolving priorities.
Excellent written and verbal communication skills, including the ability to explain complex legal concepts to technical and non-legal audiences.
Detail-oriented, collaborative, business-minded, and comfortable operating independently in a high-growth environment.
Enthusiasm for emerging technologies, including AI, blockchain, digital identity systems, and cryptocurrency ecosystems.
Strong interpersonal skills and a positive, solutions-oriented mindset.
A sense of humor.
Fully qualified lawyer in Germany, another EU jurisdiction, the UK, or the United States (or equivalent foreign qualification).
Ability to serve as Data Protection Officer under GDPR and UK GDPR requirements.
8+ years of legal experience, including experience at a law firm, in-house legal department, and/or government authority.
Significant experience advising on global privacy laws, regulations, and compliance frameworks, particularly in the technology, internet, social media, AI, or digital products sectors.
Experience advising on privacy legal risks, mitigations, governance structures, and operational compliance programs.
Experience handling regulatory investigations and interactions with data protection authorities.
Experience working cross-functionally on multiple complex projects in fast-paced environments.
Excellent problem-solving, client counseling, and stakeholder management skills.
Fluent in German and English, other languages are a plus.
Prior experience serving as a Data Protection Officer or deputy DPO.
In-house experience at a multinational technology company.
Familiarity with AI governance, biometric data regulation, blockchain technologies, and cryptocurrency-related legal issues.
Working proficiency in German and/or additional European languages.
Relevant privacy certifications (e.g., CIPP/E, CIPM, CIPT) are a plus.
