Group Data Protection Executive – 9 month FTC

This is a fully remote position, open to applicants in United Kingdom.

📋 Description

• Manage the DPIA screening process and keep the central DPIA register updated.

• Evaluate screening questionnaires to determine when a complete DPIA is necessary.

• Collaborate with project and business teams to document processing, necessity and proportionality, risks, mitigations, owners, and review dates.

• Report high residual risk, novel processing, international transfers, AI usage, special-category data, and suggested prior consultations to the Group DPO.

• Log, acknowledge, and coordinate DSARs and other requests for rights.

• Define search parameters with relevant business sectors, maintain response timelines, and track disclosure materials.

• Assist in the review, redaction, and preparation of responses.

• Promptly receive and assess personal data incidents.

• Coordinate containment efforts, fact collection, investigation records, and root-cause analysis.

• Keep the breach register and notification schedule updated.

• Conduct initial reviews of data processing agreements and supplier privacy due diligence.

• Verify compliance with core Article 28 UK GDPR requirements, including security evidence, sub-processors, international transfers, breach assistance, audit rights, and exit arrangements.

• Aid in ROPA, data mapping, policy revisions, and engagement with privacy champions.

• Serve as the contact point for routine operational data protection inquiries from the Group's non-regulated businesses.

• Track legislative and regulatory changes and recommend updates to templates and processes for Group DPO approval.

• Assist the Group Data Protection Officer and the broader Legal and Data Protection team with essential privacy workflows.

⛳️ Requirements

• 1–3 years of hands-on experience in data protection, compliance, legal operations, or privacy.

• Practical experience in managing or significantly supporting DPIAs, DSARs, breach logs, or supplier privacy due diligence.

• Familiarity with the UK GDPR, the Data Protection Act 2018, PECR, and the current UK data protection framework.

• Excellent drafting, organizational, stakeholder management, and document review abilities.

• Capable of handling deadlines, sensitive information, and competing demands across various businesses while maintaining registers, trackers, MI, and audit evidence.

• IAPP CIPP/E, CIPM, BCS, or an equivalent privacy qualification, or progress towards one is preferred.

• Experience in professional services, financial services, or a multi-entity group is advantageous.

• Knowledge of DPA negotiation, international transfers, AI governance, or privacy-by-design reviews is desirable.

• Proficiency in SharePoint, workflow tools, and data mapping or privacy management software is a plus.

🏝️ Benefits

• A collaborative and purpose-driven work environment within a growing Group.

• Exposure to a variety of data protection issues across multiple business sectors.

• Opportunity to work closely with seasoned legal and compliance experts.

• Flexible working options, including hybrid or fully remote arrangements.