Data Privacy Specialist UK

Overview

This role sits within the organization’s Global Data Privacy team and reports to the Data Privacy Manager. You will provide day-to-day specialist data privacy advice across the Group, supporting lawful, consistent, and demonstrable handling of personal data across every jurisdiction in which the organization operates. The position is multi-jurisdictional and covers all disciplines of data privacy rather than focusing on a single area.

The work includes handling inherited records, legacy systems, long retention tails, and processing designed under a previous owner, requiring judgment on what to prioritize within those constraints.

Responsibilities

• Provide day-to-day specialist data privacy advice across the Group to ensure personal data is handled lawfully, consistently, and demonstrably in each operating jurisdiction.
• Deliver assigned workstreams within the data privacy maturity programme, from baseline assessment through to evidenced closure.
• Operate in a Group-wide, multi-jurisdictional role, coordinating with colleagues in the UK, US, and other time zones.
• Apply independent specialist judgment to analyze complex, multi-jurisdictional issues and recommend proportionate solutions, including prioritization decisions for inherited records, legacy systems, long retention tails, and legacy processing.
• Escalate appropriately to the Data Privacy Manager. Note: legal conclusions and acceptance of business risk remain with the Head of Data Privacy, the DPO, and relevant business owners.

Key Privacy Workstreams

• Privacy by Design and Default

  • Advise project teams on applying Privacy by Design and Default principles.
  • Support initiatives to embed these principles across the organization.
  • Deliver relevant training.

• PIAs, DPIAs, and LIAs

  • Produce privacy impact assessments (PIAs), data protection impact assessments (DPIAs), and legitimate interests assessments (LIAs), including assessments escalated following screening by the Analyst.
  • Submit completed assessments to the Data Privacy Manager for quality review, with residual risk decisions taken by the DPO, Head of Data Privacy, or business owner as applicable.

• Consumer and data subject rights

  • Advise on data subject rights requests across all jurisdictions.
  • Handle complex or multi-jurisdictional cases, including those referred by the Analyst, ensuring each case is recorded end to end.

• ROPA, inventories, and data maps

  • Maintain and update the record of processing activities (ROPA), with support for the Data Privacy Manager.

• Regulatory compliance and horizon scanning

  • Support the Data Privacy Manager in maintaining compliance with applicable data protection legislation across all operating jurisdictions (UK GDPR, EU GDPR, US privacy laws, and the Australian Privacy Act).
  • Monitor regulatory developments through the Horizon Scanning Framework.

• Regulatory registrations and filings

  • Assist with regulatory registrations and filings.

• Privacy notices, cookies, and consent

  • Review and update privacy notices and cookie consent management.

• Supplier privacy due diligence

  • Assist with privacy due diligence on third-party suppliers as part of the Supplier Engagement Framework.

• Data Processing Agreements

  • Review Data Processing Agreements (DPAs) with relevant data processors and recommend changes.

• International transfers and TIAs/TRAs

  • Assist with international data transfer mechanisms across all operating jurisdictions, ensuring they are current, properly documented, and subject to regular review.
  • Produce transfer impact or risk assessments (TIAs/TRAs) where required.
  • Develop recommendations for Data Privacy Manager review and maintain oversight of cross-border data flows arising from third-party arrangements.

• Privacy incidents and breaches

  • Assist with handling personal data incidents from identification through resolution.
  • Where required, support the DPO in assessing and managing notifiable breaches across jurisdictions.
  • Liaise with Information Security to align incident management processes.

• Breach response testing

  • Assist with testing of the Data Breach Response Plan.

• Privacy advice and business engagement

  • Provide day-to-day specialist advice across the Group.
  • Translate complex privacy requirements into practical guidance suitable for non-specialist stakeholders.

• Training and awareness

  • Design and deliver data privacy training for employees and contractors at all levels.
  • Monitor completion rates and champion privacy awareness across the business.

• Privacy Champions Programme

  • Coordinate deployment, day-to-day support, and development of the Data Privacy Champions network.

• Privacy risk register and mitigation

  • Assist with maintaining and developing the data privacy risk register within the Group’s ERM framework across all jurisdictions.
  • Identify and assess privacy risks, develop proportionate mitigation plans and controls, deliver assigned mitigation actions, and track/report progress while collaborating with relevant business functions.

• Policies and procedures

  • Assist with reviewing data protection policies and procedures across all jurisdictions.

• Management information and reporting

  • Prepare management information and reports on the status of the privacy programme for the Data Privacy Manager and relevant stakeholders.

Requirements

• Minimum 4 to 6 years of substantive, hands-on data privacy experience, ideally gained within a regulated financial services, insurance, or professional services environment.
• Relevant professional qualification: CIPP/E, CIPM, or equivalent.
• Demonstrable expertise in UK GDPR and the Data Protection Act 2018.
• Solid working knowledge of EU GDPR and at least one of:
  • US privacy law (GLBA, CCPA/CPRA, state privacy laws), or
  • Australian privacy law (Privacy Act 1988, APPs, NDB scheme).
• Demonstrable breadth across all disciplines of data privacy (not deep specialism in only one or two areas).
• Practical experience of data subject rights at volume, including DSARs in a regulated sector context.
• Proven experience conducting DPIAs and providing Privacy by Design advice to business stakeholders.
• Experience negotiating and reviewing Data Processing Agreements and international data transfer mechanisms.
• Demonstrable experience managing personal data breaches and advising on regulatory notification obligations.
• Ability to plan and deliver assigned workstreams to time, and report progress.
• Ability to work productively and visibly in a remote setting across time zones.
• Clear written English, including the ability to produce policies and guidance that a non-specialist can follow.

Preferred Qualifications

• Experience in the insurance or reinsurance sector, including familiarity with insurance-specific data processing activities (claims, underwriting, fraud prevention databases, actuarial processing).
• Further certification such as CIPM, CIPT, or Fellow of Information Privacy, or a relevant legal qualification.
• Knowledge of the NAIC Insurance Data Security Model Law and state insurance commissioner notification requirements.
• Familiarity with the California Insurance Information and Privacy Protection Act (IIPPA) and its 2023 amendments.
• Experience working within a multi-jurisdictional privacy programme spanning EEA, UK, US and/or Australian operations simultaneously.
• Experience of privacy due diligence and integration on mergers, acquisitions, or portfolio transfers.
• Familiarity with ISO 27701, ISO 27001, SOC 2, or NIST, and experience working alongside an information security team.
• Hands-on use of privacy management tooling (e.g., OneTrust or TrustArc), including consent management platforms.
• Technical literacy to read data flow or architecture diagrams and understand deletion across databases, logs, archives, and backups.
• Interest in artificial intelligence governance and emerging obligations under the EU AI Act.
• Legal qualification (solicitor, barrister, or overseas equivalent) or privacy law academic background.

Compensation & Benefits

• Pension: automatic enrolment with a 10% employer contribution.
• Dental Insurance: optional taxable benefit for employees, spouse, and dependents.
• Medical Insurance: optional taxable benefit available through a private health network for employees, spouse, and dependents.
• Travel Insurance: automatically enrolled for business and leisure travel; coverage options include single, couple, family, or single parent family.
• 360 Health Assessment: eligible company-funded annual assessment.
• Eye examination voucher: free annual eye examination.
• Bicycle loan: option to loan a bicycle and safety equipment tax free.
• Wellness Reimbursement: up to £700 annual reimbursement for wellness-related expenses (e.g., gym memberships, massage).
• Tusker – Electric Vehicle: fixed monthly amount deducted from gross salary in exchange for use of a brand new electric car.
• Critical Illness coverage: optional.
• Income protection: automatic coverage provided by the income protection programme.
• Employee Assistance Programs (EAP): access for health and wellbeing.
• Volunteer day: one paid annual volunteer day.

Location

The role is part of the Global Data Privacy team and involves coordinating with colleagues in the UK and US and working across time zones. Remote working is required/expected.

Equal Opportunity

The organization is an equal opportunity employer and is committed to providing an accessible recruitment experience. Reasonable accommodation is available during the application process where needed to enable full participation.