Group Data Protection Executive - 9 month FTC

Overview

This role provides fixed-term cover for maternity leave (9-month FTC) as a Data Protection Executive. The position supports the Group Data Protection Officer (DPO) and the wider Legal and Data Protection team by managing core privacy workflows across the organization.

Responsibilities

• DPIAs and privacy by design

  • Run the DPIA screening process and maintain the central DPIA register
  • Review screening questionnaires and identify when a full DPIA is required
  • Facilitate assessments with project and business teams, documenting processing, necessity and proportionality, risks, mitigations, owners, and review dates
  • Escalate high residual risk, novel processing, international transfers, AI use, special-category data, and proposed prior consultations to the Group DPO

• Data subject rights requests (DSARs)

  • Log, acknowledge, and coordinate DSARs and other rights requests
  • Agree search scope with relevant business areas, maintain response timetables, and track disclosure materials
  • Support review, redaction, and preparation of responses

• Personal data breaches

  • Receive and triage incidents promptly
  • Coordinate containment, fact gathering, investigation records, and root-cause analysis
  • Maintain the breach register and notification timetable

• Supplier and DPA reviews

  • Conduct first-pass reviews of data processing agreements and supplier privacy due diligence
  • Check core Article 28 UK GDPR requirements, including security evidence, sub-processors, international transfers, breach assistance, audit rights, and exit arrangements

• Governance, advisory and awareness

  • Support ROPA, data mapping, policy updates, and privacy champion engagement
  • Serve as the point of contact for routine operational data protection queries from the organization’s non-regulated businesses
  • Monitor legislative and regulatory developments and propose updates to templates and processes for Group DPO approval

Requirements

• Essential

  • 1–3 years’ practical data protection, compliance, legal operations, or privacy experience
  • Hands-on experience handling or materially supporting DPIAs, DSARs, breach logs, or supplier privacy due diligence
  • Working knowledge of the UK GDPR, the Data Protection Act 2018, PECR, and the current UK data protection regime
  • Strong drafting, organisation, stakeholder management, and document-review skills
  • Ability to manage deadlines, sensitive information, and competing requests across multiple businesses, while maintaining registers, trackers, MI, and audit evidence

• Desirable

  • IAPP CIPP/E, CIPM, BCS, or equivalent privacy qualification (or active progress towards one)
  • Experience in professional services, financial services, or a multi-entity group
  • Exposure to DPA negotiation, international transfers, AI governance, or privacy-by-design reviews
  • Familiarity with SharePoint, workflow tools, and data-mapping or privacy-management platforms

Compensation & Benefits

• Basic salary (negotiable): £30,000–£40,000 pro rata, depending on experience
• Hybrid or fully remote and flexible working arrangements
• Collaborative, purpose-driven working environment within a growing organization
• Exposure to a broad range of data protection matters across multiple business lines
• Opportunity to work closely with experienced legal and compliance professionals

Location

Hybrid or fully remote (location not specified).