Data Protection Specialist

The Role

This role sits within the Group Data Protection team, as part of the second line of defence to embed the Groups Data Protection framework and approach for effective data protection management.

The role acts as a bridge between Group-level data protection activities and business-specific management of related risks. It assists specific businesses in managing their data protection risks in line with groupwide requirements, and in transparently managing their related risks.

Business Advice and Stakeholder Engagement

• Advise business stakeholders when completing Data Protection Impact Assessments for new and revised processing of personal data, especially regarding assessment of risk and associated control implementation
• Advise business stakeholders within the context of third-party management where personal data is in scope, in collaboration with Information Security and Procurement teams
• Assist in investigation, resolution, and remedial action of data protection-related incidents Report outcomes to the Group Data Protection Manager and where appropriate Data Protection Officer
• Respond to ad-hoc data protection queries from business stakeholders
• Host regular sessions with stakeholders in covered businesses, to build awareness of data protection requirements and to highlight areas of emerging risk
• Deliver data protection training tailored to the roles and responsibilities of individuals within the business
• Horizon scanning of relevant industry updates and cascade as appropriate
• Oversight and management of team inbox

Monitoring

• Review and challenge data protection related documents produced by covered businesses, including documents such as Data Protection Impact Assessments, Information Asset Registers and Fair Processing Notices
• Monitor completion and accuracy of Information Asset Registers
• Confirm that data subject request procedures are appropriately implemented and effective
• Review high risk supplier contracts as identified through the Data Protection Impact Assessment process
• Ensure Information Asset Owners are aware of their responsibilities and have relevant business unit procedures aligned to the Group Data Protection Policy

Reporting

• Escalate data protection risks and issues to the Group Data Protection Manager
• Review business-reported management information and risk assessments, challenging its accuracy, conclusions drawn from it, and appropriateness of actions to address any issues identified
• Create Group level management information to assist in oversight and trend analysis

The Candidate:

Essential

• Expertise in national and European data protection laws, specifically including in-depth understanding of the UK General Data Protection Regulation and Privacy and Electronic Communications Regulations
• Excellent communication skills with all levels of the business
• Strong attention to detail and analytical skills
• Understand technical data security measures available to the business

Essential

• Hold or be actively seeking Practitioner level Certification in Data Protection, Certified Information Privacy Professional / Europe qualification or equivalent

Desirable

• Financial services experience
• Degree level or equivalent education or qualified by experience