Data Privacy and Retention Analyst (12 Month FTC)

Location: London/Hybrid (Typically 2/3 days in the office)

Type: Full time - 12 Months Fixed Term

At Ardonagh Specialty, we provide much more than just a workplace. We are dedicated to fostering skill development and knowledge within a team that is passionate about their work, values their Employees, and truly celebrates diversity. Working at Ardonagh Specialty means you’ll be part of The Ardonagh Group. We are proud of our innovative environment offering many opportunities for growth across the wider group. Employees regularly move between our united teams, and we encourage you to make your role your own. Our offices are lively and exciting places to be, but we understand that life needs flexibility, and offer a genuinely flexible approach to working.

What we can offer:

• Inclusive culture with apprenticeships, study support, participation in our annual Spotlight Awards, Community Trust, Sports Teams, office socials, events and so much more.
• Access to wellbeing programs, fantastic discounts across many big-name businesses including supermarkets, gym memberships, restaurants, and healthcare cash plans.
• Employer pension contribution of 10% (providing you, the Employee provides 5%).
• Good work life balance - flexibility to suit you.
• Competitive salary.
• Life Assurance at X4 of your base salary.
• Group Income Protection.
• Generous Annual Leave entitlement.
• Private Medical Insurance.
• Group annual bonus scheme.

Purpose of the Role:

To provide analytical and operational support across data protection, privacy governance, records management, and data retention activities. The role supports the organisation in meeting its legal, regulatory, and contractual obligations by maintaining effective privacy controls, retention frameworks, information governance processes, and regular compliance monitoring. Working within the controls defined by the Ardonagh Specialty Data Protection Policy, Records Management Framework, Data Retention Standards, and relevant regulatory requirements, the role is responsible for analysing privacy and information governance risks, supporting compliance activities, maintaining records of processing, coordinating retention and disposal initiatives, and producing management information to demonstrate compliance. The assignment will extend to focus on the continuous improvement of privacy and information governance practices, helping to ensure that personal data is managed lawfully, securely, transparently, and retained only for as long as necessary in accordance with UK GDPR, Data Protection Act requirements, FCA expectations, and internal policies.

Key Role Accountabilities:

• Support the delivery and ongoing operation of Ardonagh Specialty's data protection, records management, and data retention frameworks.
• Monitor compliance with data protection and retention requirements, identifying areas of risk and supporting remediation activities.
• Coordinate periodic reviews of retention schedules with business owners to ensure retention periods remain accurate, justified, and aligned to legal, regulatory, and business requirements.
• Manage the retention schedule update process, maintaining records of approved changes and ensuring updates are communicated and implemented across relevant systems and processes.
• Oversee disposition review activities, ensuring records identified for deletion or archival are reviewed, approved, and processed in accordance with retention standards and governance requirements.
• Assist with the investigation, documentation, and management of privacy incidents, near misses, and data subject rights requests where required.
• Maintain privacy and information governance documentation, including Records of Processing Activities (ROPAs), data inventories, retention schedules, and supporting compliance records.
• Support with the completion and administration of Data Protection Impact Assessments (DPIAs), Legitimate Interest Assessments (LIAs), Transfer Risk Assessments (TRAs), and other privacy assessments.
• Monitor and track privacy and information governance actions, risks, and remediation activities, escalating issues where appropriate.
• Provide operational support and guidance to business stakeholders on data protection, records management, and retention requirements.
• Work closely with the DPO, Digital, Risk & Compliance, Legal, and business stakeholders to embed privacy-by-design and effective information governance practices across the organisation.

Qualifications & Experience:

• Experience in providing advice on all matters relating to data protection, with proven experience working in data protection, ideally spanning data retention, records management, records of processing activities, and incident management.
• Strong understanding of UK GDPR, Data Protection Act requirements, and core data protection principles.
• Experience using data privacy tooling, specifically OneTrust.
• Understanding of records management and data retention principles, including retention schedules, records disposal, and defensible deletion practices.
• Experience coordinating activities across multiple stakeholders and tracking actions through to completion.
• Ability to interpret policies, standards, and regulatory requirements and apply them to operational processes.
• Experience in regulated environments (financial services, insurance, or similar) is beneficial.
• Familiarity with responsible AI principles.

Person Specification:

The role requires a detail-oriented and proactive individual who is comfortable working across multiple concurrent workstreams spanning data privacy and protection, data retention and records management, coordinating with a range of stakeholders and maintaining accurate records and documentation to support compliance. They must bring strong attention to detail, intellectual curiosity, and the ability to interpret policies, standards, and regulatory requirements, and apply them to operational processes and produce business-focused insights. The ideal candidate is structured, well-organised, and capable of operating with limited oversight while engaging confidently with stakeholders across Digital, Risk & Compliance, the DPO, and business functions. They will be methodical in their approach, committed to accuracy and quality, and capable of managing routine operational activities with limited supervision. A collaborative mindset, willingness to learn, and a continuous improvement focus are essential, alongside a commitment to ensuring personal data and business information are managed responsibly, securely, and in accordance with legal, regulatory, and organisational requirements.

If you’re excited about this role, but your experience doesn’t perfectly match what we are looking for, please apply anyway. You might just be the right fit for the job, or other opportunities we may have within the wider Group.

If your application is successful, we will conduct relevant employment checks prior to you commencing employment with us. These will include verifying your recent employment, address, credit history, and a standard criminal record check.