Global Head of Privacy

Position Summary

Reporting to the Head of Compliance (UK & Bermuda), Ascot Group is seeking a Global Head of Privacy to serve as a senior member of the Legal & Compliance team. This role will continue to develop and lead the global privacy function and advise on all matters relating to data protection, and data governance across all Ascot Group entities and jurisdictions. The role will collaborate closely with the Heads of Compliance on privacy and data protection matters, and with the Group General Counsel on group-wide strategic privacy and data governance issues.

Responsibilities

• Lead Ascot Group’s global privacy strategy ensuring compliance with GDPR (UK/EU), PIPA (Bermuda), CCPA/CPRA (California), HIPAA (US), Data Protection Law (Guernsey) and other applicable laws and regulations.
• Develop, maintain and enhance data protection policies and standards across the UK, US, Bermuda and Guernsey including training initiatives and monitoring.
• Provide practical regulatory and commercial advice to senior stakeholders and the business on data privacy related matters.
• Lead the response to data protection issues and breaches, partnering with Cybersecurity, Legal & Compliance leadership and other stakeholders to manage regulatory, legal, and reputational risk.
• Develop and execute an annual data privacy protection plan, conduct Data Protection Impact Assessments (DPIA), remediate any identified issues.
• Oversee the data privacy aspects of vendor and third‑party relationships, including negotiating and maintaining Data Processing Agreements, conducting processor due diligence, and ongoing monitoring.
• Manage and oversee Data Subject Access Requests (DSAR) across all jurisdictions, working with internal stakeholders and ensuring timely and legally compliant responses.
• Oversee cross‑border data transfer mechanisms (Standard Contractual Clauses, UK International Data Transfer Agreements, adequacy assessments), ensuring lawful transfers across Ascot Group’s global operations.
• Advise on data protection requirements specific to the (re)insurance industry, including Lloyd’s of London (and other applicable regulators) market data standards, policyholder and claimant data handling, and data flows across distribution, underwriting, and claims operations.
• Promote data protection awareness across the Ascot Group, including designing and delivering training and education sessions on key data protection issues.
• Remain current on changing data protection laws and regulation in the UK, US, Bermuda and Guernsey (and any other applicable jurisdictions).
• Serve as the primary point of contact for data protection regulators, including the UK Information Commissioner’s Office (ICO), the Bermuda Office of the Privacy Commissioner (PrivCom), (and other applicable regulators) and manage all regulatory correspondence, reporting, inquiries, and examinations.
• Develop strong and positive relationships with the Ascot business and supporting functions including Risk, Operations, Information Security, Cyber Security, Human Resources and Marketing.
• Collaborate with the UK Head of Compliance on UK, Bermuda and Guernsey privacy and data protection matters, ensuring efficiency and alignment with the group‑wide strategic privacy program.
• Collaborate with the US Head of Compliance on US privacy and data protection matters, ensuring efficiency and alignment with the group‑wide strategic privacy program.
• Partner with the Group General Counsel on group‑wide strategic privacy and data governance issues, including enterprise risk assessment, M&A due diligence, and board‑level reporting on data protection matters.

Requirements

Qualifications

• Degree (BA, MA, LLB, or equivalent) required.
• Preferred qualifications: CIPP/E (Certified Information Privacy Professional/Europe); CIPM (Certified Information Privacy Manager); CIPP/US, CIPT, or equivalent privacy certifications.

Experience and skills

• Minimum of 10 years experience in either (Re)Insurance, Financial Services (or equivalent regulated industry), a law firm or relevant in‑house position required.
• Experience advising on UK GDPR, EU GDPR, and/or multi‑jurisdictional data protection regimes required.
• Excellent communication, organisational and time‑management skills are essential.
• Established track record of execution and delivering results is required.
• Experience with AI governance, emerging AI regulation, and advising on the deployment of AI/ML tools in a regulated environment strongly preferred.

Additional information

This person must be commercially aware and results oriented. They understand that clients seek business outcomes, not just regulatory or legal advice, and work persistently to achieve them. Ability to work in a dynamic, fast‑paced environment and effectively prioritize matters for multiple stakeholders is essential. A self‑starter, who is comfortable working independently or as part of a collaborative team, with the initiative and desire to assist with multiple projects simultaneously. Ability to serve as a Senior Management Function (SMF) or Key Function Holder (KFH) role under the Financial Conduct Authority’s Senior Managers and Certification Regime. Ability to quickly adapt and learn new areas that might fall outside his/her scope of experience. Ability to travel internationally as needed.