Senior Data Analyst in City of Westminster

The Data Governance & Privacy Analyst will work in a dynamic team responsible for delivering operational initiatives that drive data privacy and compliance. Responsibilities include contributing to the development and subsequent iterations of a roadmap for effective data mapping and lineage capabilities, establishing comprehensive and trustworthy repositories, and handling DSR (data subject requests), ROPA (records of processing activities) and DPIA (data protection impact assessment) documents. The role manages end‑to‑end projects, uses SQL and digital marketing knowledge to document data flows in compliance with U.S. and global regulatory standards, and supports the development of Condé Nast’s privacy programme maturity, efficiency and reporting.

Responsibilities

• Lead technical privacy reviews across websites, mobile apps, and backend services.
• Assess data collection, tracking technologies and third‑party integrations at code and network levels, including cookies, pixels, SDKs, APIs, and JSON payloads.
• Own end‑to‑end data mapping and document data flows, data elements, systems, and vendors.
• Maintain accurate records of data processing activities aligned with regulatory requirements across markets.
• Run compliance scanning and monitoring using tools such as Privado, Didomi, and ObservePoint.
• Validate consent signals, tag behaviour, and data transmission.
• Investigate gaps and drive remediation with engineering teams.
• Support consent management, review and test consent platforms, ensuring correct implementation of consent modes and frameworks such as TCF.
• Handle data subject rights workflows: intake, validation and fulfilment of DSARs, deletion, and access requests.
• Work with engineering and data teams to locate, extract, and erase data across systems within legal timeframes.
• Prepare regulatory responses and gather evidence to support Legal and Data Protection teams in audits, regulators, and internal reviews.
• Conduct privacy risk assessments, reviewing new and existing products, features, and vendors.
• Identify risks in data use, cross‑border transfers, and retention; recommend practical controls and track mitigation.
• Audit data processing and sharing to verify that analytics, advertising, and third‑party data flows match declared purposes, contracts, and consent states.
• Monitor ongoing compliance and report breaches or deviations.
• Define and enforce data governance standards; maintain classifications, naming standards, and schema controls.
• Partner with Engineering, Product, and Legal to translate regulatory requirements into technical tasks.
• Guide implementation and verify outcomes through testing and inspection.
• Maintain documentation and training; produce clear guidance on tracking, consent, data handling, and privacy‑by‑design.
• Train teams on correct implementation and common failure points.
• Support vendor governance: review third‑party technologies, assess data collection and transfers, ensure contracts and configurations meet privacy requirements.

Qualifications

• At least 3 years of experience in data privacy, data governance or ad tech within digital media or platform environments, with direct exposure to web and mobile data collection.
• Strong technical understanding of how websites and apps work, including inspecting cookies, tags, pixels, SDKs, APIs, and JSON payloads using browser and network tools.
• Proven experience conducting technical privacy reviews and audits.
• Ability to trace data flows from front‑end collection through to back‑end systems and third‑party vendors.
• Hands‑on experience with data mapping and records of processing.
• Knowledge of consent management platforms and frameworks such as TCF; ability to validate consent signals and enforce correct implementation across analytics and advertising technologies.
• Experience supporting data subject rights processes, including DSARs, access, deletion, and portability.
• Ability to locate and retrieve data across distributed systems and to interpret compliance‑monitoring tool results, driving remediation with technical teams.
• Strong knowledge of U.S. privacy laws (CCPA, CPRA) with working knowledge of GDPR and other global frameworks; ability to translate legal requirements into technical controls.
• Experience in regulatory response and audit support, gathering evidence, documenting findings, and supporting internal and external reviews.
• Understanding of data governance practices including schema design, data standards, and classification, with ability to enforce consistency across tracking and analytics implementations.
• Clear communication skills, ability to explain technical data flows and risks to Commercial, Product, and Engineering teams.
• Strong analytical skills and attention to detail, able to investigate discrepancies in data collection and consent.
• Ability to manage multiple workstreams in a fast‑moving environment, maintain clear structure and prioritisation, and preserve accuracy and control across documentation and review work.

Equal Employment Opportunity

Condé Nast is an equal‑opportunity employer. We evaluate qualified applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, veteran status, age, familial status, and other legally protected characteristics.