Head of Data Protection

We are recruiting a Head of Data Protection & Privacy for a well-established organisation operating within a highly regulated, consumer-facing sector.

This is a senior leadership opportunity with enterprise-wide responsibility for the organisation’s Data Protection Framework and privacy strategy. Acting as the organisation’s nominated Data Protection Officer (DPO), you will provide independent oversight and challenge, advise senior executives and the Board, and act as a key point of contact with relevant data protection regulators.

The Role

You will lead and continually develop the organisation’s approach to data protection and privacy, embedding strong governance and a culture of Privacy by Design and Default.

Key responsibilities will include:

• Acting as the nominated DPO and providing independent oversight of data protection compliance.
• Developing and enhancing an enterprise-wide Data Protection Framework, policies, standards and governance processes.
• Providing expert advice on UK and international privacy requirements, including UK GDPR, EU GDPR, the Data Protection Act 2018, PECR and South Africa’s POPIA.
• Overseeing DPIAs, Records of Processing Activities (RoPA), data subject rights, retention, lawful processing and data-sharing obligations.
• Developing a risk-based privacy monitoring and assurance programme.
• Leading the organisation’s response to personal data breaches and significant privacy incidents, including regulatory notifications where required.
• Managing relationships and engagement with relevant privacy regulators and supervisory authorities.
• Providing oversight of third-party privacy compliance, supplier due diligence, contractual data protection requirements and international data transfers.
• Working closely with Legal, Compliance, Risk, Technology, Information Security, Product, Marketing, HR and Operations.
• Developing privacy awareness and training and driving continuous improvement across the organisation’s privacy capability.

About You

We are looking for an established data protection and privacy leader who combines deep technical expertise with strong commercial judgement and the credibility to influence at the highest levels.

You will ideally bring:

• Significant experience leading a Data Protection or Privacy function within a regulated environment.
• Expert knowledge of UK & EU GDPR, the Data Protection Act 2018, PECR and wider privacy legislation, with knowledge of South Africa’s POPIA.
• Previous experience operating as a senior privacy adviser and/or DPO.
• A track record of developing and implementing enterprise-wide privacy frameworks.
• Strong knowledge of privacy governance, risk management, data lifecycle management and regulatory compliance.
• Experience managing complex personal data breaches and regulatory investigations.
• Excellent stakeholder management, communication and influencing skills, including at senior leadership level.
• The ability to combine strategic thinking with hands-on operational delivery in a fast-paced, regulated environment.
• Experience within a highly regulated environment would be advantageous, as would a recognised privacy qualification such as CIPP/E, CIPM or CIPT. Experience engaging directly with the ICO, using privacy management platforms such as OneTrust or TrustArc, and knowledge of Information Security, Cyber Security or AI governance would also be beneficial.

This is an excellent opportunity for a credible, commercially minded privacy leader to take ownership of a significant data protection function and influence privacy strategy across a complex organisation.