Reporting Specialist / Analyst in Oxford

Reference: 0619We're recruiting for a data protection specialist to be a trusted advisor on data protection, working across the firm to solve complex issues, manage risk and support colleagues with practical, business-focused guidance. Reporting to the General Counsel, this role is responsible for developing and taking ownership of key aspects of the firm's operational and commercial data protection programme. The Data Protection Specialist will be a trusted adviser to partners, lawyers and business services teams, helping the firm navigate complex data protection requirements in a pragmatic and commercially focused way. The role combines technical expertise with practical problem-solving and relationship management, working closely with stakeholders across the business to ensure data protection is effectively embedded into decision-making, procurement, technology, supplier management and client engagements. You will take ownership of significant areas of the firm's data protection programme, with particular responsibility for supplier management, client and supplier contractual requirements, data protection due diligence, international data transfer governance, auditing and wider regulatory compliance activities. You will help ensure that data protection is effectively embedded into business processes, commercial decision-making and risk management activities. You will take ownership of key workstreams, driving activity forward, identifying improvements and implementing practical, risk-based solutions that support the firm's strategic and operational objectives. The personThe role would suit an experienced data protection professional with a strong background in operational and commercial data protection, ideally gained within a law firm, professional services business or similarly regulated environment. You will combine strong technical knowledge with sound commercial judgement. You will have the confidence to apply your knowledge in a pragmatic, risk-based way. You will have experience operating within a complex organisation where data moves across multiple systems, teams, processes and third-party providers. You will be comfortable understanding and analysing complex data flows and advising on the practical implications of business, technology and procurement decisions. You have a focus on non-contentious data protection (contracts, supplier management, international data transfers), and can assist with responding to, and advising a range of internal stakeholders on, data subject rights, incidents, supplier and client-side data protection requirements, and broader governance obligations. Given the responsibilities of this role, it is likely that your background and experience will include: strong knowledge of UK GDPR, Data Protection Act 2018 and related regulatory guidance, with the ability to translate legal and regulatory requirements into practical business advice for senior stakeholders.significant experience of non-contentious data protection work, including contracts, supplier management, procurement processes, data protection impact assessments and governance activities.strong commercial awareness and the ability to balance regulatory requirements, business objectives and risk considerations.The activitiesShared data protection advice and response activityResponding to data incidents (immediate response; drafting data subject notifications; Responding to regulatory queries. Responding to complaints with data aspects. Supplier management Reviewing and negotiating data protection provisions in supplier and third-party contracts. Reviewing supplier and third-party responses to data protection questions during the procurement process. Checking supplier and third-party sub-processors for issuesClient-side contractsTaking responsibility for data protection content in letters of engagement and terms and conditions. Maintaining records of data protection clauses with clients, including notification obligations and timescales and liaising with colleagues on AI-related contractual provisions where relevant. Internal auditing and reportingConducting or procuring appropriate data protection auditing activity and working with the data protection team and other departments to implement resulting corrections. Reviewing and maintaining data protection content within the firm's risk register, identifying and escalating key data protection risks. Internal departmental support Providing pragmatic, risk-based data protection advice to Marketing, the People team, investigations teams, fee earners and Partners. Providing data protection input into internal investigations to support lawful handling, sharing and disclosure of personal data. The benefitsAs you'd expect, we offer a competitive salary and a wide range of benefits. This screening will include, but is not limited to, a basic DBS, verification of your right to work, a three year employment history and a self-declaration to assess your character and suitability for the role. Use of AI during the recruitment processTechnology is changing rapidly and we are all increasingly using AI software in our day to day lives, as well as using it to support our learning and professional development. Here at Mills & Reeve, we embrace the use of technology and AI and we recognise that candidates may use AI tools to support their applications. Please ensure you have thoroughly read the document attached below to understand what we deem acceptable uses of AI. The firmMills & Reeve is centred on achieving more for clients, their businesses and the wider communities we serve. And if clients need things we don't offer, we draw on our network to give recommendations. Our values are the principles that help us fulfil our purpose. We care - We're committed to each other, our clients, our communities and the planet We collaborate - We're easy to work with, we offer help willingly and we get things done – togetherAnd finallyEveryone at Mills & Reeve brings a unique perspective and ideas to the team and we do everything we can to help each person to thrive. We're committed to providing an inclusive and supportive working environment, are happy to consider flexible working arrangements, and want to achieve the right balance for both our people and the firm. To find out more about our diversity and inclusion work, visit our website. Vacancy Title: Data Protection Specialist Office: Birmingham, Cambridge, Leeds, Manchester, Norwich, Oxford Contract Type: Permanent Closing Date:9 October 2026