Data Protection Officer in London

Mishcon de Reya is looking to recruit an experienced Data Protection Officer (DPO). The DPO will monitor compliance and data practices internally to ensure the business and its functions comply with the applicable requirements under the EU GDPR, the UK GDPR and other relevant legislation. The DPO will be responsible for advising on, and where required carrying out, staff training, data protection impact assessments, data transfer impact assessments, and internal audits.

Key Responsibilities

• This role sits in the Risk & Compliance Department and will work closely with the firm's fee earning Data Practice Group to develop and monitor policies and standards applicable to the business and in compliance with the EU GDPR, UK GDPR and other relevant legislation.
• Implementing measures and a privacy governance framework to manage data use in compliance with the EU GDPR, UK GDPR and other relevant legislation, including developing methodologies for data collection which are compatible with our approach to excellent client service.
• Advising on and assisting with data mapping and records of data processing, and vendor management reviews.
• Reviewing vendor contracts (including relevant standard contractual clauses for international data transfers) and owning the privacy authorisation and assessment of third-party processing activities.
• Ensuring any filing/notification and fee requirements with the Information Commissioner and other supervisory authorities in the jurisdictions we operate are achieved.
• Participating in the relevant internal data governance committees.
• Managing and conducting ongoing reviews of our privacy governance framework and regular and ad hoc reporting on data privacy compliance within the organisation.
• Monitoring changes to relevant privacy laws and making recommendations when appropriate.
• Setting standards and reviewing policies and procedures globally that meet the requirements under the EU GDPR and UK GDPR and any localisation requirements in countries of operation.
• Developing and delivering privacy training to various business functions and collaborating with appropriate internal teams to raise employee awareness of data privacy and security issues.
• Coordinating, conducting and monitoring data privacy audits.
• Collaborating with internal teams to maintain records of all data assets and exports, and maintaining a personal data security incident management plan.
• Providing privacy expertise into AI governance processes, including advising on data protection considerations within AI systems.
• Working with internal stakeholders and team members to respond and advise on data subject rights requests, including data subject access requests (DSARs).
• Ensuring accountability for core privacy operational outcomes, including timely completion of DPIAs, maintaining accuracy and completeness of Records of Processing Activities (RoPA).
• Promoting effective work practices, working as a team member, and showing respect for co-workers.

Skills/Experience

• At least 3 - 5 years PQE / data privacy experience required.
• Experience in EU and UK data privacy laws.
• 3 years’ experience within compliance, legal, audit and/or risk function, with recent experience in privacy compliance.
• Experience in developing policy and compliance training.
• Law degree or post-graduate legal qualification required.
• Hold at least one data protection and/or privacy certification, such as CIPP, CIPT, CIPM, ISEB, etc. (preferred) or willingness to achieve within a short period of joining.

Knowledge, Skills and Abilities

• Strong knowledge of UK and European data privacy and data protection regulation.
• Well-developed and professional interpersonal skills; ability to interact effectively with people at all organisational levels of the firm.
• Ability to work unsupervised, exercise leadership and influence change.
• Excellent writing and presentation skills.
• Strong change and project management skills, including the ability to manage time well, prioritise effectively and handle multiple deadlines.
• Detail-oriented approach needed to recommend and implement strategic improvements on a range of data privacy and data protection issues.
• Ability to handle confidential and sensitive information with the appropriate discretion.

The Mishcon de Reya Group is an independent, international professional services business with law at its heart, employing over 1450 people with over 650 lawyers. It includes the law firm Mishcon de Reya LLP and a collection of leading consultancy businesses that complement the firm's legal services. We strive to create a fully diverse and inclusive workplace where all our people are empowered to fulfil their potential.