Privacy Operations Analyst in City of Westminster

Privacy Program Management & Reporting

• Structure and maintain privacy operations work in Azure DevOps (ADO), Jira, or similar work-management tools, including custom work item types and fields mapped to privacy concepts (jurisdiction, data type, risk tier).
• Build and maintain KPI dashboards and reporting (e.g., DSAR SLA compliance, assessment backlog age, incident response times) for privacy program leadership, using ADO Analytics, Power BI, or similar tools.
• Track cross-functional privacy work items that depend on Legal, Security, and Product teams, and proactively surface bottlenecks and at-risk items.
• Coordinate responses to data subject access requests (DSARs) and other data subject rights requests, ensuring timely resolution within statutory timelines across jurisdictions.
• Track and report on privacy program metrics and KPIs for leadership and relevant stakeholders.

Privacy Risk Assessments

• Conduct and document privacy impact assessments (PIAs), data protection impact assessments (DPIAs), and transfer impact assessments (TIAs) for new products, features, and vendor engagements.
• Support automated assessment workflows that trigger and assign PIAs/DPIAs based on risk-based conditional logic (data type, processing purpose, jurisdiction, vendor risk tier), escalating high-risk triggers for senior review.
• Support efforts to reduce manual effort in assessment scoring and risk rating, applying sound judgment on what can be automated versus what must remain human-reviewed.

Data Mapping & ROPA Maintenance

• Maintain and update the company's records of processing activities (ROPA), tying outputs directly to data mapping and risk assessment findings.
• Support data discovery and data flow mapping efforts across the organization's systems, environments, and third-party integrations, leveraging data discovery tooling where available.
• Support an ongoing ownership and maintenance model for the data map/ROPA, including monitoring for drift as systems or vendors change and reconciling against discovery tool outputs.

Privacy Compliance & Risk Management

• Monitor and track changes in privacy regulations across jurisdictions, and support compliance with key regulations including UK GDPR/EU GDPR, CCPA/CPRA, PIPEDA, and other applicable regimes.
• Support privacy incident response and breach notification processes, including incident documentation and breach register maintenance.
• Support privacy audits and assessments of internal processes and third-party vendors.

Privacy-by-Design & Cross-Functional Collaboration

• Support the intake and triage of privacy-related inquiries from internal stakeholders and customers.

#J-18808-Ljbffr