Data Security and Protection Team Leader

Data Security and Protection Team Leader Band 6 Job overview

An exciting opportunity at University Hospitals of Northamptonshire (UHN) for a proactive and passionate DSP Team Leader to join our fast‑paced Data, Security & Protection Team. The role supports Northampton General Hospital and Kettering General Hospital as part of the Group’s approach to meeting legal, statutory and regulatory obligations for personal data security.

Key responsibilities:

• Lead delivery of DSP work streams and ensure evidence is maintained for DSP Toolkit standards.
• Manage, triage and support investigation of DSP incidents via Datix.
• Deliver DSP training (classroom, small groups and virtual).
• Oversee completion and quality of Data Protection Impact Assessments (DPIAs).
• Support information sharing governance using the Information Sharing Gateway.
• Raise awareness of data security issues across the Group and promote best practice.
• Act as the key point of contact for colleagues seeking specialist DSP support.

• Act as the expert source of advice and expertise in DSP for the Group.
• Support the development of clinical administration functions – identifying information governance risks and providing recommendations for change.
• Increase the profile of DSP within the organisation and support culture change.
• Ensure processes for the secure disposal of IT and hardware assets are in place.
• Initiate and plan a programme of work ensuring the Group complies with the DSP Toolkit requirements.
• Complete annual DSP Toolkit submission and collate supporting evidence.
• Lead audits checking compliance with the DSP toolkit, incident management, research activities and data quality.
• Work in partnership with the Cyber Security Lead to meet NHSD deadlines.
• Implement and maintain compliance with relevant legislation (Data Protection Act 2018, GDPR, Computer Misuse Act 1990, Human Rights Act 1998, etc.).
• Investigate and resolve information security issues for personal and trust‑sensitive data.
• Implement the DSP training strategy to meet NHSD mandatory training targets.
• Deliver information governance training when required.
• Implement and propose changes to Group DSP policies, monitor compliance, and ensure alignment with GDPR.
• Conduct DPIAs where necessary; coordinate with relevant teams for data privacy by design and default.
• Act as UHN information security expert; communicate identified risks to technology heads.
• Assign DPIAs to team members; coordinate partnership with project and transformation leads.
• Ensure all Group DPIAs, assets, flows and third parties are recorded on the Information Sharing Gateway and signed off by relevant DPO / SIROs.
• Provide escalation point for DSP analysts; ensure DPIAs align with GDPR and redesign systems accordingly.
• Communicate complex information and influence staff on DSP standards.
• Lead collection of reports and information for compliance, performance reporting, inspections and internal assurance.
• Coordinate Data Governance Group and Information Governance Group meetings, recording minutes, actions and delegating tasks.
• Attend group, trust and project meetings to provide DSP advice and guidance.
• Coordinate reported incidents on Datix, ensuring actions are taken.
• Escalate incidents to relevant DPO for Serious Incident/ICO reporting and manage DSP Toolkit Incident reporting mechanism.
• Provide IG input and guidance for R&D programmes.
• Deputise for DSP Manager when required.
• Maintain Information Sharing Gateway; propose national system improvements.
• Coordinate investigation of IG incidents, collaborate with relevant managers.
• Act as escalation point for DSP analysts and support public in difficult situations.
• Attend serious investigation panels and draft reports to CCG.
• Perform root cause analysis on serious incidents and ensure actions.
• Work with complaints team and public to communicate DSP grievances.
• Maintain Group Information Asset register and data flow maps; provide training to owners and administrators.
• Act as first point of contact for Data Subjects regarding GDPR rights.
• Update DSP internet and intranet pages.

The Data Security & Protection Team Leader will have…