Compliance Officer, IT​/Tech

About us

We are a leading consultancy with a purpose to make an enduring impact on health and healthcare. We work with leaders and frontline teams to improve health, transform healthcare, drive adoption of innovation and create value through investment.

Our consultancy serves the entire healthcare sector, from payors and providers of care, to life science companies, health tech and sector suppliers and health investors. We provide end-to-end services, from strategy through implementation, accelerated by data, digital and AI.

We shape opinion through evidence-based thought leadership on key issues affecting health. With unmatched ability to access and use health data, our consultants are a driving force for delivering positive and meaningful change.

The Compliance Officer sits within the Data Operations team and reports directly to the Director of Data, Analytics and Intelligence. This operational coordinator role is responsible for information governance (IG), data protection, and regulatory compliance across CF. The Compliance Officer provides day-to-day coverage of the Data Protection Officer responsibilities and will undertake recognised DPO training and certification, acting as the primary point of contact for all compliance-related queries across the business.

The role spans three interconnected business functions— IT, People, and Data Operations— with additional support to the wider corporate team as needed. The Compliance Officer is responsible for reducing regulatory risk, maintaining audit readiness, and providing structured assurance to the Board and Executive Committee. Responsibilities include information governance and data protection, ISO certification coordination, data breach compliance and incident response, people and employment compliance, regulatory monitoring, and legal and IP query management across the UK, Middle East and Europe.

This is an excellent opportunity for a graduate with a legal background—or someone early in their compliance career—to develop a broad and substantive compliance portfolio within a dynamic, data-rich healthcare consultancy. Full training and professional development support will be provided.

• Develop, maintain and regularly review internal compliance policies to ensure staff are equipped to meet regulatory obligations.
• Data protection and privacy policies, including employee and candidate privacy notices.
• Employment contracts.
• Associate agreements and Statements of Work (SoWs).
• Anti-bribery and conflicts of interest policies.
• Information security policies aligned to ISO 27001.
• Identify and flag compliance issues, deviations from standard terms, or matters with wider legal or commercial implications, escalating to the People team and legal advisors as appropriate.
• Own the annual policy review cycle, coordinating with relevant function leads to ensure policies remain current and fit for purpose.
• Develop accessible plain‑English guidance and FAQs to support staff understanding and day‑to‑day compliance.

• Act as the operational Data Protection Officer and primary internal contact handling day‑to‑day data protection queries, escalating to the Director of Data, Analytics and Intelligence as required.
• UK GDPR compliance queries.
• CF technical products (e.g. Health Strata).
• Maintain and update Records of Processing Activities (ROPAs) across the business.
• Maintain the Information Asset Register (IAR) across CF.
• Review and advise on Data Protection Impact Assessments (DPIAs) and Data Sharing Agreements (DSAs) for new projects, client engagement and internal systems.

• Ensure CF’s data breach policy and incident response process is embedded across the business and adhered to consistently.
• Act as the first point of contact for suspected or confirmed data breaches, leading the internal response and coordinating with relevant function leads.
• Maintain a data incident and breach register, ensuring all incidents are documented with appropriate detail for regulatory audit purposes.
• Conduct post‑incident reviews to identify root causes and drive remediation,…