Data Protection Officer

Data Protection Officer | Manchester Monex specialises in FX risk management and international payments, helping corporate and institutional clients design tailored FX solutions to navigate currency volatility with confidence. Our team of FX specialists implement well-considered currency strategies, offering dedicated support to help clients manage their payment needs – whether for goods, services, or direct investments.

In 2023, Monex facilitated $309 billion in FX turnover, managed $10.7 billion in assets, and processed 8.5 million transactions. With offices across North America (Canada, the US, and Mexico), Asia (Singapore), and Europe (the UK, Spain, and the Netherlands), we serve over 66,000 clients worldwide.

By combining global reach with deep local market expertise, Monex enhances businesses with a suite of financial solutions and FX market analysis to help optimise efficiency, mitigate currency risk, and protect margins in an increasingly complex financial landscape. Our corporate client experience is further enhanced by our dedicated sector expertise across a range of industries.

The Information Security and Data Protection Governance function supports Monex in protecting client, employee, supplier and business information and maintaining compliance with applicable data protection, privacy, information security and financial services regulatory requirements. The function works across legal entities and jurisdictions to embed privacy by design, maintain data governance records, support data subject rights, oversee personal data breach response, advise on lawful processing, and provide assurance that personal data is handled responsibly and securely.

As Data Protection Officer, you will provide independent, expert data protection oversight and practical guidance across Monex’s international operations. The role is based in Manchester, UK, with a global remit covering the UK, EU, Canada, USA and Singapore, and is expected to be capable of being formally notified or registered as the DPO with relevant supervisory authorities, including the Spanish AEPD where required.

You will own and mature the data protection governance framework, including DPIAs, Records of Processing Activities (ROPAs), data subject rights, data breach governance, data protection policies, training, regulatory liaison and risk-based assurance.

• Act as the appointed Data Protection Officer for relevant Monex entities, maintaining independence, professional judgement and direct access to senior management where required.
• Provide expert advice on UK GDPR, EU GDPR, the UK Data Protection Act 2018, PECR, Spanish LOPDGDD requirements, Dutch privacy requirements, Canadian privacy requirements including PIPEDA and Quebec Law 25, applicable US privacy requirements and Singapore PDPA obligations.
• Be eligible and willing to be notified or registered with relevant supervisory authority registers, including the ICO and Spanish AEPD, and support equivalent DPO/contact-point requirements in other jurisdictions where applicable.
• Own and improve the global data protection governance framework, including policies, standards, procedures, registers, templates, guidance notes and evidence packs.
• Lead, review and advise on Data Protection Impact Assessments (DPIAs), Privacy Impact Assessments, Legitimate Interest Assessments and Transfer Risk Assessments for new suppliers, systems, products, AI use cases, projects and material changes to processing.
• Create, maintain and periodically review Records of Processing Activities (ROPAs), data inventories, data-flow maps, lawful basis records, retention references and records of international data transfers across relevant business areas and entities.
• Support privacy by design and default by engaging early with technology, product, change, procurement and operational initiatives, ensuring data protection requirements are built into design decisions before go-live.
• Advise on and oversee global personal data breach governance, including assessment of risk to individuals, regulatory notification requirements, data subject communications,…