Data Protection Officer

Overview

Role

Title:

Data Protection Officer

Location: Milton Keynes, Hybrid working 2 days per week onsite

Duration: 6 month contract with potential for extension

Reporting to the General Counsel, the DPO leads data protection compliance across UK entities, ensuring adherence to UK GDPR, Data Protection Act, FCA requirements, and ICO guidance. The role provides strategic advice, oversees compliance frameworks, manages data protection risks, and leads a team of Data Protection Specialists.

• Act as the organisation's lead expert on data protection and privacy compliance.
• Develop, implement, and monitor data protection policies, procedures, and controls.
• Advise senior leadership, boards, and business functions on privacy risks and regulatory requirements.
• Lead and oversee:
  • Data Protection Impact Assessments (DPIAs)
  • Records of Processing Activities (RoPAs)
  • Legitimate Interest Assessments (LIAs)
  • Transfer Risk Assessments (TRAs)
• Manage personal data breach investigations, reporting, and liaison with the ICO and other regulators.
• Ensure privacy by design and default across products, services, and business processes.
• Deliver training, awareness programmes, and regulatory updates.
• Support contract reviews, data-sharing arrangements, and cross-border data transfers.
• Lead data protection governance forums and regulatory reporting.
• Manage and develop a team of Data Protection Specialists.

• Extensive Data Protection Officer or senior privacy compliance experience.
• Strong knowledge of UK GDPR, Data Protection Act, ICO guidance, and related regulations.
• Experience advising businesses on practical regulatory compliance.
• Understanding of data processing operations, information security, and privacy risk management.
• Proven stakeholder management and leadership experience.
• Ability to manage multiple priorities and complex compliance matters.

• Financial services or automotive finance experience.
• Knowledge of FCA regulations (CONC, SYSC, SM&CR, FIT, COND, etc.).
• Experience handling complex Subject Access Requests (SARs).
• IAPP certifications (CIPP/E, CIPM) or equivalent privacy qualifications.

• Strong leadership and team management.
• Excellent communication and stakeholder engagement.
• Analytical problem-solving and risk assessment.
• Ability to balance regulatory requirements with commercial objectives.
• Strong organisational and planning skills.