Senior Risk & Compliance Consultant; Data Privacy

We are seeking an experienced Senior Risk & Compliance Consultant (Data Privacy Consultant / DPO) to work from our Birmingham office (hybrid working with flexibility). Other offices will be considered. This position is permanent and ideally full-time (36.25 hours) however part-time (4 days) will also be considered. As an experienced Senior Risk & Compliance Consultant / Data Privacy Consultant, you'll support a diverse portfolio of clients across multiple sectors in a fast-paced consulting environment.

The role involves both proactive privacy advisory work and reactive support for incidents such as data breaches and data subject rights requests (DSRs). This position suits someone who is calm under pressure, comfortable managing multiple priorities, and able to explain privacy risks and decisions clearly, concisely, and without jargon to business stakeholders at all levels.

A snapshot of your day Support multiple client engagements simultaneously across a range of sectors in a busy consulting environment

Proactively assess and improve clients’ data protection and privacy posture, including Privacy gap analyses and audits;
Risk assessments and DPIAs, including for new technologies and data uses; and Policy, procedure, and framework development

Assess and advise on the privacy implications of processing personal data using AI and automated decision-making technologies

Conduct third-party and supplier privacy assessments, including data processing due diligence and ongoing assurance

Produce clear, well-structured audit and assessment reports with practical, prioritised recommendations

Provide calm, pragmatic advice during reactive scenarios, including Data breaches and incident response;
Regulatory notifications and communications; and Data subject rights requests (access, erasure, rectification, etc.)Deliver privacy education and training, tailored to different audiences and levels of knowledge

Act as a trusted advisor, helping clients balance regulatory requirements with business objectives across differing regulatory and operational contexts

Communicate effectively with operational teams, senior leaders, and non-technical stakeholders, avoiding unnecessary jargon or alarmism

Work collaboratively with legal, information security, and business teams to embed privacy into day-to-day operations

Maintain awareness of relevant data protection laws, regulatory guidance, and best practices (e.g. GDPR, UK GDPR)
Managing a small team of consultants

We would love to hear from you if you have:

Proven experience working in a busy, multi-client environment supporting organisations across multiple sectors, either in consultancy or an equivalent in-house role; with hands-on experience delivering both proactive privacy advisory services and reactive support

Ability to quickly understand different business models, risk profiles, and regulatory environments, and tailor privacy advice accordingly

Practical experience handling data breaches and incident response and data subject rights requests

Experience assessing AI and automated processing activities involving personal data, including understanding risk, transparency, and accountability considerations

Demonstrated ability to conduct third-party privacy risk assessments, including review of suppliers, processors, and data sharing arrangements

Capability to produce high-quality, structured written outputs, including audit and assessment reports

Experience designing and delivering privacy training and awareness sessions

Excellent communication skills, with the ability to translate privacy requirements into clear, concise business decisions and communicate effectively with technical and non-technical audiences

Broader business understanding, enabling pragmatic advice that…