Organisational Relationship: Reports to In-house Counsel  

Location: Hybrid - Stafford Office and up to 2 days remote working per week

Salary: DOE

TopCashback Limited is looking to recruit an experienced Group Privacy Manager / Data Protection Officer (DPO) to meet its obligations under the EU GDPR and the UK GDPR. Reporting to the In-house Counsel / Compliance Board, the statutory DPO will monitor compliance and data practices internally to ensure the business and its functions comply with the applicable requirements under the EU GDPR, the UK GDPR and other relevant legislation. The DPO will be responsible for advising on, and carrying out and maintaining, staff training, data protection impact assessments, data transfer impact assessments, data processing agreements, international data transfer agreements and internal audits. The DPO will also serve as the primary contact for the relevant EU and UK supervisory and individuals whose data is processed by the organisation.

Essential Duties and Responsibilities: In this role, you will work closely with the Legal, Compliance, and Information Security functions to develop and monitor policies and standards applicable to the business and in compliance with the EU GDPR, UK GDPR and other relevant legislation in jurisdictions where the business operates. Duties will include:

·        Implementing measures and a privacy governance framework to manage data use in compliance with the EU GDPR, UK GDPR and other relevant legislation, including developing templates for data collection, advising on and assisting with data mapping and records of data processing, and vendor management reviews.

·        Working with key internal stakeholders in the review of operations and projects and related data processing to ensure compliance with data privacy laws, and where necessary, advising on and monitoring data protection privacy impact assessments.

·        Serving as the primary point of contact and liaison for the relevant EU / UK supervisory authorities and designated representative(s) on all data protection related matters under the EU GDPR, UK GDPR and other relevant legislation.

·        Serving as the primary point of contact for data protection queries in the business.

·        Reviewing and advising on vendor contracts (including relevant standard contractual clauses for international data transfers), transfer risk assessments  and other third party data processing and data sharing arrangements in partnership with the organisation's Risk and Control Manager and Information Security functions.

·        Ensuring filing and fee requirements with the Information Commissioner are achieved. 

·        Participating in the Data Privacy / Information Governance Committee.

·        Managing and conducting ongoing reviews of TopCashback’s privacy governance framework including regular and ad hoc reporting on data privacy compliance within the organisation

·        Monitoring changes to and horizon scanning relevant privacy laws in all jurisdictions and making recommendations to the Security / Compliance Board when appropriate.

·        Setting standards and reviewing policies and procedures globally that meet the requirements under the EU GDPR and UK GDPR and any localisation requirements in countries of operation.

·        Developing and delivering privacy training to various business functions and collaborating with the Information Security function(s) to raise employee awareness of data privacy and security issues.

·        Developing strategies and initiatives to ensure engagement with key internal and external stakeholders.

·        Coordinating, conducting and monitoring data privacy audits.

·        Collaborating with the Information Security function(s) to maintain records of all data assets and exports, and maintaining a personal data security incident management plan to ensure timely remediation of incidents impacting personal data including impact assessments, breach response, complaints, claims or notifications.

·        Advising on data subject rights requests, including data subject access requests (DSARs) and other requests from individuals.

·        In conjunction with the Information Security function you will ensure that TopCashback’s IT systems and procedures comply with all relevant data privacy and protection law, regulation and policy (including in relation to the retention and destruction of data).

·        Working with designated privacy lawyers, subject matter experts or champions across TopCashback’s offices and, where necessary, outside legal advisers to help advise on data privacy law issues.

·        Promoting effective work practices, working as a team member, and showing respect for co-workers.

Requirements

Education

·        Hold at least one data protection and/or privacy certification, such as CIPP, CIPT, CIPM, ISEB, etc. (preferred) or willingness to achieve within a short period of joining

Work Experience

·        Experience in EU and UK data privacy laws

·        At least 5 years experience within a compliance, legal, audit and/or risk function, with recent experience in data privacy compliance in a global organisation

·        Experience in developing policy and compliance training

·        Experience working with Regulators (e.g. ICO)

Knowledge, Skills and Abilities

·        Strong knowledge of UK and European data privacy and data protection regulation, and a good understanding of other major privacy frameworks and evolving legislation worldwide

·        Sufficient knowledge of information technology and data management systems required

·        Ability to interact effectively with people at all organisational levels of the firm

·        Experience of working in a global organisation

·        Ability to work unsupervised, exercise leadership and influence change

·        You will need to manage your own time, prioritise effectively and handle multiple deadlines

·        Ability to undertake large, long-term projects, develop alternative methods to complete them and implement solutions

·        Ability to use independent judgement and discretion when making majority of decisions

·        Detail-oriented approach needed to recommend and implement strategic improvements on a range of data privacy and data protection issues.

·        Ability to handle confidential and sensitive information with the appropriate discretion

·        Fluent English; knowledge of other languages especially German preferred

Additional Requirements

·        Some international travel may be required

·        The statements contained in this role specification are not necessarily all-inclusive; additional duties may be assigned and requirements may vary from time to time

Abercrombie and Fitch Co.  

Sephora  

Nike  

Marks & Spencer  

Co-op  

H&M Group  

Officeworks  

Specsavers  

beeline Group  

Next