Privacy Programme Specialist

Role overview

Location and reporting

• The stated location is Heathrow.
• The role reports to the VP, Technology UK and Ireland, with a dotted line to the Head of Products, Partnerships and Innovation.

Working pattern

• This is a part-time role offered as three working days per week or condensed working hours across five days.
• The stated shift pattern is 45 hours per week, Monday to Friday.

Privacy governance and records

• Manage and track the day-to-day privacy programme and maintain its governance framework, records, controls, actions, and reporting.
• Provide stakeholders with updates on privacy activity, risks, incidents, requests, and improvement priorities.
• Maintain Records of Processing Activities across the UK and Ireland and work with business owners to validate processing details.
• Identify gaps in processing records and drive timely remediation.

Assessments, requests, and incidents

• Review and support DPIAs for systems, processes, suppliers, and initiatives involving personal data; guide risk assessment and mitigation.
• Coordinate DSARs and other individual rights requests, ensuring they are logged, quality checked, and completed within required timescales.
• Guide stakeholders on evidence gathering, redaction, exemptions, and responses, escalating complex matters when needed.
• Manage personal data incidents and suspected breaches through investigation, containment, remediation, closure, and lessons learned.

Training and alignment

• Coordinate annual HR privacy training and additional training as needed; maintain records and support targeted awareness.
• Review training content to keep it relevant and aligned with the UK and Ireland privacy programme.
• Review and update privacy policies, procedures, guidance, and supporting documentation.
• Align privacy processes and controls across acquired companies in Ireland, harmonising legacy practices and documentation.

Role requirements

• Support compliance with UK GDPR and EU GDPR for the Republic of Ireland, alongside internal policies and procedures.
• Provide practical guidance to business stakeholders on data privacy and related processes.
• Coordinate privacy governance records, individual rights requests, incidents, and training.
• Work with local stakeholders to align privacy processes and controls while recognising applicable local requirements.