Data Protection Lead

- Maintain and update Records of Processing Activities (ROPA), data retention schedules, policies, procedures and related governance documentation. - Support business teams in documenting new or amended processing activities and ensuring required governance artefacts are completed. - Maintain accurate compliance records to support accountability obligations. - Manage and respond to data subject rights requests, including rights of access, rectification, erasure, restriction, objection, and data portability. - Coordinate information gathering across relevant teams and ensure responses are issued within statutory timeframes. - Review material and apply appropriate redactions to protect third-party personal data and confidential information in line with established procedures. - Escalate complex legal considerations, exemption assessments, or high-risk matters to the Data Protection Officer (DPO) where required. - Support business stakeholders in embedding privacy-by-design principles into new projects, systems, and operational changes. - Coordinate and facilitate Data Protection Impact Assessments (DPIAs), including gathering relevant information, documenting risks, and tracking mitigation actions. - Ensure DPIAs are completed where required and submitted to the DPO for review and advice. - Escalate high-risk or residual risk processing activities to the DPO and relevant governance forums. - Support the coordination and documentation of personal data breach investigations. - Maintain incident records and ensure prompt internal reporting of suspected breaches. - Escalate potential notifiable breaches to the DPO for assessment under UK GDPR reporting requirements. - Support preparation of information required for regulatory notification where directed by the DPO. - Support the coordination and delivery of data protection training and awareness initiatives across the organisation. - Promote understanding of data protection responsibilities and good practice within business teams. - Identify recurring compliance themes or training gaps and escalate to the DPO where further guidance or intervention may be required. - Act as a point of contact for routine data protection queries and provide guidance in line with established policies and DPO advice. - Promote consistent data protection practices across business operations.