Job Description
The Role
The role provides expert legal advice and strategic support on all aspects of data protection, privacy and information governance across the Group. The role ensures that the organisation's data strategy, governance framework and commercial initiatives are underpinned by robust legal and regulatory compliance while enabling the responsible and innovative use of data.
As a member of the wider legal team, working closely with the Data Enablement Officer, Data Protection, Information Security, Compliance, Technology and Business teams, the role embeds privacy by design, supports enterprise data governance, facilitates secure data sharing, and provides day-to-day legal advice on privacy and contractual data protection matters across our operating companies. The role acts as a trusted legal partner to the business, enabling commercial initiatives through practical, solutions-oriented advice.
Key Responsibilities
Provide legal support in the development and maintenance of the Group Data Enablement Framework.
Ensure legal and privacy requirements are embedded within enterprise data governance standards, policies and processes.
Advise on accountability obligations, lawful processing principles and privacy-by-design requirements across data initiatives.
Support governance committees and decision-making forums on legal aspects of data management.
Review, draft and negotiate contracts involving the processing or sharing of personal data.
Ensure contractual arrangements appropriately allocate privacy obligations and regulatory responsibilities.
Provide legal support on supplier, customer and technology agreements involving personal data.
Act as the primary legal contact for operational data protection and privacy queries from business stakeholders.
Provide timely advice on subject access requests, retention, lawful basis, marketing, customer complaints, employee data and operational privacy issues.
Support business projects by providing practical legal solutions to day-to-day data protection matters.
Provide legal advice on new data flows, system integrations and enterprise data architecture initiatives.
Advise on privacy implications relating to data minimisation, purpose limitation, retention, security and lawful processing.
Review new technologies and transformation programmes to ensure privacy risks are appropriately managed.
Advise on legal requirements relating to Records of Processing Activities (ROPAs), data inventories and data classification.
Support documentation of ownership, lawful basis, retention periods and processing purposes for key business data assets.
Ensure accountability obligations under GDPR are appropriately embedded within enterprise data cataloguing initiatives.
Provide legal advice on the lawful use of customer data for analytics, profiling, segmentation, AI and commercial initiatives.
Advise on consent requirements, legitimate interests assessments and direct marketing obligations.
Support responsible innovation while protecting customer rights and maintaining regulatory compliance.
Provide privacy and data protection legal advice on the Group's AI initiatives, including generative AI tools, machine learning models and automated decision-making systems.
Advise on the lawfulness of AI-driven processing.
Support the development of internal AI governance frameworks and policies, ensuring privacy-by-design principles are embedded from the outset.
Monitor developments in AI regulation and advise on their implications for the Group's activities.
Lead the legal response to personal data incidents and breaches, including severity assessment and advising on regulatory notification obligations.
Manage notifications to the ICO within statutory timeframes and coordinate any required communications to affected data subjects.
Coordinate breach response with Information Security, Compliance and Communications teams to ensure a timely and legally robust response.
Manage proactive and reactive…