Data Protection Advisor

Brown & Brown UK; Greater London; On-site; GBP 40,000 - 70,000; Full time

Job summary

Brown & Brown (UK) is seeking a Data Protection Advisor to join the London team. The role focuses on advising on privacy matters, ensuring compliance with UK GDPR and PECR, and managing DSARs and DPIAs.

You will review contracts with suppliers, contribute to incident response, and help train staff on privacy awareness. The ideal candidate has 2–5 years' hands-on privacy experience and relevant PDP/CIPP/E/CIPM qualifications.

Qualifications

• 2 to 5 years' practical data protection or privacy experience.
• Proven DSAR handling experience.
• Good working knowledge of UK GDPR and PECR.
• Experience reviewing contracts and data processing agreements.
• Experience providing privacy advice to stakeholders.
• Experience supporting DPIAs.

Responsibilities

• Lead end-to-end handling of Data Subject Access Requests and other individual rights requests.
• Provide day-to-day privacy advice to colleagues and stakeholders.
• Review supplier contracts, DPAs, and data protection clauses.
• Support DPIA completion and first-line DPIA reviews.
• Assist with data breach investigations and incident management.
• Support privacy training and awareness activities.

Skills

Data protection

DSAR handling

UK GDPR

PECR knowledge

Contract review

Privacy training

Education

Privacy qualification (PDP/CIPP/E/CIPM)

Job description

Location: Mark Lane / Aldgate House, London

Salary: Negotiable + Benefits

Role Purpose

We are currently looking for a Data Protection Advisor to join the welcoming and professional London team.

The Data Protection Advisor provides practical, business-facing privacy advice and helps ensure Brown & Brown (UK) meets its obligations under UK GDPR, the Data Protection Act 2018 and PECR. The role manages individual rights requests, supports the review of suppliers and marketing activity, and contributes to incident management and privacy awareness across the business.

Key Responsibilities

Individual rights

• Lead the end-to-end handling of Data Subject Access Requests (DSARs) and other individual rights requests, ensuring responses are accurate, complete and issued within statutory deadlines.

Advice and guidance

• Provide day-to-day data protection and privacy advice to colleagues and stakeholders across the business.
• Review marketing activities for compliance with UK GDPR and PECR.

Contracts and suppliers

• Review supplier contracts, data processing agreements and data protection clauses, and advise on risk and negotiation positions.

Risk and assurance

• Support the completion of Data Protection Impact Assessments (DPIAs) and carry out first-line reviews.
• Assist with data breach investigations and incident management, including assessment, documentation and follow-up actions.

Training and awareness

• Support the delivery of privacy training and awareness activities.

Person Specification

• 2 to 5 years' practical data protection or privacy experience.
• Proven experience managing DSARs independently.
• Good working knowledge of UK GDPR and PECR.
• Experience reviewing contracts and data processing agreements.
• Experience providing privacy advice to business stakeholders.
• Experience supporting and reviewing DPIAs.
• privacy qualification such as PDP, CIPP/E or CIPM.

Skills and Attributes

• Clear, concise communicator who can explain legal requirements in practical terms.
• Sound judgement and the confidence to advise and, where necessary, challenge.
• Strong organisational skills, with the ability to manage competing deadlines.
• Discretion when handling sensitive and confidential information.