Data Protection Manager

East Midlands Railway; East Midlands; Hybrid; GBP 60,000 - 90,000; Full time

Benefits offered by this job

32 days leave

Free rail travel

Rail discounts 75%

Friends & family tickets

Personal development opportunities

Job summary

East Midlands Railway (EMR) is seeking a Data Protection Manager to lead the privacy framework and ensure full compliance with UK GDPR, the Data Protection Act 2018, and related legislation. The role provides expert, pragmatic advice and embeds privacy by design across business processes while promoting a culture of accountability and compliance.

This pivotal position offers flexible hybrid working from our Derby head office, a competitive salary, 32 days leave (34 after 2 years), and attractive

Qualifications

• Certified Information Privacy Professional/Europe (CIPP/E) or a BCS Practitioner certificate.
• Knowledge of UK GDPR, Data Protection Act 2018, PECR, ICO guidance, and information security principles. Desirable certification in Data Protection.
• Experience managing DPIAs, Data Subject Rights Requests, personal data breaches, and privacy risk assessments.
• Experience reviewing DPAs, Data Processing Agreements, and Data Sharing Agreements.
• Experience producing Board-level reports and performance metrics to provide compliance assurance to senior leadership.
• Ability to interpret complex legislation and translate it into strategic, risk-based, and proportionate business solutions.

Responsibilities

• Own the data protection strategy and governance, ensuring compliance with UK GDPR and the Data Protection Act 2018.
• Advise senior leadership and project teams on complex privacy matters, embedding privacy by design across initiatives.
• Manage data subject rights requests and personal data breaches within statutory timescales.
• Oversee data processing and data sharing agreements with suppliers and partners.
• Provide ongoing assurance that data protection risks are identified, assessed and mitigated.
• Build capability and awareness through training and campaigns across the organization.
• Monitor regulatory developments and translate them into practical recommendations for the organisation.
• Produce accurate reporting for governance committees and the Board.

Skills

CIPP/E

UK GDPR

PECR

Privacy by design

DPIAs

Data Subject Rights

DPAs

Contract reviews

Board reporting

Stakeholder communication

Education

CIPP/E

BCS Practitioner

Job description

We are proud to be One Team at East Midlands Railway (EMR). We are passionate about keeping people safe, delighting our customers, doing the right thing and putting customers at the heart of our sustainable railway for the East Midlands. With over 2,600 employees, our people are the reason we are so successful, and our employees make a crucial contribution to this.

Ten times accredited as a Top Employer and Gold accredited for Inclusive Employers Standards, we value our people and are dedicated to making sure that everybody feels empowered to bring their authentic self to work.

At EMR we want to proactively embrace diversity across our workforce and recognise that we are under-represented in some areas. We’re therefore taking positive steps to promote a positive and inclusive culture and we welcome applications from everyone to help us better represent our communities.

We have an exciting opportunity to join #TeamEMR as a Data Protection Manager.

This pivotal role leads and manages EMR’s privacy framework to ensure full compliance with the UK GDPR, the Data Protection Act 2018, and related legislation. Providing expert, pragmatic advice and, embedding privacy by design across all business processes, and promote a strong internal culture of accountability and compliance.

Key Roles and Responsibilities

• Data Protection Strategy & Governance - Own the organisation's data protection and privacy framework, ensuring compliance with UK GDPR, the Data Protection Act 2018, PECR and related legislation, and that policies, procedures and standards remain current and effective.
• Advisory & Decision Support - Act as the organisation's principal source of data protection expertise, advising senior leadership and project teams on complex privacy matters, challenging proposals where risks or non-compliance arise, and embedding privacy by design across change initiatives and DPIAs.
• Individual Rights & Breach Management - Own the end-to-end handling of data subject rights requests and personal data breaches, ensuring both are managed lawfully, efficiently and within statutory timescales, with regulatory notification where required.
• Information Governance & Third-Party Assurance - Maintain oversight of the organisation's records of processing activities, and ensure data protection provisions are properly reflected in contracts, data processing and data sharing agreements with suppliers and partners.
• Assurance, Risk & Retention - Provide ongoing assurance that data protection risks are identified, assessed and mitigated, that compliance actions are implemented, and that a robust retention and disposal framework keeps personal data held only as long as necessary and disposed of securely.
• Culture, Capability & Awareness - Build organisational capability and awareness through training and campaigns, ensuring managers and stakeholders understand their responsibilities and a culture of privacy and accountability is embedded.
• Regulatory Horizon Scanning - Monitor developments in data protection law, regulatory guidance and best practice, translating these into practical recommendations for the organisation.
• Reporting & Governance Assurance - Produce accurate, timely reporting and management information for senior leadership, governance committees and the Board, providing assurance on compliance performance and the effectiveness of the data protection framework.
• Stakeholder & Group Relationships - Build effective relationships with internal stakeholders, regulators and the Group Data Protection Officer, ensuring alignment with group-wide privacy strategy and consistent application of standards, and acting as or supporting the DPO role where required.
• Other reasonable requests - The above list is not exhaustive, and on occasion, the role may need to undertake other reasonable requests as required by their line manager, in line with grade and competence.

All staff have a responsibility and accountability to ensure that their day-to-day activities support our commitments under the Sustainability Policy Statement and relevant management systems (e.g. ISO14001 or ISO50001); and to act in a sustainable manner and minimise impact on the environment.

About You

We’re looking for a confident and capable individual who brings:

• Certified Information Privacy Professional/Europe (CIPP/E) or a BCS Practitioner certificate
• Knowledge of UK GDPR, Data Protection Act 2018, PECR, ICO guidance, and information security principles. Desirable certification in Data Protection
• Understanding of privacy by design, information lifecycle management, data sharing, and supplier governance.
• Experience managing DPIAs, Data Subject Rights Requests, personal data breaches, and privacy risk assessments.
• Experience reviewing commercial contracts, Data Processing Agreements (DPAs), and Data Sharing Agreements.
• Experience producing Board-level reports and performance metrics to provide compliance assurance to senior leadership.
• Ability to interpret complex legislation and translate it into strategic, risk-based, and proportionate business solutions.
• Excellent communication (written and verbal), negotiation, and influencing skills to challenge and advise confidently at all organisational levels and committees within a diverse workforce.
• Experience of leading a GDPR governance programme (continuous improvement against minimum standards)

As well as a competitive salary, we’ll also offer you:

• 32 days annual leave (including bank holidays), rising to 34 days after 2 years of service
• Free travel on East Midlands Railway and other train companies operated by Transport UK
• 75% discount on other national rail train companies, including for partners and dependants
• Discounted friends and family tickets on the EMR network
• Various personal development and progression opportunities

This position is based in our Derby Head office, but we've adopted a flexible hybrid working model that creates the opportunity to work in your own way at home but also provides great spaces for in-person collaboration.

We are open minded to applications from people who wish to have flexible working. Many of our staff work flexibly in many ways. Please talk to us at interview about the flexibility you need. We can’t promise to give you exactly what you want, but we do promise not to judge you for asking.

Important Notice to Candidate: AI Use Monitoring

Please be advised that all responses to questions on this application form will be carefully monitored for indications of AI assistance. It is important to us that you are being your authentic self so please base your answers on your personal knowledge and experience.

Any detected use of AI-generated content will result in disqualification from the application process. We value integrity and transparency in all applications and appreciate your cooperation in maintaining these standards.

If you're successful in this role, you'll be expected to support our frontline colleagues at some points throughout the year. This might be undertaking safety critical work, for which you'll receive training, but it could just be helping out with Customer Service when our stations are busy. We're One Team, and that means our managers step up for the frontline, not just manage from a distance. Supporting frontline colleagues is part of our DNA at EMR.

We welcome applicants from diverse backgrounds, we promote equal opportunities for all. East Midlands Railway is a non-discriminatory employer committed to the recruitment and promotion of all on the basis of ability and merit irrespective of disability, race, gender, health, social class, sexual preference, marital status, nationality, religion, employment status or age. We’ll treat your application fairly and assess you for the job based on merit and skills.

We welcome applicants from diverse backgrounds , we promote equal opportunities for all. East Midlands Railway is a non-discriminatory employer committed to the recruitment and promotion of all on the basis of ability and merit irrespective of disability, race, gender, health, social class, sexual preference, marital status, nationality, religion, employment status or age. We’ll treat your application fairly and assess you for the job based on merit and skills.