Data Protection Manager

CRS; Greater London; On-site; GBP 90,000 - 120,000; Full time

Job summary

CRS is seeking an experienced Data Protection Manager to lead our privacy framework across the business, with a hands-on, commercial approach. You will work closely with Legal, Compliance, Risk, Information Security, Product, Engineering, Operations, Marketing and other teams to ensure privacy is embedded in how we build products, serve customers and grow the business.

You will play a key role in helping the business scale responsibly, ensuring that data protection requirements are understood,

Qualifications

• Experience in data protection and privacy governance.
• Ability to advise stakeholders and embed privacy-by-design.
• Strong understanding of UK GDPR, EU GDPR and data transfers.

Responsibilities

• Own and maintain the company's data protection and privacy framework.
• Develop, maintain and improve data protection policies, standards, procedures and guidance.
• Monitor compliance with UK GDPR, EU GDPR and local requirements as the business expands internationally.
• Maintain records of processing activities (ROPA), data inventories and data flows.
• Provide clear, practical advice to stakeholders on data protection requirements and risk.
• Act as a trusted privacy partner to Product, Engineering and Technology teams.
• Embed privacy-by-design and privacy-by-default principles into product development and business change.
• Review new products, features, technologies, partnerships and business initiatives from a data protection perspective.
• Lead or oversee Data Protection Impact Assessments (DPIAs) and legitimate interest assessments where appropriate.
• Advise on the use of emerging technologies, including AI, analytics, profiling and automated decision-making.
• Support Procurement, Legal and business teams with data protection aspects of supplier, partner and customer arrangements.
• Review and advise on Data Processing Agreements, international data transfers and appropriate contractual safeguards.
• Assess the data protection implications of new vendors, processors and strategic partners.
• Support due diligence for acquisitions, partnerships and new markets
• Oversee the company's processes for responding to data subject rights requests, including access, deletion, rectification and objection requests.
• Provide guidance and support on personal data breaches and privacy incidents, working closely with Information Security and Risk.
• Coordinate breach assessments and regulatory notifications where required.

Job description

We are a fast-growing payments and fintech business operating in a highly regulated and data-driven environment. As we scale, we are looking for an experienced Data Protection Manager to lead and strengthen our data protection and privacy framework across the business.

This is a hands-on role for someone who can combine strong data protection expertise with commercial judgement and practical execution. You will work closely with Legal, Compliance, Risk, Information Security, Product, Engineering, Operations, Marketing and other teams to ensure that privacy is embedded into how we build products, serve customers and grow the business.

You will play a key role in helping the business scale responsibly, ensuring that data protection requirements are understood, operationalised and proportionate to the risks we face.

Key Responsibilities

Data Protection & Privacy Governance

• Own and maintain the company's data protection and privacy framework.
• Develop, maintain and continuously improve data protection policies, standards, procedures and guidance.
• Monitor compliance with applicable data protection and privacy legislation, including UK GDPR, EU GDPR and relevant local requirements as the business expands internationally.
• Maintain appropriate records of processing activities (ROPA), data inventories and data flows.
• Provide clear, practical advice to stakeholders on data protection requirements and risk.

Privacy by Design

• Act as a trusted privacy partner to Product, Engineering and Technology teams.
• Embed privacy-by-design and privacy-by-default principles into product development and business change.
• Review new products, features, technologies, partnerships and business initiatives from a data protection perspective.
• Lead or oversee Data Protection Impact Assessments (DPIAs) and legitimate interest assessments where appropriate.
• Advise on the use of emerging technologies, including AI, analytics, profiling and automated decision-making.

Third-Party & Commercial Support

• Support Procurement, Legal and business teams with data protection aspects of supplier, partner and customer arrangements.
• Review and advise on Data Processing Agreements, international data transfers and appropriate contractual safeguards.
• Assess the data protection implications of new vendors, processors and strategic partners.
• Support due diligence for acquisitions, partnerships and new markets

Data Subject Rights & Incidents

• Oversee the company's processes for responding to data subject rights requests, including access, deletion, rectification and objection requests.
• Provide guidance and support on personal data breaches and privacy incidents, working closely with Information Security and Risk.
• Coordinate breach assessments and regulatory notifications where required.