Data Protection Manager

Allen Lane; Slough; Hybrid; GBP 70,000 - 90,000; Full time

Job summary

Allen Lane are partnering with a not-for-profit organisation to recruit an interim Data Protection Manager for a 3-6 month contract inside IR35. Hybrid working with 1-2 days onsite in London.

You will lead a full GDPR compliance audit, overhaul data protection documentation, map data flows, create DPIAs where appropriate, and advise on remedial actions. You will also support data subject access requests, training development, and fundraising data practices.

Qualifications

• Strong working knowledge of UK GDPR, the Data Protection Act 2018 and PECR, with the ability to apply these requirements in a practical organisational context

Responsibilities

• Carry out a full GDPR compliance audit and identify gaps or deficiencies, producing a formal report
• Propose and implement remedial actions arising from the audit
• Overhaul data protection documentation, producing a revised Data Protection Policy and accompanying processes and forms
• Ensure that data flows are mapped and DPIAs are created where appropriate
• Review data protection requirements across systems, suppliers, contracts and data sharing arrangements and advise on gaps/remedial actions
• Identify training needs and develop fit-for-purpose GDPR training on operational aspects including DPIAs and data flow mapping
• Work with the Fundraising team to ensure fundraising practices are compliant and support a fundraising data policy if appropriate
• Act as the first point of contact for data subject access requests and coordinate with relevant teams

Skills

UK GDPR knowledge

Job description

Allen Lane are partnering with a not-for-profit organisation on their recruitment for an interim Data Protection Manager. This a 3-6 month contract inside IR35 and hybrid working with 1-2 times a week onsite in London.

OVERALL ACCOUNTABILITIES:

• Carry out a full GDPR compliance audit and identify where there may be gaps or deficiencies, producing a clear formal report of the same
• Propose and implement remedial actions arising from the above audit where needed
• Overhaul all data protection documentation, producing a relevant and accessible, principles based, revised Data Protection Policy and accompanying processes and forms
• Ensure that all data flows are mapped by the relevant teams and that Data Protection Impact Assessments are created where appropriate
• Work with relevant teams to review data protection requirements in relation to systems, suppliers, contracts and data sharing arrangements, advising on any gaps or remedial actions required
• Based on findings of audit, identify where training is needed and work with the Head of Learning & Development to develop fit for purpose training on operational aspects of GDPR, including DPIAs (and when they are not needed) and data flow mapping requirements
• Work with the Fundraising team to ensure emerging fundraising practices are compliant with legislation and our data protection principles and support the build of a dedicated fundraising data policy if appropriate
• Act as the first point of contact for all data subject access requests, working with service and enabling teams to identify the required data and escalating to the Director of Finance & Resources where needed

Qualifications/ Knowledge

• Strong working knowledge of UK GDPR, the Data Protection Act 2018 and PECR, as well as emerging legislation such as the Data (Use & Access) Act 2025, with the ability to apply these requirements in a practical organisational context

Experience

• Experience of carrying out data protection or GDPR compliance reviews, identifying gaps or deficiencies, and producing clear, prioritised recommendations for improvement.
• Experience of developing or improving data protection policies, processes, forms and guidance so that they are clear, accessible and fit for purpose.
• Practical experience of supporting data flow mapping and Data Protection Impact Assessments, including advising when DPIAs are and are not required.
• Experience of managing or supporting data subject access requests, data protection enquiries, and potential data protection incidents or breaches.
• Ability to work confidently with colleagues across different teams to understand operational practice, advise on data protection requirements, and support proportionate remedial action.