Data Protection Specialist (0619)

Mills & Reeve; Oxford; On-site; GBP 60,000 - 90,000; Full time

Job summary

Mills & Reeve is recruiting a Data Protection Specialist to advise across the firm on data protection, risk and compliance. Reporting to the General Counsel, you will own significant areas of the data protection programme and work with partners, lawyers and business services to embed privacy into decision-making.

You will handle supplier management, data transfer governance, DPIAs and governance activities, balancing regulatory requirements with practical business outcomes.

Responsibilities

• Provide data protection guidance to partners and business services across the firm.
• Review supplier data protection provisions and data protection questions during procurement.
• Support responses to data subject rights and data protection incident notifications.

Job description

We're recruiting for a data protection specialist to be a trusted advisor on data protection, working across the firm to solve complex issues, manage risk and support colleagues with practical, business-focused guidance.

This is an exciting opportunity to join the General Counsel function at Mills & Reeve. Reporting to the General Counsel, this role is responsible for developing and taking ownership of key aspects of the firm's operational and commercial data protection programme.

The Data Protection Specialist will be a trusted adviser to partners, lawyers and business services teams, helping the firm navigate complex data protection requirements in a pragmatic and commercially focused way. The role combines technical expertise with practical problem-solving and relationship management, working closely with stakeholders across the business to ensure data protection is effectively embedded into decision-making, procurement, technology, supplier management and client engagements.

You will take ownership of significant areas of the firm's data protection programme, with particular responsibility for supplier management, client and supplier contractual requirements, data protection due diligence, international data transfer governance, auditing and wider regulatory compliance activities. You will help ensure that data protection is effectively embedded into business processes, commercial decision-making and risk‑management activities. You will take ownership of key workstreams, driving activity forward, identifying improvements and implementing practical, risk‑based solutions that support the firm's strategic and operational objectives.

This role can be based in any of our regional offices.

The person

The role would suit an experienced data protection professional with a strong background in operational and commercial data protection, ideally gained within a law firm, professional services business or similarly regulated environment.

You will combine strong technical knowledge with sound commercial judgement. You will have the confidence to apply your knowledge in a pragmatic, risk‑based way. You will enjoy working independently, taking ownership of significant areas of responsibility and driving matters through to completion.

You will have experience operating within a complex organisation where data moves across multiple systems, teams, processes and third‑party providers. You will be comfortable understanding and analysing complex data flows and advising on the practical implications of business, technology and procurement decisions. You have a focus on non‑contentious data protection (contracts, supplier management, international data transfers), and can assist with responding to, and advising a range of internal stakeholders on, data subject rights, incidents, supplier and client‑side data protection requirements, and broader governance obligations.

• strong knowledge of UK GDPR, Data Protection Act 2018 and related regulatory guidance, with the ability to translate legal and regulatory requirements into practical business advice for senior stakeholders.


• significant experience of non‑contentious data protection work, including contracts, supplier management, procurement processes, data protection impact assessments and governance activities.


• strong commercial awareness and the ability to balance regulatory requirements, business objectives and risk considerations.


• confidence operating independently and confident in setting and prioritising multiple competing demands.


• effective self‑management and confidence in setting and prioritising their own work agenda.

The Role Additionally Requires Someone Who

• works collaboratively and contributes positively to a supportive team culture.


• is curious, pragmatic and confident in exercising judgement.

The activities

Shared data protection advice and response activity

• Responding to data incidents (immediate response; drafting ICO notification; drafting data subject notifications; identifying clients to be notified).


• Responding to regulatory queries.


• Responding to complaints with data aspects.

Supplier management

• Reviewing and negotiating data protection provisions in supplier and third‑party contracts.


• Reviewing supplier and third‑party responses to data protection questions during the procurement process.


• Checking supplier and third‑party sub‑processors for issues.

Client‑side contracts

• Taking responsibility for data protection content in letters of engagement and terms and conditions.


• Reviewing bespoke client contracts and terms.


• Maintaining records of data protection clauses with clients, including notification obligations and timescales and liaising with colleagues on AI‑related contractual provisions where relevant.

Internal auditing and reporting

• Conducting or procuring appropriate data protection auditing activity and working with the data protection team and other departments to implement resulting corrections.


• Supporting and contributing to other internal and external assurance frameworks.


• Reviewing and maintaining data protection content within the firm's risk register, identifying and escalating key data protection risks.

Internal departmental support

• Providing pragmatic, risk‑based data protection advice to Marketing, the People team, investigations teams, fee earners and Partners.


• Supporting employee rights request responses, including reviewing disclosures and advising on exemptions where appropriate.


• Providing data protection input into internal investigations to support lawful handling, sharing and disclosure of personal data.

A full list of activities and responsibilities can be found in the job description attached below.

The Benefits

As you'd expect, we offer a competitive salary and a wide range of benefits.

Pre employment screening

If we offer you a role, we will conduct comprehensive pre‑employment screening. This screening will include, but is not limited to, a basic DBS, verification of your right to work, a three year employment history and a self‑declaration to assess your character and suitability for the role. Full details of our pre‑screening employment process are available upon request.

Use of AI during the recruitment process

Technology is changing rapidly and we are all increasingly using AI software in our day to day lives, as well as using it to support our learning and professional development.

Here at Mills & Reeve, we embrace the use of technology and AI and we recognise that candidates may use AI tools to support their applications. As a regulated industry, we expect candidates to use such tools responsibly, honestly and in a manner that allows us to make a fair and accurate assessment of their individual skills, experience and suitability for the role.

Please ensure you have thoroughly read the document attached below to understand what we deem acceptable uses of AI.

The firm

Mills & Reeve is centred on achieving more for clients, their businesses and the wider communities we serve. Our clients and their industries benefit from our knowledge and learning, and receive consistent experiences with no surprises. We tell them what they need to know when they need to know it.

We build personal relationships, with advice individually tailored to individual need. And if clients need things we don't offer, we draw on our network to give recommendations. Our 1,450 plus people and over 850 lawyers share one vision – achieving more for clients.

By joining Mills & Reeve, you'll have the chance to build your skills and experience within a firm that's not only ranked in the top 50 UK law firms, but also one that truly values their people. We're also ranked in The Sunday Times Best Places to Work list, and have been awarded Platinum Investors in People. Our mantra is “Achieve more. Together.”, which we feel embodies our purpose and is more than just a catchphrase!

Our values are the principles that help us fulfil our purpose. Our people shaped them and live them every day.

• We're ambitious - We aim high, we embrace new ideas and we're passionate about our work


• We're open - We communicate openly and honestly to build trust, and we do what's right


• We care - We're committed to each other, our clients, our communities and the planet


• We collaborate - We're easy to work with, we offer help willingly and we get things done – together

And finally

Everyone at Mills & Reeve brings a unique perspective and ideas to the team and we do everything we can to help each person to thrive. We're committed to providing an inclusive and supportive working environment, are happy to consider flexible working arrangements, and want to achieve the right balance for both our people and the firm. We encourage everyone to ask if they feel they need any workplace adjustments, and will do our best to support with these.

To find out more about our diversity and inclusion work, visit our website .