Deputy Data Protection Officer

John Lewis Partnership; Greater London; Hybrid; GBP 54,000 - 90,000; Full time

Job summary

John Lewis Partnership seeks a Deputy Data Protection Officer to help shape privacy strategy and oversee personal data risk across the organisation. You will influence divisional teams to embed privacy by design, manage DPIA processes and ensure compliance with UK GDPR and related legislation.

You will work in a hybrid setting, with office-based days at London/Bracknell and occasional site visits, supporting the DPO and reporting to senior management and the Audit & Risk Committee.

Qualifications

• Educated to degree level with a legal qualification and strong data protection knowledge.
• Experience navigating regulatory frameworks and privacy laws at a senior level.
• Proven track record leading teams and managing multiple stakeholders.

Responsibilities

• Set strategic governance for privacy policies and risk management across the organisation.
• Act as deputy to the Data Protection Officer and liaise with ICO and data subjects.
• Design, maintain and communicate data protection policies, DPIA methodologies and privacy controls.
• Lead Privacy by Design and DPIA initiatives across projects with risk-based prioritisation.
• Establish accountability frameworks, incident response and rights management processes.

Skills

Degree level

Legal qualification

Legal & regulatory experience

Data protection expertise

Experience leading a team

Stakeholder management

Education

Degree in law or related field

Job description

About the role

You will support the Data Protection Officer, working alongside another Deputy Data Protection Officer, in setting strategic direction for privacy policies and managing personal data risk across the Partnership. In this role, you will influence key divisional teams to deliver our privacy strategy, ensuring privacy considerations sit at the heart of projects and is deeply embedded, to identify and mitigate key risks proactively. You will also support the Data Protection Officer in delivering independent assurance to the Board, General Counsel, and Audit & Risk Committee, while guiding management to ensure robust compliance with legal frameworks and legislation, including the Data (Use and Access) Act 2025, Data Protection Act 2018, UK GDPR, and PECR.

At a glance

Hybrid working: This is a hybrid working role, therefore your time will primarily be split between working from home and the Head Offices - London / Bracknell. However, there will also be an expectation to visit other locations as the need arises.

You will be expected to work from the office location at least twice a week to connect and on a more ad-hoc basis to attend key meetings, but again the frequency is dependent on the business needs.

Expected Salary - Up to £90,000 (depending on experience)

Contract type - This position is a permanent contract.

Key Responsibilities

• Strategic Governance & Advisory: Help shape information and data strategies that safeguard the Partnership over the short and long term while leading and participating in key decision‑making forums and steering groups.
• Regulatory & External Liaison: Act as a deputised point of contact with the Information Commissioner’s Office (ICO), relevant supervisory authorities, and individual data subjects regarding privacy complaints, queries, and rights requests.
• Policy Ownership & Business Support: Design, maintain, and review data protection policies, guidance, and standards (including Fair Processing Notices and cookie policies) for Partners, customers, and suppliers. Advise accountable business owners so they understand their legal obligations, risks, and mitigation strategies.
• Privacy by Design & DPIA Management: Lead and maintain the Data Protection Impact Assessment (DPIA) methodology, tools, and risk acceptance processes alongside Data Owners. Orchestrate the implementation of "Privacy by Design" and "Privacy by Default" across medium‑and high‑risk projects.
• Risk & Accountability Frameworks: Establish and maintain a clear data privacy accountability framework, policy exception processes, risk reporting mechanisms, and controls for technical and organisational measures across the organisation.
• Breach & Rights Management: Lead day‑to‑day operations within the Data Privacy Office, maintaining the data breach response plan and overseeing the resolution of escalated rights requests and incidents.
• Team Leadership & Development: Recruit, manage, and retain a high‑performing privacy team. Create an internal operating model and SME training packages to build and maintain expert capability within the Data Privacy Office.
• Training & Education: Lead and maintain organisation‑wide Data Privacy and Information Security awareness programmes, spanning mandatory modules for all Partners and tailored training for high‑risk roles.

Essential Skills / Experience you’ll need

• Educated to degree level
• Legal qualification
• Legal & Regulatory experience
• Expert knowledge of Data Protection and operational compliance
• Experience of Leading and Managing a team of people
• Experience of Stakeholder management.

Desirable Skills / Experience you may have

• Law Degree
• Data Protection Certifications such as CIPP/E
• Experience of working within the Retail Industry and Tech/AI qualifications/experience.

Additional information

• Should your initial application be successful, the subsequent stages will comprise two rounds of interviews - virtual and in‑person assessments.
• Interviews potentially commence from w/c 26th October 2026.

The partnership

We’re the largest employee owned business in the UK and home of our cherished brands, John Lewis and Waitrose. We’re not just employees, we’re Partners, driven by our purpose to build a happier world. As we look to our future, there’s never been a more exciting time to join us.

We’re ruthlessly focused on being brilliant at retail. We continue to innovate, adapt and diversify. Never Knowingly Undersold on price, quality and service in John Lewis and passionately serving food‑lovers in Waitrose.

As Partners we all share the responsibility of ownership and in its rewards. We use our voices to contribute to our success, working together through the good and challenging times, holding true to our behaviours and treating everyone with kindness and respect.

We all own making the Partnership somewhere we belong. Embracing our differences and creating an environment where we’re free to be ourselves and can THRIVE. Growing ourselves individually, and as a collective.

As Partners, we make all the difference. And, we all own it.

Important points to note:

It’s important to note that some of our roles are subject to pre‑employment vetting (which may include DBS checks for successful candidates). If required, you’ll be informed and provided with information about vetting during the recruitment process and we encourage you to complete any vetting documents quickly to avoid delays. Any DBS checks required will be carried out by a third‑party registered body and financial probity checks may also be required for some of our roles.

We occasionally close vacancies early in the event we receive a high volume of applications, and therefore, we recommend you apply early. If you require a reasonable adjustment due to a disability which means you may need longer to complete your application please contact us as soon as possible.

We want all of our Partners to have a good work‑life balance and we support flexible working. This might mean flexible or compressed hours, job sharing or short‑hour contracts, where possible. Please discuss this further with the hiring manager during your interview.