Group Data Protection Executive - 9 month FTC

Quantuma Advisory Limited; United Kingdom; Hybrid; GBP 30,000 - 40,000; Full time

Benefits offered by this job

Hybrid or fully remote working

Flexible working arrangements

Job summary

K3 Advisory Group is seeking a Data Protection Executive on a 9-month fixed-term maternity cover to manage core privacy workflows across the Group. The role reports to the Group DPO and supports DPIAs, DSARs, breach triage, DPAs and governance reporting.

You will work autonomously on process optimization, escalation of high-risk items, and collaboration with multiple business units while staying compliant with UK GDPR and PECR.

Qualifications

• 1–3 years' practical data protection, compliance, legal operations or privacy experience.
• Hands-on DPIAs, DSARs, breach logs or supplier privacy due diligence.
• Working knowledge of the UK GDPR, Data Protection Act 2018 and PECR.

Responsibilities

• Operate the DPIA screening process and maintain the central DPIA register.
• Log, acknowledge and coordinate DSARs and other rights requests.
• Receive and triage data breach incidents and coordinate investigations.
• Review first-pass data processing agreements and supplier privacy due diligence.
• Support policy updates, data mapping and privacy awareness.

Skills

Data protection experience

DPIAs handling

DSARs handling

UK GDPR knowledge

Stakeholder management

Education

CIPP/E or CIPM or equivalent privacy qualification

Tools

SharePoint

Privacy platforms

Job description

About K3 Advisory Group

K3 Advisory Group is a private equity backed advisory and professional services group providing expert advisory across Business Sales, Tax, Restructuring, Technology Solutions, and Financial Services.

Our Data Protection function sits within Group Legal and is responsible for delivering and maintaining the Group's data protection framework across all Group businesses.

Role Overview

We are looking for a Data Protection Executive to provide fixed-term cover for a period of maternity leave (9-month FTC). This is a practical, junior-to-mid-level role supporting the Group Data Protection Officer (DPO) and the wider Legal and Data Protection team by managing core privacy workflows across the Group.

The post-holder will own the day-to-day operation of key data protection processes — including DPIAs, data subject rights requests, personal data breach triage, supplier and data processing agreement reviews, and governance reporting. The role operates with a degree of autonomy over process and workflow, escalating legal, high-risk, contentious and regulated-business matters to the Group DPO or Legal for decision.

Key Responsibilities

DPIAs and privacy by design

• Operate the DPIA screening process and maintain the central DPIA register
• Review screening questionnaires and identify when a full DPIA is required
• Facilitate assessments with project and business teams, documenting processing, necessity and proportionality, risks, mitigations, owners and review dates
• Escalate high residual risk, novel processing, international transfers, AI use, special-category data and proposed prior consultations to the Group DPO

Data subject rights requests

• Log, acknowledge and coordinate DSARs and other rights requests
• Agree search scope with relevant business areas, maintain response timetables and track disclosure materials
• Support the review, redaction and preparation of responses

Personal data breaches

• Receive and triage incidents promptly
• Coordinate containment, fact gathering, investigation records and root-cause analysis
• Maintain the breach register and notification timetable

Supplier and DPA reviews

• Conduct first-pass reviews of data processing agreements and supplier privacy due diligence
• Check core Article 28 UK GDPR requirements, including security evidence, sub-processors, international transfers, breach assistance, audit rights and exit arrangements

Governance, advisory and awareness

• Support ROPA, data mapping, policy updates and privacy champion engagement
• Act as point of contact for routine operational data protection queries from the Group's non-regulated businesses
• Monitor legislative and regulatory developments and propose updates to templates and processes for Group DPO approval

Essential

Skills & experience

• 1–3 years' practical data protection, compliance, legal operations or privacy experience
• Hands-on experience handling or materially supporting DPIAs, DSARs, breach logs or supplier privacy due diligence
• Working knowledge of the UK GDPR, the Data Protection Act 2018, PECR and the current UK data protection regime
• Strong drafting, organisation, stakeholder management and document-review skills
• Ability to manage deadlines, sensitive information and competing requests across multiple businesses, and maintain registers, trackers, MI and audit evidence

Desirable

• IAPP CIPP/E, CIPM, BCS or equivalent privacy qualification (or active progress towards one)
• Experience in professional services, financial services or a multi-entity group
• Exposure to DPA negotiation, international transfers, AI governance or privacy-by-design reviews
• Familiarity with SharePoint, workflow tools and data-mapping or privacy-management platforms

What We Offer

• Negotiable basic salary pro rated £30,000 - £40,000 depending on experience
• A collaborative, purpose-driven working environment within a growing Group
• Exposure to a broad range of data protection matters across multiple business lines
• The opportunity to work closely with experienced legal and compliance professionals
• Hybrid or fully remote and flexible working arrangements

#K3Advisorygroup