Head of Compliance and Data Protection Officer

Yolk Recruitment; Peacehaven; On-site; GBP 60,000 - 80,000; Full time

Benefits offered by this job

LGPS

Generous annual leave

Learn Welsh

Employee assistance programme

Job summary

Coleg y Cymoedd seeks a Head of Compliance and Data Protection Officer to lead the college's compliance assurance and act as its DPO. You will provide expert guidance on UK GDPR, Data Protection Act 2018 and related legislation, reporting to the Vice Principal: Corporate Services and working with senior leaders, the Governing Body and external regulators.

You will drive DPIAs, information governance, records management and risk-based monitoring, while coordinating Medr reporting and assurance

Qualifications

• Degree-level qualification in a relevant discipline such as law, information governance, compliance.
• Recognised data protection qualification (BCS/ISEB/IAPP) or willingness to obtain within 6 months.
• Substantial experience as a Data Protection Officer or senior data protection/compliance role.

Responsibilities

• Lead compliance assurance and act as Data Protection Officer for the college.
• Provide independent oversight across regulatory compliance, data protection and information governance.
• Review DPIAs, policies, information management and retention.
• Support Medr reporting and annual assurance return.
• Advise senior leaders and Governing Body on regulatory matters.

Skills

Data protection

Governance

Regulatory compliance

DPIAs

Subject Access Requests

FOI requests

Information governance

Risk management

Advising leaders

Education

Law or information governance degree

CIPP/E or equivalent

Tools

GRC tools

Job description

Yolk Recruitment is delighted to be partnering with Coleg y Cymoedd to appoint a new Head of Compliance and Data Protection Officer.

This is an exciting opportunity to join a college at the heart of its communities, supporting more than 10,000 learners each year across four campuses.

This is a newly created role, established as Coleg y Cymoedd continues to develop its compliance arrangements in response to evolving regulatory requirements and new Medr funding conditions. With future reporting requirements ahead, including the Annual Assurance Return to Medr, this is an opportunity to join at an important point in the college's development and help shape how compliance and data protection operate for the future.

The opportunity

Reporting to the Vice Principal: Corporate Services, you will lead the college's compliance assurance function while acting as its designated Data Protection Officer (DPO).

You will provide independent oversight and expert advice across regulatory compliance, data protection and information governance, working with senior leaders, the Governing Body and colleagues across the college to ensure the right systems, processes and controls are in place.

Your initial priorities will include:

• Reviewing the college's current data protection arrangements, including Data Protection Impact Assessments (DPIAs).
• Reviewing policies, procedures and the way information and records are stored and managed.
• Identifying compliance and data protection risks and putting practical solutions in place.
• Considering the implications of increased automation and digital transformation, including the use of AI and automated decision-making.
• Strengthening information governance, records management and compliance processes.
• Supporting the college's preparations for future Medr reporting and assurance requirements.

You will lead compliance with Medr's Regulatory Framework, including its Conditions of Registration and Conditions of Funding, and coordinate the college's Annual Assurance Return to Medr.

The role will also cover:

• Data protection and information governance
• Subject Access Requests and data breaches
• Freedom of Information requests
• Records management and retention
• Information asset registers
• Data sharing agreements and supplier due diligence
• Complaints and regulatory notifications
• Policy, procedure and institutional compliance
• Insurance and risk management
• Regulatory and performance reporting

As DPO, you will provide advice on UK GDPR, the Data Protection Act 2018 and the Data Use and Access Act 2025, oversee DPIAs, Subject Access Requests, data breaches and ICO correspondence, and maintain the college's wider information governance framework.

You will also provide evidence-based reporting and advice to senior leaders, Boards and Committees.

About you

We are looking for an experienced compliance and/or data protection professional who can operate confidently within a regulated environment.

You will bring:

• Degree-level qualification (or equivalent professional experience) in a relevant discipline such as law, information governance, compliance, or a related field.
• A recognised data protection qualification (BCS Practitioner Certificate, ISEB Certificate in Data Protection or IAPP CIPP/E), or willingness to obtain one within 6 months of appointment, supported by the College and required to pass probation.
• Substantial experience as a Data Protection Officer or in a senior data protection or compliance role within a regulated environment.
• Experience leading or managing data protection and compliance within a regulated organisation.
• Experience advising senior leaders, executive teams and governing bodies on regulatory, data protection and information governance matters.
• Experience developing compliance frameworks, policies, registers and risk-based monitoring arrangements.
• Experience managing Subject Access Requests, Freedom of Information requests, data breaches and ICO correspondence.
• Experience advising on DPIAs, records of processing activities and information asset registers.
• Experience with regulatory returns, assurance submissions or statutory reporting.
• Experience with data sharing agreements, processor contracts and supplier due diligence.
• Expert working knowledge of UK GDPR, the Data Protection Act 2018 and the Data Use and Access Act 2025.
• Sound knowledge of the Freedom of Information Act 2000 and the Environmental Information Regulations 2004.

More than technical expertise

This role needs someone who is confident enough to challenge when something isn't right, but who understands that effective compliance is about bringing people with you.

Coleg y Cymoedd is looking for someone who is authentic, honest, practical and solution-focused - someone who can identify risk and raise difficult issues while building constructive relationships across the organisation.

The successful candidate will need to move comfortably between detailed operational work and strategic thinking, translating complex legislation and regulation into clear, practical advice that colleagues can understand and act on.

The college's values are Authentic, Supportive, People-Centred, Inclusive, Responsible and Empowered, and these will be central to how the successful candidate works with learners, colleagues, senior leaders, regulators and external partners.

Benefits

• Local Government Pension Scheme (LGPS)
• Generous annual leave
• Opportunity to learn Welsh
• Free employee assistance programme
• Full suite of family-friendly policies to support work/life balance
• Gymnasiums at Nantgarw and Ystrad Mynach campuses
• Free parking at all College campuses
• Annual pay progression
• Car leasing scheme
• Hair, beauty and catering discounts
• Specsavers vouchers
• ASPIRE Employee Recognition Award

Closing Date: Midday on Wednesday, 7th October

Interview Date: Friday, 16th October

Disability Confident Interview Scheme

Coleg y Cymoedd is proud to be part of the Disability Confident Interview Scheme. If you have a disability and meet all the essential criteria in the person specification, you'll be guaranteed an interview.

Please notify Hannah at Yolk Recruitment if this applies to you. We're committed to an inclusive recruitment process and will provide reasonable adjustments if needed.