Information Governance Manager

The Methodist Church in Britain; City of Westminster; On-site; GBP 33,000 - 52,000; Part time

Job summary

The Hospital of St John and St Elizabeth is seeking an operationally focused Information Governance professional to support the Data Protection Officer. The role covers the hospital and its on-site hospice, operating at 0.6 FTE.

You will investigate data breaches, train staff, and ensure compliance with UK GDPR and the Data Protection Act 2018 while maintaining governance documentation. Ideal candidates will have substantial information governance experience in regulated settings, plus a

Qualifications

• Recognised data protection or information governance qualification (e.g., CIPP/E, BCS Practitioner Certificate) or equivalent experience.
• Substantial information governance or data protection experience, ideally in a hospital or regulated setting.

Responsibilities

• Act as operational lead for information governance, supporting the DPO on UK GDPR, the Data Protection Act 2018, ICO guidance and DSPT compliance.
• Investigate information governance incidents, complaints and potential personal data breaches with the DPO and colleagues, meeting reporting timeframes.
• Turn lessons learned into lasting good practice and develop information governance training across the Hospital and Hospice.
• Maintain policies, privacy notices and the information governance risk register; carry out audits and spot checks.
• Map assets and data flows with Information Asset Owners and support Data Protection Impact Assessments; review Data Sharing Agreements.

Skills

Data protection qualification

Education

Data protection qualification / info governance credential

Job description

This Corporate team post at The Hospital of St John and St Elizabeth reports to the Company Secretary and General Counsel, who is the statutory Data Protection Officer. The work keeps the hospital compliant with UK GDPR, the Data Protection Act 2018 and the NHS Data Security and Protection Toolkit, investigating breaches and training staff. It is a 0.6 FTE role covering the hospital and its on-site hospice. Fit depends on substantial data protection experience, ideally in a regulated setting, plus a recognised qualification or equivalent experience.

What the job involves

• Act as operational lead for information governance, supporting the DPO on UK GDPR, the Data Protection Act 2018, ICO guidance and DSPT compliance
• Investigate information governance incidents, complaints and potential personal data breaches with the DPO, SIRO and Caldicott Guardian, meeting the 72-hour reporting window where required
• Turn lessons learned into lasting good practice
• Develop and deliver information governance training and guidance across the Hospital and Hospice
• Maintain policies, privacy notices and the information governance risk register
• Carry out audits and compliance spot checks across the Hospital and Hospice
• Work with Information Asset Owners to map assets and data flows and maintain the Register of Processing Activities
• Support colleagues with Data Protection Impact Assessments
• Review Data Sharing Agreements and carry out supplier due diligence under the General Counsel's supervision
• Ensure data subject requests meet statutory timeframes, including supporting the Medical Records team on medical records requests
• Report key compliance KPIs to the Information Governance Committee
• Complete and submit the annual NHS Data Security and Protection Toolkit and support the SIRO, DPO and Caldicott Guardian in their duties

What’s required

Qualifications

• Recognised data protection or information governance qualification, held or in progress, such as BCS Practitioner Certificate in Data Protection or IAPP CIPP/E, or equivalent professional experience

Experience

• Substantial information governance or data protection experience, ideally in a hospital or comparable regulated setting
• Track record investigating information governance incidents and personal data breaches
• Track record handling data subject requests to statutory deadlines
• Track record developing and delivering training that raises awareness across an organisation

Skills & knowledge

• Working knowledge of UK GDPR, the Data Protection Act 2018 and the common law duty of confidentiality
• Awareness of ICO guidance
• Sound analytical judgement and practical application of the rules
• Influencing and challenging colleagues at all levels
• Working autonomously and prioritising competing statutory deadlines

Other

• Discretion and the highest standards of integrity

Nice to have

• Familiarity with the Caldicott Principles
• Familiarity with the NHS Data Security and Protection Toolkit