Privacy Operations Analyst

Thomson Reuters; City of Westminster; Sur place; GBP 70 000 - 100 000; Plein temps

Résumé du poste

Thomson Reuters is seeking a Privacy Program Manager to structure and maintain privacy operations, lead KPI reporting, and coordinate with Legal, Security, and Product teams across jurisdictions. The role emphasizes timely DSAR handling, risk-based workflows, and governance across data processing activities.

You will map data flows, maintain the ROPA, support DPIAs/PIAs/TIAs, and help automate assessment scoring.

Qualifications

• Experience structuring and maintaining privacy operations in work-management tools.
• Ability to build KPI dashboards and reports for privacy leadership.
• Experience tracking cross-functional work items and surfacing bottlenecks.
• Familiarity with DSARs and regulatory timelines across jurisdictions.

Responsabilités

• Manage privacy program reporting and KPIs for leadership.
• Conduct PIAs/DPIAs/TIAs for new products and vendors.
• Maintain and update ROPA, data mapping and risk findings.
• Monitor regulatory changes across jurisdictions and support audits.
• Support privacy by design and cross-functional collaboration.

Connaissances

KPI reporting

Data analysis

Cross-functional collaboration

Outils

Azure DevOps (ADO)

Jira

Power BI

Description du poste

Privacy Program Management & Reporting

• Structure and maintain privacy operations work in Azure DevOps (ADO), Jira, or similar work-management tools, including custom work item types and fields mapped to privacy concepts (jurisdiction, data type, risk tier).
• Build and maintain KPI dashboards and reporting (e.g., DSAR SLA compliance, assessment backlog age, incident response times) for privacy program leadership, using ADO Analytics, Power BI, or similar tools.
• Track cross-functional privacy work items that depend on Legal, Security, and Product teams, and proactively surface bottlenecks and at-risk items.
• Coordinate responses to data subject access requests (DSARs) and other data subject rights requests, ensuring timely resolution within statutory timelines across jurisdictions.
• Track and report on privacy program metrics and KPIs for leadership and relevant stakeholders.

Privacy Risk Assessments

• Conduct and document privacy impact assessments (PIAs), data protection impact assessments (DPIAs), and transfer impact assessments (TIAs) for new products, features, and vendor engagements.
• Support automated assessment workflows that trigger and assign PIAs/DPIAs based on risk-based conditional logic (data type, processing purpose, jurisdiction, vendor risk tier), escalating high-risk triggers for senior review.
• Support efforts to reduce manual effort in assessment scoring and risk rating, applying sound judgment on what can be automated versus what must remain human-reviewed.

Data Mapping & ROPA Maintenance

• Maintain and update the company's records of processing activities (ROPA), tying outputs directly to data mapping and risk assessment findings.
• Support data discovery and data flow mapping efforts across the organization's systems, environments, and third-party integrations, leveraging data discovery tooling where available.
• Support an ongoing ownership and maintenance model for the data map/ROPA, including monitoring for drift as systems or vendors change and reconciling against discovery tool outputs.

Privacy Compliance & Risk Management

• Monitor and track changes in privacy regulations across jurisdictions, and support compliance with key regulations including UK GDPR/EU GDPR, CCPA/CPRA, PIPEDA, and other applicable regimes.
• Support privacy incident response and breach notification processes, including incident documentation and breach register maintenance.
• Support privacy audits and assessments of internal processes and third-party vendors.

Privacy-by-Design & Cross-Functional Collaboration

• Support the intake and triage of privacy-related inquiries from internal stakeholders and customers.