Senior Risk & amp ; Compliance Consultant ( Data Privacy )

Barnett Waddingham; Birmingham; Hybrid; GBP 65,000 - 90,000; Full time

Benefits offered by this job

Annual bonus

Life insurance

Income protection

Private medical insurance

Pension scheme

Annual leave 25–27 days

Flexible benefits

Career development

Job summary

Barnett Waddingham in Birmingham is seeking an experienced Senior Risk & Compliance Consultant (Data Privacy / DPO) to join our hybrid office. You will support a diverse client portfolio with proactive privacy advisory work and reactive support for data breaches and DSRs.

You’ll lead privacy assessments, DPIAs, third‑party reviews, and policy development, collaborating with legal, information security, and business teams to embed privacy into day‑to‑day operations.

Qualifications

• Proven experience supporting multiple clients across sectors in a busy advisory role.
• Ability to tailor privacy advice to different business models and regulatory regimes.
• Experience handling data breaches and data subject rights requests (DSRs).
• Experience assessing AI and automated processing of personal data for risk, transparency and accountability.
• Ability to conduct third‑party privacy risk assessments including supplier reviews.
• Ability to produce high‑quality structured written outputs (audit reports, recommendations).
• Experience designing and delivering privacy training and awareness sessions.
• Excellent written and verbal communication for both technical and non‑technical audiences.

Responsibilities

• Support multiple client engagements across diverse sectors in a busy consulting environment.
• Proactively assess and improve clients’ privacy posture, incl. DPIAs, risk assessments, and policy development.
• Advise on AI/automation privacy implications and data processing.
• Conduct third‑party privacy due diligence and ongoing assurance.
• Produce clear audit/assessment reports with prioritized recommendations.
• Provide pragmatic guidance during data breaches and incident response scenarios.
• Deliver tailored privacy education and training for varied audiences.
• Collaborate with legal, information security, and business teams to embed privacy in operations.

Skills

Data privacy

Risk management

Regulatory compliance

Incident response

Privacy by design

DPIAs

Audits

Policy development

Education

CIPP/EN or DPO or IAPP certifications

Job description

We are seeking an experienced Senior Risk & Compliance Consultant (Data Privacy Consultant / DPO) to work from our Birmingham office (hybrid working with flexibility). Other offices will be considered. This position is permanent and ideally full-time (36.25 hours) however part‑time (4 days) will also be considered.

As an experienced Senior Risk & Compliance Consultant / Data Privacy Consultant, you’ll support a diverse portfolio of clients across multiple sectors in a fast‑paced consulting environment. The role involves both proactive privacy advisory work and reactive support for incidents such as data breaches and data subject rights requests (DSRs). This position suits someone who is calm under pressure, comfortable managing multiple priorities, and able to explain privacy risks and decisions clearly, concisely, and without jargon to business stakeholders at all levels.

• Support multiple client engagements simultaneously across a range of sectors in a busy consulting environment
• Proactively assess and improve clients’ data protection and privacy posture, including Privacy gap analyses and audits; Risk assessments and DPIAs, including for new technologies and data uses; and Policy, procedure, and framework development
• Assess and advise on the privacy implications of processing personal data using AI and automated decision‑making technologies
• Conduct third‑party and supplier privacy assessments, including data processing due diligence and ongoing assurance
• Produce clear, well‑structured audit and assessment reports with practical, prioritised recommendations
• Provide calm, pragmatic advice during reactive scenarios, including Data breaches and incident response; Regulatory notifications and communications; and Data subject rights requests (access, erasure, rectification, etc.)
• Deliver privacy education and training, tailored to different audiences and levels of knowledge
• Act as a trusted advisor, helping clients balance regulatory requirements with business objectives across differing regulatory and operational contexts
• Communicate effectively with operational teams, senior leaders, and non‑technical stakeholders, avoiding unnecessary jargon or alarmism
• Work collaboratively with legal, information security, and business teams to embed privacy into day‑to‑day operations
• Maintain awareness of relevant data protection laws, regulatory guidance, and best practices (e.g. GDPR, UK GDPR)
• Managing a small team of consultants

We would love to hear from you if you have:

• Proven experience working in a busy, multi‑client environment supporting organisations across multiple sectors, either in consultancy or an equivalent in‑house role; with hands‑on experience delivering both proactive privacy advisory services and reactive support
• Ability to quickly understand different business models, risk profiles, and regulatory environments, and tailor privacy advice accordingly
• Practical experience handling data breaches and incident response and data subject rights requests
• Experience assessing AI and automated processing activities involving personal data, including understanding risk, transparency, and accountability considerations
• Demonstrated ability to conduct third‑party privacy risk assessments, including review of suppliers, processors, and data sharing arrangements
• Capability to produce high‑quality, structured written outputs, including audit and assessment reports
• Experience designing and delivering privacy training and awareness sessions
• Excellent communication skills, with the ability to translate privacy requirements into clear, concise business decisions and communicate effectively with technical and non‑technical audiences
• Broader business understanding, enabling pragmatic advice that aligns privacy compliance with operational and commercial realities
• Experience working across regulated and non‑regulated sectors (e.g. financial services, healthcare, technology, public sector, retail)
• Experience working closely with information security or cybersecurity teams (an advantage)
• Understanding of technical security controls and how they intersect with privacy and AI risk
• Professional certification such as Certified Data Protection Officer (DPO) or CIPP/M or other IAPP certifications
• Competitive discretionary annual bonus.
• Core benefits including life assurance of four times salary, income protection of 75% of salary for up to five years, and single private medical insurance cover.
• A generous pension scheme
• 25 days’ annual leave, increasing to 27 days after five years’ service.
• Access to the Howden flexible benefits programme, offering a wide range of benefits and discounts to support your wellbeing, family life and lifestyle.
• The opportunity to be part of a growing global business where career development, collaboration and innovation are encouraged.

If you require reasonable adjustments or want more information on accessibility, please let us know