Data Protection Analyst

Working closely with the Data Protection Lead, Information Security colleagues and stakeholders across the business, the successful candidate will play a key role in supporting the organisation’s data protection framework, ensuring compliance with data protection legislation and embedding privacy best practice across the organisation.

The successful individual will hold the following responsibilities:

• Support the delivery and continuous improvement of Nuffield Health’s Data Protection Framework, including maintaining data protection records, documentation and accountability evidence, ensuring compliance with UK data protection legislation and organisational policies.
• Coordinate and manage Data Subject Rights Requests, including DSARs, rectification, erasure, restriction, portability and objection requests, ensuring statutory deadlines are met and accurate records are maintained. Support the ongoing development and improvement of related processes and controls.
• Provide practical day-to-day data protection advice and guidance to colleagues, supporting projects, operational teams and business change initiatives while promoting privacy by design.
• Support the completion of DPIAs, PIAs, LIAs and reviews of high-risk processing activities, ensuring privacy risks are appropriately identified, assessed and managed.
• Assist in the management of personal data breaches, compliance monitoring activities, audits and assurance reviews, including maintaining risk registers, incident records and improvement plans.
• Support third-party privacy due diligence activities, including reviews of Data Processing Agreements, data sharing arrangements, processors and international data transfers.
• Produce reports, metrics, dashboards and management information, analysing trends and identifying opportunities to improve compliance, efficiency and data protection performance.
• Support the development of training, awareness materials, guidance documents and self-service tools, acting as a privacy champion and helping to embed a culture of accountability and transparency across the organisation.
• The role holder will be expected to perform any other duties that may reasonably be asked of them.
• The role holder will need to build and maintain effective relationships at all levels across the organisation.

• Experience working within a Data Protection, Privacy, Compliance, Information Governance or Risk role.
• Good understanding of UK GDPR, the Data Protection Act 2018 and associated privacy requirements.
• Experience supporting and/or coordinating Data Subject Access Requests (DSARs) and other data subject rights requests.
• Experience supporting DPIAs, PIAs, LIAs or similar privacy assessments.
• Experience supporting supplier, third-party or data sharing reviews would be advantageous.
• Knowledge of personal data breach management and incident response processes.
• Experience maintaining records, registers, audit trails and compliance documentation.
• Strong organisational skills with the ability to manage multiple priorities and deadlines effectively.
• Excellent attention to detail and analytical skills.
• Strong written and verbal communication skills, with the ability to explain data protection requirements clearly to a range of stakeholders.
• Confident IT user with strong skills in Microsoft Office applications, particularly Outlook, Word and Excel.
• Ability to build effective working relationships and influence stakeholders across different teams.
• Experience producing reports, dashboards, metrics or management information would be advantageous.
• Professional data protection qualifications such as IAPP, BCS Practitioner Certificate in Data Protection or equivalent would be desirable.

We want you to love coming to work, feeling healthy, happy and valued. That’s why we’ve developed a benefits package with you in mind. Here, you can choose from a range of fitness, lifestyle, health and fitness wellbeing rewards, such as free gym membership, health assessments, retail discounts and pension options.