Data Protection Manager

• Carry out a full GDPR compliance audit and identify where there may be gaps or deficiencies, producing a clear formal report of the same
• Propose and implement remedial actions arising from the above audit where needed
• Overhaul all data protection documentation, producing a relevant and accessible, principles based, revised Data Protection Policy and accompanying processes and forms
• Ensure that all data flows are mapped by the relevant teams and that Data Protection Impact Assessments are created where appropriate
• Work with relevant teams to review data protection requirements in relation to systems, suppliers, contracts and data sharing arrangements, advising on any gaps or remedial actions required
• Based on findings of audit, identify where training is needed and work with the Head of Learning & Development to develop fit for purpose training on operational aspects of GDPR, including DPIAs (and when they are not needed) and data flow mapping requirements
• Work with the Fundraising team to ensure emerging fundraising practices are compliant with legislation and our data protection principles and support the build of a dedicated fundraising data policy if appropriate
• Act as the first point of contact for all data subject access requests, working with service and enabling teams to identify the required data and escalating to the Director of Finance & Resources where needed

• Strong working knowledge of UK GDPR, the Data Protection Act 2018 and PECR, as well as emerging legislation such as the Data (Use & Access) Act 2025, with the ability to apply these requirements in a practical organisational context, * Experience of carrying out data protection or GDPR compliance reviews, identifying gaps or deficiencies, and producing clear, prioritised recommendations for improvement.
• Experience of developing or improving data protection policies, processes, forms and guidance so that they are clear, accessible and fit for purpose.
• Practical experience of supporting data flow mapping and Data Protection Impact Assessments, including advising when DPIAs are and are not required.
• Experience of managing or supporting data subject access requests, data protection enquiries, and potential data protection incidents or breaches.
• Ability to work confidently with colleagues across different teams to understand operational practice, advise on data protection requirements, and support proportionate remedial action.

Allen Lane are partnering with a not-for-profit organisation on their recruitment for an interim Data Protection Manager. This a 3-6 month contract inside IR35 and hybrid working with 1-2 times a week onsite in London.