Data Privacy Specialist UK

About you and the Role:

The Data Privacy Specialist will sit in Enstar's Global Data Privacy team reporting to the Data Privacy Manager and working alongside colleagues in the UK and US. You will be providing day-to-day specialist data privacy advice across the Group so that personal data is handled lawfully, consistently and demonstrably in every jurisdiction in which Enstar operates. The role holder is expected to work across all disciplines of data privacy rather than specialising in specific areas and will coordinate with colleagues in other time zones. Enstar’s business is built on acquired portfolios, therefore the role involves working with inherited records, legacy systems, long retention tails and processing designed under a previous owner and exercising judgement about what to prioritise within those constraints.

What you will be doing:

Overall contribution

• Provide day-to-day specialist data privacy advice across the Group so that personal data is handled lawfully, consistently and demonstrably in every jurisdiction in which Enstar operates and deliver assigned workstreams of the data privacy maturity programme.

Scope and reporting

• Work in a Group-wide, multi-jurisdictional role within Enstar's Global Data Privacy team, reporting to the Data Privacy Manager and coordinating with colleagues in the UK, US and other time zones.
• Work across all disciplines of data privacy rather than specialising in specific areas.

Judgement and escalation

• Exercise independent specialist judgement: analyse complex, multi-jurisdictional issues and recommend proportionate solutions, including what to prioritise when working with inherited records, legacy systems, long retention tails and processing designed under a previous owner.
• Escalate appropriately to the Data Privacy Manager. Legal conclusions and the acceptance of business risk remain with the Head of Data Privacy, the DPO and the relevant business owners.

Maturity programme

• Contribute to the baseline assessment across entities and jurisdictions and own delivery of assigned workstreams through to evidenced closure.

Privacy by Design and Default

• Advise project teams on applying Privacy by Design and Default principles, supporting the initiative to embed them across the organisation and delivering the relevant training.

PIAs, DPIAs and LIAs

• Produce privacy impact assessments (PIAs), data protection impact assessments (DPIAs) and legitimate interests assessments (LIAs), including those escalated following screening by the Analyst.
• Submit completed assessments to the Data Privacy Manager for quality review, with decisions on residual risk taken by the DPO, Head of Data Privacy or business owner as applicable.

Consumer and data subject rights

• Advise on data subject rights requests across all jurisdictions and handle complex or multi-jurisdictional cases, including those referred by the Analyst, ensuring each is recorded end to end.

ROPA, inventories and data maps

• Maintain and update the record of processing activities (ROPA), supporting the Data Privacy Manager.

Regulatory compliance and horizon scanning

• Support the Data Privacy Manager in maintaining compliance with applicable data protection legislation across all operating jurisdictions (UK GDPR, EU GDPR, US privacy laws and the Australian Privacy Act).
• Monitor regulatory developments as part of the Horizon Scanning Framework.

Regulatory registrations and filings

• Assist with regulatory registrations and filings.

Privacy notices, cookies and consent

• Review and update privacy notices and cookie consent management.

Supplier privacy due diligence

• Assist with privacy due diligence on third-party suppliers as part of the Supplier Engagement Framework.

Data Processing Agreements

• Review Data Processing Agreements (DPAs) with relevant data processors and recommend changes.

International transfers and TIAs/TRAs

• Assist with international data transfer mechanisms across all operating jurisdictions, ensuring they are current, properly documented and subject to regular review.
• Produce transfer impact or risk assessments (TIAs/TRAs) where required, develop recommendations for the Data Privacy Manager's review, and maintain oversight of cross-border data flows arising from third-party arrangements.

Privacy incidents and breaches

• Assist with the handling of personal data incidents from identification to resolution.
• Where required, support the DPO in the assessment and management of notifiable breaches across jurisdictions, and liaise with Information Security to align incident management processes.

Breach response testing

• Assist with testing of the Data Breach Response Plan.

Privacy advice and business engagement

• Provide day-to-day specialist advice across the Group, translating complex requirements into practical guidance that a non-specialist can follow.

Training and awareness

• Design and deliver data privacy training for employees and contractors at all levels, monitor completion rates and champion privacy awareness across the business.

Privacy Champions Programme

• Coordinate the deployment, day-to-day support and development of the Data Privacy Champions network.

Privacy risk register and mitigation

• Assist with the maintenance and development of the data privacy risk register within the Group's ERM framework across all jurisdictions.
• Identify and assess privacy risks, develop recommendations and proportionate mitigation plans and controls, deliver assigned mitigation actions, and track and report on progress, collaborating with the relevant business functions.

Policies and procedures

• Assist with the review of data protection policies and procedures across all jurisdictions.

Management information and reporting

• Prepare management information and reporting on the status of the privacy programme for the Data Privacy Manager and relevant stakeholders.

What you will bring:

Essential Qualifications and Experience

• A minimum of four to six years of substantive, hands-on data privacy experience, ideally gained within a regulated financial services, insurance, or professional services environment.
• Relevant professional qualifications: CIPP/E, CIPM or equivalent.
• Demonstrable expertise in UK GDPR and the Data Protection Act 2018, with solid working knowledge of EU GDPR and at least one of: US privacy law (GLBA, CCPA/CPRA, state privacy laws), or Australian privacy law (Privacy Act 1988, APPs, NDB scheme).
• Demonstrable breadth across all disciplines of data privacy, rather than deep specialism in one or two areas
• Practical experience of data subject rights at volume, including DSARs in a regulated sector context.
• Proven experience of conducting DPIAs and providing Privacy by Design advice to business stakeholders.
• Experience of negotiating and reviewing Data Processing Agreements and international data transfer mechanisms.
• Demonstrable experience of managing personal data breaches and advising on regulatory notification obligations.
• Ability to plan and deliver assigned workstreams to time, and to report progress
• Ability to work productively and visibly in a remote setting across time zones
• Clear written English, including policies and guidance that a non-specialist can follow

Desirable Qualifications and Experience

• Experience in the insurance or reinsurance sector, with familiarity with insurance-specific data processing activities (claims, underwriting, fraud prevention databases, actuarial processing).
• Further certification such as CIPM, CIPT or Fellow of Information Privacy, or a relevant legal qualification
• Knowledge of the NAIC Insurance Data Security Model Law and state insurance commissioner notification requirements.
• Familiarity with the California Insurance Information and Privacy Protection Act (IIPPA) and its 2023 amendments.
• Experience of working within a multi-jurisdictional privacy programme spanning EEA, UK, US and/or Australian operations simultaneously.
• Experience of privacy due diligence and integration on mergers, acquisitions or portfolio transfers
• Familiarity with ISO 27701, ISO 27001, SOC 2 or NIST, and with working alongside an information security team.
• Hands-on use of privacy management tooling, for example OneTrust or TrustArc, including consent management platforms.
• Technical literacy sufficient to read a data flow or architecture diagram and understand what deletion means across databases, logs, archives and backups.
• Interest in artificial intelligence governance and the emerging obligations under the EU AI Act.
• Legal qualification (solicitor, barrister or overseas equivalent) or privacy law academic background.

Your Benefits:

• Pension (Enrolment is automatic on joining with a 10% employer contribution)
• Dental Insurance (This is an optional taxable benefit available to employee, spouse, and dependents)
• Medical Insurance (This is an optional taxable benefit available to employee, spouse, and dependents through a private health network)
• Travel Insurance (As an employee you are automatically enrolled with business and leisure travel insurance with single, couple, family, or single parent family coverage options.)
• Eligible company funded annual 360 Health Assessment.
• Voucher for free annual eye examination.
• Option to loan a bicycle and safety equipment tax free.
• Wellness Reimbursement program (up to 700 pounds annual reimbursement for wellness related expenses, i.e, gym memberships, massage, etc.).
• Tusker – Electric Vehicle (A fixed monthly amount is taken directly from your gross salary and, in return, you get the use of a brand new electric car.).
• Optional Critical Illness coverage
• Automatic coverage provided by income protection programme
• Access to Employee Assistance Programs (EAP) for health and wellbeing
• One paid annual volunteer day