Data Protection Manager

Data Protection Manager

Location: London/ Remote

About the Role

We are a fast-growing payments and fintech business operating in a highly regulated and data-driven environment. As we scale, we are looking for an experienced Data Protection Manager to lead and strengthen our data protection and privacy framework across the business.

This is a hands-on role for someone who can combine strong data protection expertise with commercial judgement and practical execution. You will work closely with Legal, Compliance, Risk, Information Security, Product, Engineering, Operations, Marketing and other teams to ensure that privacy is embedded into how we build products, serve customers and grow the business.

You will play a key role in helping the business scale responsibly, ensuring that data protection requirements are understood, operationalised and proportionate to the risks we face.

Key Responsibilities

Data Protection & Privacy Governance

• Own and maintain the company's data protection and privacy framework.
• Develop, maintain and continuously improve data protection policies, standards, procedures and guidance.
• Monitor compliance with applicable data protection and privacy legislation, including UK GDPR, EU GDPR and relevant local requirements as the business expands internationally.
• Maintain appropriate records of processing activities (ROPA), data inventories and data flows.
• Provide clear, practical advice to stakeholders on data protection requirements and risk.

Privacy by Design

• Act as a trusted privacy partner to Product, Engineering and Technology teams.
• Embed privacy-by-design and privacy-by-default principles into product development and business change.
• Review new products, features, technologies, partnerships and business initiatives from a data protection perspective.
• Lead or oversee Data Protection Impact Assessments (DPIAs) and legitimate interest assessments where appropriate.
• Advise on the use of emerging technologies, including AI, analytics, profiling and automated decision-making.

Third-Party & Commercial Support

• Support Procurement, Legal and business teams with data protection aspects of supplier, partner and customer arrangements.
• Review and advise on Data Processing Agreements, international data transfers and appropriate contractual safeguards.
• Assess the data protection implications of new vendors, processors and strategic partners.
• Support due diligence for acquisitions, partnerships and new markets

Data Subject Rights & Incidents

• Oversee the company's processes for responding to data subject rights requests, including access, deletion, rectification and objection requests.
• Provide guidance and support on personal data breaches and privacy incidents, working closely with Information Security and Risk.
• Coordinate breach assessments and regulatory notifications where required.
• Ensure appropriate lessons learned and remediation actions are captured following incidents.

Regulatory & Compliance

• Monitor regulatory developments and translate changes into practical actions for the business.
• Support engagement with relevant data protection regulators and supervisory authorities where required.
• Maintain appropriate evidence of compliance and support internal and external audits.
• Develop and report meaningful privacy KPIs, KRIs and management information to senior stakeholders.

Training & Awareness

• Develop and deliver engaging data protection training and awareness programmes.
• Build a strong culture of responsible data use across the organisation.
• Provide targeted training and guidance to higher-risk teams such as Product, Engineering, Marketing, Operations, Fraud and Customer Support.
• Make complex privacy requirements understandable and actionable for non-specialists

What We're Looking For

Essential

• Significant experience in a data protection, privacy, compliance or related role, ideally within a regulated, technology, payments or financial services environment.
• Strong working knowledge of UK GDPR and EU GDPR.
• Practical experience managing data protection programmes in a fast-moving organisation.
• Experience with DPIAs, ROPA, data subject rights, data breaches, third-party risk and data protection agreements.
• Experience working cross-functionally with Legal, Compliance, Technology, Security, Product and Operations teams.
• Strong understanding of data processing, data flows, controllers/processors and international data transfers.
• Excellent communication skills, with the ability to translate complex regulatory requirements into clear commercial advice.
• Strong organisational skills and the ability to manage multiple priorities in a high-growth environment.

Desirable

• Experience within payments or fintech
• Experience working across multiple jurisdictions.
• Experience with privacy issues relating to AI, machine learning, profiling or automated decision-making.
• Familiarity with information security frameworks and controls.
• Relevant privacy qualification such as CIPP/E, CIPM, CIPT or equivalent.
• Experience implementing or working with privacy management technology/GRC platforms

What You'll Get

• The opportunity to build and shape the privacy function within a rapidly scaling fintech.
• Significant exposure to senior stakeholders and strategic business initiatives.
• A highly collaborative, international and technology-focused environment.
• The opportunity to influence how privacy and responsible data use are embedded into products from the ground up.

If you're excited by the opportunity to help build a best-in-class data protection function within a fast-growing payments business, we'd love to hear from you.