Data Protection Officer

Responsibilities:

- Role is an independent legally mandated requirement which requires detailed understanding of UK and European data protection law and practice.
- Role is required to give advice which has legally binding consequences to all levels of the council and schools.
- Communicates to the Leader and Deputy Leader, Councillors, Directors and Assistant Directors. Communicates to groups of staff, regulators, customers and suppliers. Influences at all these levels.
- Technically proficient. Required to have clear expertise in data management which is maintained by the post holder. May hold one or more technical qualifications in data protection.
- Able to independently analyse and evaluate situations, creating what-if scenarios, reasoning based on the information, experience and knowledge to arrive at one or more options, and draw effective conclusions, upon which to provide decisions at an operational and mid-term strategic level.
- Having accountability for the legally mandated role of Data Protection Officer for the council and schools as described in the General Data Protection Regulation 2016 (GDPR) and Data Protection Act 2018 (DPA).
- Have an overarching responsibility for fostering a data protection culture within the council and schools, providing the services required by the legislation. In order to maintain the legally required independence cannot receive any instructions regarding the exercise of their tasks, nor be dismissed for performing their tasks.
- Has the day to day authority and responsibility for advising the council and schools on compliance with the data protection law, liaising directly with the regulator, the council’s leadership, school governors, headteachers and the public as required to carry out their duties.
- Must be involved, properly and in a timely manner, in all issues which relate to the protection of personal data and as such are able to influence and make decisions that are critical to the organisation’s success, influence directly the formulation and implementation of strategy relating to use of personal data, and has a full range of management and leadership skills.
- Is required to participate regularly in meetings of senior or middle management, and their presence is recommended where decisions with data protection implications are taken. Their opinion must be given due weight and disagreement formally recorded; they must be promptly consulted once a data breach or another incident has occurred. They are required to produce regular reports on data protection compliance and issues for the highest management level of both the council and schools and these reports cannot be edited or filtered by others.
- The post holder must have expertise in national and European data protection laws and practices and an in-depth understanding of both GDPR and DPA and is required to maintain this level of understanding. The post holder is required to ensure that a data protection culture is fostered within the organisation, and to maintain the highest standards of integrity and professional ethics.
- The demands of this role involve regularly managing a number of competing activities, at times with demanding deadlines and public/press/regulator involvement, on an on-going basis, with a range of complexities, from very complex to tactical, including key decisions that could result in legislative action against the council, impact the delivery of the service to the whole Council and beyond, to partner organisations.
- This role is required to act as the communication channel to/from all data users with internal and external stakeholders, especially in the case of a data breach. This service must be provided 24 x 7 x 365. As such, there may be times when the post holder is required to be available out of hours, including weekends. Accountability for reporting and managing data breaches remains with the data owner.

**Job Type**: Temporary contract
Contract length: 3 months

Pay: £32.07 per hour

Expected hours: 35 per week

**Benefits**:

- Company pension

**Experience**:

- delivering data protection services: 1 year (required)
- Knowledge of data protection law: 1 year (required)
- knowledge of using MS-365 software: 1 year (preferred)

Licence/Certification:

- qualification in data protection /information security/law (required)
- IAPP, NADPO, BCS, ISACA, (ISC)2 or ongoing certitification (required)

Work Location: In person