Love data privacy, continuous improvement, and making sure information is handled responsibly? National Express Bus is looking for a Data Governance & Compliance Officer to act as our resident expert and Data Protection Officer (DPO) for our Bus entities.

In this role, you will lead our operational compliance with UK and EU GDPR, PECR, and internal governance standards. You will work closely with senior leaders and operational teams to build a positive compliance culture, manage data privacy risks, and keep our customer and employee records secure.

This role is based at NX House (Birmingham) with a hybrid working option.

What you will actually be doing

• Act as DPO: Provide clear, recorded recommendations to strengthen internal controls and serve as the main legal contact for data privacy queries.
• Manage GDPR Rights & Requests: Oversee information rights requests (Access, Correction, Erasure, Restriction) and keep processing records (ROPA) updated.
• Risk Assess & Triage: Lead Legitimate Interest Impact Assessments, support data transfer assessments, and triage security incidents or potential data breaches.
• Drive Audits & Governance: Scrape, test, and run data privacy audits, creating clear action plans to fix deficiencies and report progress to the Bus Board.
• Embed PECR & Controls: Implement PECR guidelines, create practical policy controls, and collaborate with the training team to educate employees on data privacy.
• Partner with Cyber Security: Work alongside technical and security teams to ensure personal data assets are protected against emerging risks.