Data Protection Manager, Derby - Head Office, Permanent

Salary: £48,135 – £55,008

Closing Date: 7th October 2026

Reference: 0469-26

We have an exciting opportunity to join #TeamEMR as a Data Protection Manager. This pivotal role leads and manages EMR’s privacy framework to ensure full compliance with the UK GDPR, the Data Protection Act 2018, and related legislation. Providing expert, pragmatic advice and embedding privacy by design across all business processes, and promote a strong internal culture of accountability and compliance.

Key Roles and Responsibilities

• Data Protection Strategy & Governance: Own the organisation's data protection and privacy framework, ensuring compliance with UK GDPR, the Data Protection Act 2018, PECR and related legislation, and that policies, procedures and standards remain current and effective.
• Advisory & Decision Support: Act as the organisation's principal source of data protection expertise, advising senior leadership and project teams on complex privacy matters, challenging proposals where risks or non-compliance arise, and embedding privacy by design across change initiatives and DPIAs.
• Individual Rights & Breach Management: Own the end-to-end handling of data subject rights requests and personal data breaches, ensuring both are managed lawfully, efficiently and within statutory timescales, with regulatory notification where required.
• Information Governance & Third-Party Assurance: Maintain oversight of the organisation's records of processing activities, and ensure data protection provisions are properly reflected in contracts, data processing and data sharing agreements with suppliers and partners.
• Assurance, Risk & Retention: Provide ongoing assurance that data protection risks are identified, assessed and mitigated, that compliance actions are implemented, and that a robust retention and disposal framework keeps personal data held only as long as necessary and disposed of securely.
• Culture, Capability & Awareness: Build organisational capability and awareness through training and campaigns, ensuring managers and stakeholders understand their responsibilities and a culture of privacy and accountability is embedded.
• Regulatory Horizon Scanning: Monitor developments in data protection law, regulatory guidance and best practice, translating these into practical recommendations for the organisation.
• Reporting & Governance Assurance: Produce accurate, timely reporting and management information for senior leadership, governance committees and the Board, providing assurance on compliance performance and the effectiveness of the data protection framework.
• Stakeholder & Group Relationships: Build effective relationships with internal stakeholders, regulators and the Group Data Protection Officer, ensuring alignment with group-wide privacy strategy and consistent application of standards, and acting as or supporting the DPO role where required.