Job Summary

Mishcon de Reya is looking to recruit an experienced Data Protection Officer (DPO). The DPO will monitor compliance and data practices internally to ensure the business and its functions comply with the applicable requirements under the EU GDPR, the UK GDPR and other relevant legislation. The DPO will be responsible for advising on, and where required carrying out, staff training, data protection impact assessments, data transfer impact assessments, and internal audits.

Key Responsibilities

This role sits in the Risk & Compliance Department and will work closely with the firm's fee earning Data Practice Group to develop and monitor policies and standards applicable to the business and in compliance with the EU GDPR, UK GDPR and other relevant legislation. Duties will include:

• Implementing measures and a privacy governance framework to manage data use in compliance with the EU GDPR, UK GDPR and other relevant legislation, including developing methodologies for data collection which are compatible with our approach to excellent client service, advising on and assisting with data mapping and records of data processing, and vendor management reviews. The ownership of enterprise-wide data asset registers and broader data architecture remains with the Data Governance function.
• Working with key internal stakeholders in the review of operations and projects and related data processing to ensure compliance with data privacy laws, and where necessary, advising on and monitoring data protection privacy impact assessments.
• Reviewing vendor contracts (including relevant standard contractual clauses for international data transfers) and owning the privacy authorisation and assessment of third-party processing activities, including oversight of privacy-specific contractual controls (such as Article 28 clauses, SCCs and IDTAs), while working in partnership with Procurement.
• Ensuring any filing/notification and fee requirements with the Information Commissioner and other supervisory authorities in the jurisdictions we operate are achieved.
• Participating in the relevant internal data governance committees.
• Managing and conducting ongoing reviews of our privacy governance framework and regular and ad hoc reporting on data privacy compliance within the organisation.
• Monitoring changes to relevant privacy laws and making recommendations when appropriate.
• Setting standards and reviewing policies and procedures globally that meet the requirements under the EU GDPR and UK GDPR and any localisation requirements in countries of operation.
• Developing and delivering privacy training to various business functions and collaborating with appropriate internal teams to raise employee awareness of data privacy and security issues.
• Developing strategies and initiatives to ensure engagement with key internal and external stakeholders.
• Coordinating, conducting and monitoring data privacy audits.
• Collaborating with internal teams to maintain records of all data assets and exports, and maintaining a personal data security incident management plan to ensure timely remediation of incidents impacting personal data including impact assessments, breach response, complaints, claims or notifications.
• Providing privacy expertise into AI governance processes, including advising on data protection considerations within AI systems, automated decision-making and emerging technologies as part of relevant DPIAs and risk assessments.
• Working with internal stakeholders and team members to respond and advise on data subject rights requests, including data subject access requests (DSARs) and other requests from individuals. This includes meeting statutory DSAR response deadlines and fulfilling data breach notification obligations.
• Working with designated privacy lawyers, subject matter experts or champions across the firm and, where necessary, outside legal advisers to help advise on data privacy law issues.
• Ensuring accountability for core privacy operational outcomes, including timely completion of DPIAs, maintaining accuracy and completeness of Records of Processing Activities (RoPA).
• Working in close partnership with the Data Governance Manager and Information Security to ensure alignment and a coordinated oversight with clear escalation routes and effective management of data-related risks across functions.
• Promoting effective work practices, working as a team member, and showing respect for co-workers.