Acorn Compliance
Data Protection Officer and Compliance Manager
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
About Acorn Compliance:
Acorn Compliance is a healthtech compliance technology company. Our platform, Squirrel, automates regulatory compliance for digital health companies across DTAC, DCB0129/0160, DSPT, UK GDPR, Cyber Essentials and Cyber Essentials Plus, ISO 27001, ISO 13485 and global medical device regulation.
What sets us apart is our assurance model: every output on the platform is validated by regulatory experts, so our clients get the speed of automation with evidence that stands up to audit. We describe this as Automated and Assured.
Our clients range from early stage SaMD startups to global medical device players and the NHS. Expert services, including outsourced DPO appointments and certification delivery, are built around the platform and run through it.
The Role:
This is a new role created to support the growth of our client base. As adoption of the platform and demand for our assured services has increased, we are adding senior capacity to our assurance team so that delivery scales with the product and our clients continue to receive the standard of service they expect. The role has three functions, in order of weighting:
- Data Protection Officer (primary). You will take over our full book of outsourced DPO appointments across a portfolio of digital health clients. This includes acting as the named Data Protection Officer, handling data subject rights requests, breach assessment and notification decisions, DPIAs, ICO correspondence, records of processing and ongoing advisory work.
- Cyber Essentials delivery. You will strengthen our Cyber Essentials and Cyber Essentials Plus capacity, working alongside the existing delivery team on readiness assessment, remediation guidance, evidence gathering and liaison with certification bodies, and helping ensure certification deadlines are consistently met as engagement volume grows.
- ISO 27001 support. You will support ISO 27001 implementation and surveillance work across client engagements, including gap analysis, ISMS documentation, internal audit and certification support.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Beyond the client-facing work, you will be a senior point of support for the team on delivery questions.
We are a platform-first business. You will be expected to identify gaps from a practitioner seat and feed well-formed feature suggestions into the product roadmap, helping shape how compliance delivery is automated.
What you will do:
- Act as named DPO for a portfolio of digital health clients, with formal ICO registered appointments
- Run breach assessments and make or document notification decisions within statutory timescales
- Lead DPIAs, including for clinical data integrations and AI-enabled products
- Deliver Cyber Essentials and Cyber Essentials Plus engagements alongside the wider team
- Support ISO 27001 implementations, internal audits and certification cycles
- Maintain the delivery deadline register in Squirrel and run sync meetings with the team
- Produce clear, well-written client documentation in plain British English
- Work platform-first, keeping Squirrel as the single source of truth for all delivery activity
- Identify platform gaps and propose feature enhancements into the Squirrel product roadmap
What we are looking for:
- Demonstrable experience as a practising DPO or senior data protection practitioner, ideally across multiple concurrent appointments
- ISO 27001 Lead Implementer or Lead Auditor certification
- Hands-on Cyber Essentials and Cyber Essentials Plus delivery experience; IASME assessor status is an advantage but not essential
- Strong working knowledge of UK GDPR, the Data Protection Act 2018 and ICO guidance and enforcement practice
- Excellent written English and the ability to produce client-ready documents without heavy editing
- Self-directed and reliable on deadlines; comfortable owning a delivery calendar rather than being managed against one
- A platform-first mindset: comfortable running all delivery through a compliance platform as the single source of truth, and able to articulate clear, well-reasoned feature suggestions when the platform needs to do more
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Desirable:
- A recognised data protection qualification such as CIPP/E, CIPM or the BCS Practitioner Certificate in Data Protection
- Experience in digital health, NHS supply or regulated software (DTAC, DSPT, DCB0129/0160, SaMD / AiaMD)
- Familiarity with ISO 13485 or medical device quality systems
- Experience delivering compliance outcomes for multiple concurrent clients
- Experience using compliance management platforms to run delivery
What we offer:
- A senior role with real ownership in a growing healthtech technology company
- Fully remote working on UK hours
- Direct influence over how our Squirrel™ platform is extended, from a practitioner seat
- Competitive salary, reviewed annually
How to apply:
Send a CV and a short covering note to info@acorncompliance.com Please include one example, suitably anonymised, of a difficult data protection judgement you have made and how you reached it. Shortlisted candidates will complete a series of technical tests and exercises reflecting real client work.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills
Location