Key Tasks / Accountabilities

Serve as statutory DPO under UK data protection law for the Club and Alan Rogers Travel Group, acting as primary liaison for the Information Commission’s Office (ICO), other regulators and data subjects.

• Monitor regulatory change, ICO guidance, legislative updates and technology trends to keep data security policies and operational standards current.
• Own the Privacy Policy suite and maintain privacy governance, including the Master Record of Privacy Statements, Records of Processing Activities (ROPAs), Legitimate Interest Assessments (LIAs) and Data Protection Impact Assessments (DPIAs).
• Act as the final escalation and approval point for data subject requests, law enforcement (and other) disclosures and data protection complaints, ensuring timely and compliant resolution, completed to a high standard.
• Oversee the continued development, implementation and maintenance of data security policies, procedures and standards across the organisation.
• Provide, or oversee the provision of, data protection advice for projects and initiatives, ensuring Privacy by Design is applied and DPIAs are completed where necessary.
• Using the ICO Accountability Tracker, ensure the DSCT monitors data protection compliance, advising and supporting the Club to meet its legal duties, implement proportionate safeguards and protect data subjects' rights.
• Lead, motivate and develop the DSCT team members with personal development plans, career growth support, opportunities and task delegation, and performance management.
• Manage recruitment and onboarding processes for permanent and contract team members, as required.
• Continue to develop a culture of continuous learning and proactive compliance across all departments.
• Provide strategic direction for all data protection and data security training and awareness programs.
• Oversee all data security incident management, directly handling incidents when necessary, and ensure adherence to legal and regulatory reporting timelines. Report breaches to the Club’s Directors, the ICO and/or relevant law enforcement agencies as required.
• Report data security activities, data subject request completion statistics, breach investigations and risk posture to the Directors and members of the Senior Leadership Team (SLT) via the quarterly meeting of the Data Security Protection Group (DSPG).
• Promote an open, 'no-blame' reporting culture while ensuring corrective solutions and post-incident improvements are implemented.
• Maintain strategic oversight of PCI DSS compliance, collaborating closely with the Information Systems (IS) Security Specialist, the Club’s acquiring bank and the external Qualified Security Assessor (QSA), as required.
• Ensure IS teams schedule and remediate regular vulnerability and ASV scans, and that penetration tests are carried out annually or when significant change occurs.
• Be responsible for the completion, sign off and submission of annual PCI DSS Self-Assessment Questionnaires (SAQs) to the Club’s acquiring bank, ensuring evidence of compliance is maintained and documented.
• Ensure all payment channels are PCI DSS compliant and that new channels or changes to existing channels are assessed and appropriate security controls introduced.
• Partner with the Club’s Procurement team and external legal counsel to ensure robust data protection, PCI DSS and data security clauses are embedded in supplier contracts and non-disclosure agreements.
• Drive privacy and data security requirements developed by the DSCT to be embedded in all relevant projects and initiatives, as well as considered for changes to existing processes.
• Have responsibility for the continued improvement of ‘light touch’ business continuity frameworks, ensuring alignment between data protection requirements, data security policies, IS disaster recovery and business continuity plans.
• Oversee the management and documentation of team representation on Gold and Silver Business Continuity groups.
• Actively push for robust privacy and data security standards by authoring Club-wide communications and presenting at departmental and team meetings.
• Manage budgets and contractual agreements for third-party vendors supporting the DSCT’s activities, such as consultants.
• Maintain active membership in key organisational forums, including the Club's Google User Group, AI Governance Board and Cross Functional Board, to maintain continuous awareness of upcoming initiatives, emerging risks and business change.
• Serve as the primary point of contact for the team's third-party Privacy Management System, tracking updates and ensuring thorough pre-release testing.
• Act as the Product Owner for the Club's secure email product, overseeing contract management, cost controls and feature rollouts to license holders.
• Attend relevant external industry meetings and conferences to keep knowledge current and stay up to date with legislation, best practice and emerging threats.