Caravan and Motorhome Club
Data Protection Officer
Get notified of more jobs like this · No spam, ever
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Purpose of Job
The DPO will inform, advise and be the primary point of contact at the Club for data protection, data security and Payment Card Industry Data Security Standard (PCI DSS) compliance.
Serving as a subject matter expert in data protection, the role holder will provide strategic leadership across policy and compliance frameworks. This includes upholding the Club's compliance with UK data protection law and PCI DSS, while ensuring data security policies are closely aligned with established information security standards like ISO 27001.
Operating under the Data Protection Act 2018 and UK General Data Protection Regulation (UK GDPR), the DPO is engaged in all matters concerning the processing of personal data. As this position is mandated and protected by law, this key role within the Club demands that the post holder executes their duties with integrity, diplomacy and the utmost professionalism. A pragmatic approach is also encouraged.
The DPO heads up the Data Security Compliance Team (DSCT) and manages all team members.
Key Tasks / Accountabilities
Statutory Leadership & Regulatory Oversight
- Statutory DPO & Regulator Liaison: Serve as statutory DPO under UK data protection law for the Club and Alan Rogers Travel Group; act as primary contact for the ICO, regulators, and data subjects.
- Governance & Accountability Tracker: Own the Privacy Policy suite, ROPAs, LIAs, and DPIAs; leverage the ICO Accountability Tracker to ensure compliance, meet legal duties, and safeguard data subjects' rights.
- Escalations & Incident Response: Act as final escalation/approval point for data subject requests, law enforcement disclosures, and complaints; oversee data incident management, reporting breaches to SLT/Directors, the ICO, and law enforcement within statutory timelines.
- Reporting & Horizon Scanning: Deliver quarterly reports on risks, breaches, and DSR metrics to the DSPG board, while monitoring regulatory changes, technology trends, and industry developments to keep standards current.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Data Security, PCI DSS & Business Continuity
- PCI DSS Strategic Leadership: Oversee end-to-end PCI DSS compliance across all payment channels—collaborating with IS, acquiring banks, and QSAs to manage vulnerability scans, pen tests, and annual SAQ submissions.
- Policy, Infrastructure & Continuity: Oversee data security policies and align data protection with IS disaster recovery and light-touch business continuity frameworks (including Gold/Silver BC representation).
Commercial, Supplier & Advisory Integration
- Privacy by Design & Advisory: Provide expert guidance on new projects and initiatives, embedding Privacy by Design, privacy requirements, and DPIAs into business processes and cross-functional boards (e.g., AI Governance Board).
- Vendor & Contract Management: Partner with Procurement and Legal to enforce robust data protection, security, and PCI DSS clauses in supplier agreements; manage DSCT vendor contracts, budgets, and security software tools (e.g., secure email, Privacy Management System).
Culture, Training & Team Management
- Team Leadership & Development: Lead, recruit, and mentor the Data Security and Compliance Team (DSCT), managing performance, workload delegation, and career growth for permanent and contract staff.
- Training, Culture & Advocacy: Set the strategic direction for organization-wide privacy training, author Club-wide communications, and foster a proactive, "no-blame" continuous learning culture.
Essential Skills and Experience Required
- Senior Privacy & Security Leadership: Proven track record leading privacy, security, or compliance functions, with direct experience liaising with regulators (e.g., ICO) and managing/mentoring teams.
- Commercial & Risk Management: Strong commercial awareness and negotiation skills, with experience managing privacy risks in complex IT systems, vendor contracts, and cross-organizational changes.
- Data Protection & Security Mastery: Expert knowledge of UK privacy legislation (UK GDPR, Data Use and Access Act 2025, DPA 2018, PECR), ICO guidance, and ISO 27001 security controls.
- Professional Certifications: Holds recognized privacy/security credentials (e.g., CIPP/E, CIPM, CISM, CISSP, UK GDPR Practitioner, or PC.dp).
- Pragmatic Implementation: Exceptional written/verbal communication skills with the ability to interpret complex regulations and implement pragmatic solutions across all organizational levels under pressure.
- Adaptability & Drive: Fast learner with strong general IT proficiency (Google Workspace/MS Office) and a passionate, enthusiastic drive to cultivate organizational change.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Desirable Skills and Experience Required
- Experience of working with or managing corporate business continuity frameworks.
- Hands-on experience with privacy management platforms, such as OneTrust, working with AI tools and using redaction software such as Adobe Acrobat.
- Awareness of Financial Conduct Authority (FCA) regulations.
To see the full job description, view this link.
https://www.caravanclub.co.uk/about-us/work-for-us/head-office/vacancies/data-protection-officer/
The Caravan and Motorhome Club is committed to employing a diverse workforce. All applications are treated equally and we recruit purely on the basis of skills and experience. We know our greatest strength is our people, so differences are celebrated, and we strive to create an environment where colleagues feel respected and valued for their unique potential.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London