Card Factory
Data Protection Officer
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Data Protection Officer
Data Protection Officer – cardfactory
Salary: c£65,000 + benefits package
Join us as the UK & Ireland **Data Protection Officer (**DPO) and play a pivotal role in shaping and safeguarding the privacy framework across cardfactory, funkypigeon.com and Garlanna. In this influential position, you’ll act as a trusted, independent advisor—ensuring our organisation meets its obligations under UK GDPR, EU GDPR, PECR, ePrivacy, and related legislation.
You’ll lead the way in embedding a strong culture of privacy by design, guiding stakeholders at all levels and championing accountability across our UK and Ireland operations. As the primary contact for regulators, data subjects, and internal teams, you’ll oversee compliance, identify and mitigate privacy risks, and ensure robust policies and controls are in place.
If you’re ready to make a significant impact by driving a proactive, risk-aware approach to data protection, we’d love to hear from you.
At cardfactory, we believe in smart working. That means you’ll spend around two days a week at our Wakefield support centre, with the flexibility to work from home the rest of the time.
responsibilities
-
Data Protection Strategy:
- Develop, implement, and maintain a comprehensive Data Protection Strategy aligned to organisational goals and legislation.
- Own and update the Record of Processing Activities (ROPA).
-
Policies & Documentation:
- Maintain all data protection policies, procedures, and documentation, including Data Protection Impact Assessments (DPIAs), privacy notices, breach logs, and Subject Access Request (SAR) logs.
- Support the development of the Information Security Management System.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
-
Compliance Management:
- Lead audits and compliance activities to meet UK/EU GDPR, PECR, and other regulatory requirements.
- Run the GDPR and data privacy steering committee.
-
Monitoring & Audit:
- Conduct ongoing assessments and internal audits to ensure adherence to data protection standards.
- Review contracts to ensure appropriate legal and technical safeguards.
-
Regulatory Liaison:
- Act as the primary contact for the Information Commissioner’s Office (ICO), Data Protection Commission (DPC), and other regulatory bodies.
- Manage enquiries, investigations, and reporting duties.
-
Incident & Breach Management:
- Lead breach assessments, investigations, and reporting, ensuring effective mitigation, documentation, and communication.
-
Training & Awareness:
- Design and deliver training initiatives, keeping colleagues informed on data protection requirements, risks, and emerging trends.
-
Leadership:
- Advise senior leaders and business units on privacy risks and compliance.
- Provide leadership and mentoring to the team.
-
Supplier Risk Management:
- Oversee governance and risk assessments for third-party suppliers to ensure compliance and security standards are met.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
-
Collaboration & Consultancy:
- Act as the first point of contact for data privacy queries.
- Work cross-functionally to ensure a consistent, business-aligned approach to data protection.
-
Risk Management:
- Identify, assess, and mitigate data privacy risks, ensuring clear reporting to the appropriate stakeholders.
Requirements
Key Skills:
- Strong risk management capability and ability to deliver practical, commercially-aware solutions.
- Strong influencing skills (soft/hard/active listening) – and the ability to blend and adapt them to the situation and intended audience.
- Ability to implement a holistic security program of strategy, policies, processes, and technologies.
- Balancing legislative requirements while considering a commercial viewpoint.
- People management skills to direct and manage a small team of data privacy specialists.
Experience:
- Substantial experience in a DPO role, managing privacy operations, complaints, and compliance with GDPR and PECR.
- Experience leading, developing, and managing teams.
- Familiarity with Microsoft Purview, OneTrust, and other similar Data Subject Access Request (DSAR) management and tooling.
- Experience working in fast-paced and complex environments, across multiple business units.
- Experience with ISO 27001, ISO 27701, ISAE 3000/3402, or other information security standards and frameworks.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills