Whitbread
General Counsel - Data Protection Specialist
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Data Protection Specialist
Location: Dunstable, (LU5 5XE) hybrid working (3 days per week in the office)
Salary: £68,000 - £73,000 dependant on skills and experience + up to 20% bonus + up to 10% pension contributions + health + bens
Function: Legal
Reports To: Senior Legal Counsel – Data Privacy and Compliance
Looking to join a collaborative, supportive legal team where your expertise is trusted and your work genuinely matters?
Whitbread is a FTSE 100 company, the UK’s largest hospitality business, and home to one of the country’s most recognisable brands, Premier Inn. We have heritage that stretches back over 275 years. We combine scale and stability with a strong focus on doing the right thing for our guests and our people.
We’re now looking for a Data Protection Specialist to join our Legal team. This is a key role in ensuring Whitbread meets its data protection obligations. You will support the development, implementation, and continuous improvement of data protection practices across the business, helping to embed a strong culture of privacy and compliance.
About the role
The primary focus of the role will be to manage and take ownership of the organisation’s day-to-day data protection compliance, whilst providing additional support on the wider strategy, governance, and AI related matters.
The role would suit a data protection specialist or junior qualified lawyer looking to build on their data protection experience. Note that for a qualified lawyer the job title would be amended to Legal Counsel – Data Privacy.
You’ll work closely with colleagues across Legal, Technology, Digital, HR and the wider business, acting as a key data protection point of contact.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Flexible Working - Although this role is advertised as full time, we recognise that people do their best work in different ways. For the right person, we’re open to conversations about alternative working patterns.
What you’ll be doing
Data Protection (UK led, with international exposure)
- Support the implementation and maintenance of data protection policies, notices and templates.
- Maintain records of processing activities (ROPA) and ensure other privacy management tools are up to date.
- Coordinate DPIAs and other risk assessments from scoping through to completion.
- Respond to and manage data protection rights requests (e.g. DSARs) and complaints.
- Management of the data privacy inbox – handling queries and requests from employees and guests directly.
- Act as a key contact for data protection queries, supporting teams with guidance on best practice.
- Provide data protection advice on CRM, digital marketing, cookies and consent.
- Assist with personal data breaches, including investigation, risk assessment, and reporting.
- Initial review of supplier due diligence and data processing agreements, identifying gaps and potential risks.
- Identify privacy risks and escalate key issues to the Senior Legal Counsel and external UK DPO, when required.
- Provide support to data protection teams in Ireland and Germany.
- Coordinate and progress the work of the Data Champions Network.
- Contribute to ongoing improvement in data privacy processes and standards.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
What we’re looking for
We’re more interested in good judgement, curiosity, and a collaborative mindset than a rigid checklist. That said, you’ll likely have:
- At least 2 years data protection experience (or be a qualified lawyer NQ-2 PQE)
- Strong experience in UK data protection law requirements
- Excellent organisational and management skills
- Experience working with consumer and/or employee personal data
- Strong communication skills with the ability to write clear, accurate and practical advice
- Confidence working with senior stakeholders in a complex organisation
- A pragmatic, solutions focused approach
Private practice or in-house backgrounds are welcome.
What kind of person thrives here?
People who enjoy this role tend to be:
- Approachable, positive, and collaborative
- Comfortable taking ownership, while working closely with others
- Excellent communicator with a strong customer service focus
- Organised and strong attention to detail
- Motivated by improving processes and making a real difference
Why Whitbread
At Whitbread, people matter. You’ll be joining a collegiate, pragmatic legal team that works closely with the business, values good judgement over bureaucracy, and gives genuine autonomy.
We’re proud to be a Top Employer for 14 consecutive years, a top apprenticeship employer, #10 in the Stonewall Workplace Equality Index, and a Top 25 Exemplary Employer in the Investing in Ethnicity Parliamentary Matrix.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills