Data Protection Manager at Department for Transport Operator Limited, London/Remote, £Contract Rate

Job Purpose

To lead the day-to-day delivery of the organisation's data protection function, ensuring compliance with UK data protection legislation and supporting operational teams with practical, risk-based advice. The role is responsible for the operational management of privacy compliance and supports, but does not replace, the statutory Data Protection Officer.

As a Data Protection Manager - (INSIDE IR35), your main responsibilities will be:

• Manage and oversee responses to data subject rights requests, including subject access, erasure, rectification, restriction, objection and data portability.
• Oversee CCTV and body-worn camera disclosure requests, making decisions on the lawful disclosure of personal data, applying relevant exemptions and providing data protection approval. Redaction and evidential handling are undertaken by specialist operational teams.
• Lead personal data breach management from initial triage through to containment, investigation, risk assessment, ICO notification where required, communication with affected individuals and post-incident lessons learned.
• Lead and review Data Protection Impact Assessments (DPIAs) and support privacy by design across new systems, projects and business change.
• Maintain and develop the organisation's Article 30 Record of Processing Activities (ROPA).
• Provide practical data protection advice to managers, project teams and operational colleagues.
• Review and advise on data processing agreements, data sharing agreements, supplier due diligence and international transfer mechanisms.
• Develop and maintain privacy notices, retention schedules, policies, standards and guidance.
• Support compliance with the Privacy and Electronic Communications Regulations (PECR), including marketing activities.
• Deliver data protection training and awareness activities across the business.
• Monitor compliance through audits, reviews and reporting, providing management information and recommendations to senior leadership.
• Keep abreast of developments in data protection law and guidance, including the UK GDPR, Data Protection Act 2018, PECR and the Data (Use and Access) Act 2025

To be considered for this role, please ensure your CV evidences the following essential criteria.

Essential

• Complete and maintain the company 's ROPA.
• Manage SARs within statutory timescales.
• Maintain SAR tracking, quality assurance and reporting.
• Review and maintain the DPIA register.
• Complete DPIAs for relevant projects and processing activities.
• Embed DPIA screening into projects, procurement and business change.
• Track privacy actions and provide regular progress reporting.

Desirable

• Qualification in Data Protection

Please be aware that this role can only be worked within the UK and not Overseas.

In applying for this role, you acknowledge the following this role falls in scope of the Off Payroll Working in the Public Sector legislation. Any rates of payment quoted will reflect the gross rate per day for the assignment and will be subject to appropriate taxes and statutory costs. As such the payment to the intermediary and your income resulting from this contract will be different.