GRC & Data Protection Manager

Location: London or Bradford, UK
Working pattern: Hybrid - 2-3 days per week in the office
Department: Enterprise Systems & Tech
Reports to: Data Protection & AI Manager

Rate: £500 per day inside IR35

About the role

Are you passionate about data protection, governance, risk and compliance? Do you enjoy translating complex regulatory requirements into practical solutions that support business growth and innovation?

Our client, who is a technology-enabled business services organisation that helps businesses improve efficiency and drive growth through innovative solutions, automation and AI,is looking for a GRC & Data Protection Manager to help strengthen and evolve their data protection governance and wider Governance, Risk & Compliance (GRC) frameworks.

This is an exciting opportunity to play a key role in embedding a strong culture of compliance, accountability and responsible innovation across the business. Working at the intersection of data protection, AI governance and broader regulatory compliance, you?ll act as a trusted subject matter expert, helping teams identify and manage risks while ensuring our policies, processes and controls remain effective and fit for purpose.

You?ll work closely with stakeholders across the business, supporting new projects, products and services and helping translate evolving regulatory requirements into clear, practical guidance. From privacy impact assessments and third-party risk management to policy development and compliance monitoring, you?ll have the opportunity to make a tangible impact on how they manage risk and protects data.

This is a hybrid role, with the flexibility to be based in either our London or Bradford office and an expectation to work from the office 2-3 days per week.

What you'll be doing

• Developing governance frameworks: Enhance and maintain data protection and wider GRC frameworks, ensuring they align with relevant legislation, regulatory requirements and recognised standards.
• Driving compliance and policy development: Create, review and advise on policies, procedures and controls covering areas such as GDPR, CCPA, the EU AI Act, ESG, Anti-Money Laundering (AML) and Anti-Bribery and Corruption (ABC).
• Assessing risk and impact: Lead Data Protection Impact Assessments (DPIAs), AI impact assessments and broader risk assessments for new projects, products and services, embedding privacy and compliance considerations from the outset.
• Maintaining governance documentation: Keep key records up to date, including data maps, risk registers, the Legal Register and other compliance documentation.
• Managing third-party risk: Support supplier and vendor risk assessments, due diligence and ongoing monitoring as part of our third-party management processes.
• Providing expert guidance: Advise business stakeholders on data protection, privacy by design, AI governance, risk management and regulatory obligations.
• Building awareness and capability: Develop practical training, guidance and checklists to help teams understand and meet their data protection and compliance responsibilities.
• Supporting external engagement: Work with vendors, suppliers and B2B customers on relevant compliance and data protection matters, partnering with internal stakeholders as needed.
• Collaborating across the business: Organise and participate in cross-functional governance and compliance forums, helping drive alignment and effective decision-making.
• Monitoring regulatory compliance: Conduct compliance monitoring across data protection, AI governance, ESG, AML, ABC and other relevant regulatory areas, identifying gaps and supporting continuous improvement.

What you'll bring

We?re looking for someone who combines strong technical knowledge of data protection and compliance with a pragmatic, commercially aware approach to managing risk.

Essential experience and skills

• A relevant bachelor?s degree.
• At least five years? relevant professional experience in data protection, governance, risk and compliance, or a closely related field.
• Strong knowledge of GDPR, the EU AI Act, the ePrivacy Directive and other relevant legislation and standards, with an understanding of areas such as CCPA, the EU Data Act, ESG, AML and ABC.
• Strong risk assessment and compliance evaluation skills, with the ability to identify gaps and develop effective, proportionate controls.
• Experience building, implementing or developing data protection or risk management frameworks within an organisation.
• The ability to interpret complex regulatory requirements and translate them into clear, actionable policies, processes and guidance.
• Strong research, analytical and problem-solving skills.
• Excellent stakeholder management and communication skills, with the confidence to advise and influence colleagues across different functions.
• Strong organisational and prioritisation skills, with the ability to manage competing demands and challenging deadlines in a fast-paced environment.

It would be great if you also have

• A recognised data protection or privacy certification, such as IAPP CIPP/E, CIPM, CIPT or AIGP.
• Experience with ISO certifications and SOC 2 requirements.
• Knowledge of risk management frameworks such as ISO 31000 or COSO.
• Experience implementing ISO standards, including ISO 9001, ISO 14001, ISO 45001, ISO 22301 or ISO 42001.
• An understanding of other regulatory and compliance areas, such as HIPAA, SOX, AML, KYB and KYC.
• AML-related certifications.
• Familiarity with international privacy laws, particularly across the US, Latin America and Asia.
• Experience using privacy management platforms such as OneTrust.
• The ability to quickly understand technology products and services and the regulatory and policy considerations associated with them.
• A collaborative, adaptable approach and an understanding of the commercial, legal and political environment in which a business operates.

Why apply?

This is an opportunity to take ownership of meaningful GRC and data protection initiatives in a role that goes beyond maintaining compliance. You?ll help shape governance frameworks, influence how risks are managed and support the responsible development and delivery of products and services.

You?ll work with colleagues across the business, contribute to a culture of continuous improvement and help ensure that data protection, AI governance and wider compliance are embedded into everyday decision-making.

Interested? If you have the expertise to navigate complex regulatory requirements, the confidence to influence stakeholders and the drive to turn compliance into practical business value, we?d love to hear from you.