Act as statutory DPO for six months at a retail group with 20 million loyalty members while it rebuilds its privacy programme after a reportable breach.
The role
The group runs around 900 stores across the UK and Ireland, alongside an online business and a loyalty scheme with 20 million members. A reportable breach last year at a third-party marketing supplier led to an ICO investigation, which closed without a fine but with clear recommendations. The permanent DPO has since left, and a replacement is unlikely to start before the spring. You will report to the General Counsel, with direct access to the Audit and Risk Committee.
What you will do
Act as the named Data Protection Officer under UK GDPR and the Irish Data Protection Act.
Close out the ICO’s recommendations and report progress to the Audit and Risk Committee.
Review personalisation and profiling in the loyalty programme, including legitimate interests assessments.
Tighten supplier due diligence and data processing terms across around 150 processors.
Manage a privacy team of four and prepare the handover to the permanent hire.
What you will bring
Experience as a DPO or head of privacy in a consumer business with large volumes of customer data.
Deep working knowledge of UK GDPR, PECR and the Data (Use and Access) Act 2025.
Experience of handling a regulatory investigation or breach response with the ICO.
A practical, commercially minded approach to marketing and loyalty data.
Availability to start within four weeks.
The package
A day rate of £800 to £950 outside IR35 for a six-month assignment, four or five days a week. The role is remote, with occasional days at the head office in Leeds or the Dublin office. Interviews can be arranged at short notice.
