Data Protection jobs

Data Protection Officer – CDRL

Consumer Dispute Resolution Limited (CDRL) is hiring a Data Protection Officer to run our subject access requests and keep our day-to-day data protection compliance on track, working closely with our external legal counsel.

Detail

Job title: Data Protection Officer

Location: Kingsbridge, Devon (TQ7 1EQ)

Salary: Negotiable, depending on experience

Hours: Full-time, 37.5 hours per week

Contract: Permanent

Reports to: Management team/Board

About the role

CDRL is an independent, not-for-profit Alternative Dispute Resolution (ADR) provider. We run five ADR schemes: AviationADR, RetailADR, UtilitiesADR, CommsADR and Consumer Arbitration. Together they resolve disputes between consumers and airlines, airports, retailers, utility and communications providers. We are approved by the Civil Aviation Authority, the Chartered Trading Standards Institute and Ofcom, and received more than 61,000 claims between January and September 2026.

Every case we handle is built on personal data: contact details, booking and account records, correspondence and evidence submitted by consumers and by the businesses that are members of our schemes. Consumers and traders trust us to treat that information fairly and securely. As our Data Protection Officer, you will be the first point of contact for anyone exercising their data rights and the internal owner of our data protection programme.

You will manage subject access requests from start to finish, monitor how we comply with UK GDPR and the Data Protection Act 2018, and flag issues early. On complex or contentious matters you will work alongside our external counsel, preparing the facts and documents they need and putting their advice into practice.

In line with UK GDPR, the role has direct access to senior management and will carry out its duties independently, without conflicts of interest.

Key responsibilities

Subject access requests and data rights

• Log, acknowledge and track every subject access request (SAR) within the one-month statutory deadline, including extensions where lawful
• Handle SARs from consumers, participating member businesses, staff and others, including requests for complete case files
• Verify requesters' identity and clarify the scope of requests
• Search for, collate and review personal data across our case management and other systems
• Apply redactions and exemptions correctly, protecting third-party data such as the other party's staff and our ADR officials
• Prepare clear, accurate responses and keep a full audit trail of decisions
• Handle other data rights requests, including erasure, rectification, restriction and objection

Monitoring and managing compliance

• Maintain our record of processing activities, privacy notices and data protection policies across CDRL and all five schemes
• Advise colleagues and ADR officials on data protection obligations and lawful bases for processing
• Make sure case data is shared appropriately between consumers, participating members and decision-makers, and no further
• Oversee international transfers, including to airlines and other members based outside the UK
• Carry out and review data protection impact assessments (DPIAs), including for new schemes, systems and online complaint forms
• Monitor compliance through regular audits and spot checks, and report findings to senior management
• Support our ISO certifications and any data protection evidence requested by our approving bodies
• Review data sharing agreements, member terms and supplier contracts for data protection terms
• Oversee data retention schedules for closed cases and secure disposal
• Deliver data protection training and raise awareness across the organisation

Breaches and regulators

• Lead our response to personal data breaches, including assessing risk and deciding whether to notify the ICO within 72 hours
• Act as the contact point for the Information Commissioner's Office and for individuals
• Keep the breach log and lessons-learned records up to date

Working with external counsel

• Brief external counsel on complex SARs, complaints, breaches and disputes
• Prepare the chronologies, documents and information counsel needs
• Implement legal advice in practice and track agreed actions to completion
• Help manage legal spend by handling routine matters in-house

About you

Essential

• Proven experience in a data protection, privacy, information governance or compliance role
• Hands-on experience managing subject access requests end to end, including redaction and applying exemptions
• Strong working knowledge of UK GDPR, the Data Protection Act 2018 and PECR
• Excellent organisational skills and the ability to manage several deadlines at once
• Clear written and verbal communication, with the confidence to advise colleagues at all levels
• Sound judgement, discretion and a methodical eye for detail

Desirable (but not essential)

• A recognised data protection qualification, such as BCS Practitioner Certificate in Data Protection, PC.dp or IAPP CIPP/E
• Experience in an ADR, ombudsman, complaints-handling or regulated consumer environment
• Experience working with external solicitors or in-house legal teams
• Experience handling personal data breaches and dealing with the ICO
• Familiarity with ISO 27001 or similar information security standards
• Familiarity with case management, eDiscovery or redaction software

What we offer:

• A competitive salary
• 23 days annual leave plus bank holidays
• Pension scheme with 3% employer contribution
• Hybrid and flexible working
• Funded professional development, including support towards a data protection qualification
• Onsite parking

CDRL is an equal opportunities employer. We welcome applications from everyone and will make reasonable adjustments throughout the recruitment process. Your application data will be processed in line with our recruitment privacy notice.

Application question(s):

• Do you have experience working in data protection, information governance, or a similiar role?
• Do you have a good working knowledge of UK GDPR and the Data Protection Act 2018?

• Have you previously handled Subject Access Requests (SAR's), data breaches or data protection complaints?

Work Location: In person