About you and the Role:

The Data Privacy Specialist will sit in Enstar's Global Data Privacy team reporting to the Data Privacy Manager and working alongside colleagues in the UK and US. You will be providing day-to-day specialist data privacy advice across the Group so that personal data is handled lawfully, consistently and demonstrably in every jurisdiction in which Enstar operates. The role holder is expected to work across all disciplines of data privacy rather than specialising in specific areas and will coordinate with colleagues in other time zones.

Enstar’s business is built on acquired portfolios, therefore the role involves working with inherited records, legacy systems, long retention tails and processing designed under a previous owner and exercising judgement about what to prioritise within those constraints.

What you will be doing:

Overall contribution

Provide day-to-day specialist data privacy advice across the Group so that personal data is handled lawfully, consistently and demonstrably in every jurisdiction in which Enstar operates and deliver assigned workstreams of the data privacy maturity programme.

Scope and reporting

Work in a Group-wide, multi-jurisdictional role within Enstar's Global Data Privacy team, reporting to the Data Privacy Manager and coordinating with colleagues in the UK, US and other time zones.
Work across all disciplines of data privacy rather than specialising in specific areas.

Judgement and escalation

Exercise independent specialist judgement: analyse complex, multi-jurisdictional issues and recommend proportionate solutions, including what to prioritise when working with inherited records, legacy systems, long retention tails and processing designed under a previous owner.
Escalate appropriately to the Data Privacy Manager. Legal conclusions and the acceptance of business risk remain with the Head of Data Privacy, the DPO and the relevant business owners.

Maturity programme

Contribute to the baseline assessment across entities and jurisdictions and own delivery of assigned workstreams through to evidenced closure.

Privacy by Design and Default

Advise project teams on applying Privacy by Design and Default principles, supporting the initiative to embed them across the organisation and delivering the relevant training.

PIAs, DPIAs and LIAs

Produce privacy impact assessments (PIAs), data protection impact assessments (DPIAs) and legitimate interests assessments (LIAs), including those escalated following screening by the Analyst.
Submit completed assessments to the Data Privacy Manager for quality review, with decisions on residual risk taken by the DPO, Head of Data Privacy or business owner as applicable.

Consumer and data subject rights

Advise on data subject rights requests across all jurisdictions and handle complex or multi-jurisdictional cases, including those referred by the Analyst, ensuring each is recorded end to end.

ROPA, inventories and data maps

Maintain and update the record of processing activities (ROPA), supporting the Data Privacy Manager.

Regulatory compliance and horizon scanning

Support the Data Privacy Manager in maintaining compliance with applicable data protection legislation across all operating jurisdictions (UK GDPR, EU GDPR, US privacy laws and the Australian Privacy Act).
Monitor regulatory developments as part of the Horizon Scanning Framework.

Regulatory registrations and filings

Assist with regulatory registrations and filings.

Privacy notices, cookies and consent

Review and update privacy notices and cookie consent management.

Supplier privacy due diligence

Assist with privacy due diligence on third-party suppliers as part of the Supplier Engagement Framework.

Data Processing Agreements

Review Data Processing Agreements (DPAs) with relevant data processors and recommend changes.

International transfers and TIAs/TRAs

Assist with international data transfer mechanisms across all operating jurisdictions, ensuring they are current, properly documented and subject to regular review.
Produce transfer impact or risk assessments (TIAs/TRAs) where required, develop recommendations for the Data Privacy Manager's review, and maintain oversight of cross-border data flows arising from third-party arrangements.