Global Compliance Manager & Data Protection Officer

Key Responsibilities

General Compliance responsibilities

• Compliance framework & policies: Maintain and develop the Group's compliance policies (e.g. anti-bribery & corruption, anti-fraud & tax evasion, AML, whistleblowing, code of conduct, conflicts of interest, and gifts & hospitality). Own the policy inventory and control matrix; monitor adherence and report to leadership.
• Know Your Client (KYC) / due diligence & AML: Run risk-based client onboarding and ongoing due diligence, beneficial-ownership verification, and anti-money laundering (AML) checks.
• Sanctions: Support in the screening of clients and counterparties against UK, EU, US (OFAC) and UN sanctions lists; consider red flags; maintain awareness of export-control considerations.
• Training & culture: Deliver compliance and data protection training; embed a culture of compliance across the business.
• Cross-functional partnering: Work closely with Legal, IT&Tech, Finance, People & Development and the business lines; support internal and client audits.
• Working with external legal counsel on compliance and data protection matters
• ISO 27001 & audit support: Support ISO 27001 certification and surveillance audits (and client or SOC audits where relevant) by providing privacy evidence, maintaining privacy controls in the ISMS and working with the Cyber Risk & Compliance team.

Data Protection responsibilities

• Lead global privacy compliance (UK & EU GDPR, US state privacy laws, and other applicable regimes). vendor/third-party due diligence and data processing agreements (DPAs).
• Named DPO where registration required and serve as point of contact for supervisory authorities and data subjects
• Development of group-wide policies and procedures required to implement global data protection compliance
• Data Protection advisory for Technology, P&D, Marketing, Finance,
• Maintenance of Record of Processing Activities (ROPA) and other mandatory registers and documentations under relevant data protection law
• Creation and provision of privacy notices where required
• Handle Data Subject Access Requests, liaising where relevant with Tech/IT Team
• Advise on data breaches/incidents where relevant
• Creation and delivery of data protection training where relevant
• Review of data protection relevant contractual requirements (including, but not limited to, mandatory processor DPAs for GDPR compliance)
• Conducting Data Protection Impact Assessments where relevant
• Implementing Intergroup Data Transfer agreements to ensure compliance with international data transfer requirements
• Review of data protection/privacy questionnaires and similar as part of onboarding, RfP, annual review etc.
• Due Diligence on potential processors that engage AG and use AG personal data
• Data protection representative on the AI Governance Committee
• Act as the privacy and compliance contact for client due diligence, third-party risk management (inbound and outbound) and contractual negotiations on data protection, data deletion, sub-processors and AI use clauses
• Support the Acceptable Use of AI Policy, the AI capability inventory and AI risk assessments; advise on EU AI Act deployer obligations, client disclosure and consent requirements for AI use, and AI-related data retention and deletion queries from clients
• Data protection input on Cyber Security Working Group
• Contribute to the Group data governance programme, including data classification, retention and deletion policy and process, and client data segregation, working with IT and Legal
• Own and maintain the Group Data Protection Policy and lead the Data Privacy Team, including coordination with any Deputy DPO or privacy support roles
• Any other relevant data protection requirements

• Privacy-by-design across technology platforms - ensures all systems, applications, and integrations embed data protection controls (access, encryption, logging) aligned with privacy regulations.
• Personal data risk ownership in technology landscapes - identifies, assesses, and mitigates privacy risks arising from technology platforms are tracked within ISMS risk registers.
• Data availability and protection in business continuity plan and disaster recovery - ensures business continuity and disaster recovery plans protect personal data confidentiality and integrity while maintaining availability during disruptions and crisis scenarios.
• Breach, resilience, and recovery oversight - ensures privacy impact assessment, breach containment, secure recovery and post-incident remediation are built into incident and business continuity playbooks.
• Third-party technology and resilience assurance - ensures vendors and service providers meet data privacy requirements, including tested recovery capabilities and contractual privacy safeguards.

Skills & Expertise

• Minimum 5 years' experience in a global / multi-jurisdictional compliance and/or data protection role.
• Strong, demonstrable data protection expertise (GDPR + international frameworks).
• Policy drafting, governance and monitoring experience.
• Able to advise senior stakeholders independently; detail-oriented and pragmatic.
• Excellent written and spoken English.

• Legal qualification (a plus, not essential: strong compliance professionals from non-legal backgrounds are welcome).
• Additional languages
• Privacy / compliance certifications
• Familiarity and comfort with technology systems and AI