Job Description

Role Purpose

The Data Protection Analyst is a 12 month Fixed Term Contract role intended to support Collinson Insurance’s Privacy Compliance programme across the end-to-end insurance lifecycle including distribution, underwriting, policy administration, claims handling, medical assistance, fraud prevention and customer service. The objective is to ensure a compliant, secure and transparent use of personal data.

Key Responsibilities

Advice & Triage: provide first line practical guidance on day-to-day privacy queries across commercial, operations, medical assistance and customer support teams. Escalate complex, high risk or strategic matters with a clear summary and recommendation.
Data subject rights & complaints: support the handling of data subject requests and data protection complaints
DPIAs: support DPIAs for change initiatives by assisting with advice, wording, identification and documentation of risks, mitigations and track actions through to completion.
AI and Automated Decision Making: support privacy assessments for AI enabled tools and automated decision making, including data mapping, DPIA input, transparency requirements, human oversight measures and escalation of potential high risk use cases.
RoPA & Data Mapping: maintain RoPA entries and data maps for core insurance processes documenting data flows and supporting periodic governance reviews.
Incident and breach management: Manage personal data incident logging, triage and assist with risk assessment and documentation, and track remediation.
Retention & Deletion: support the implementation and monitoring of data retention requirements, including retention schedules, deletion actions, exceptions, and evidence of compliance.
Supplier & Contract Assurance: support third party privacy due diligence and the review of data processing clauses, maintaining trackers and evidence for processor compliance. Escalate higher risk arrangements, international transfers and non-standard contractual positions.
Training & Awareness: support role-based privacy training and development of guidance materials tailored to operational claims and customer service scenarios.
Reporting & Governance Support: maintain Privacy Dashboards and support audit and regulator readiness by ensuring decisions and evidence are properly documented.
Privacy Notice & Transparency: support reviews of privacy notices, customer communications and operational documentation to ensure processing is explained clearly and accurately.

You’re the right person if

You’re good with building relationships across with internal and external stakeholders.
You communicate in a clear, straightforward way. You can explain privacy requirements in plain English, tailor your message to the audience, and write things down so they are easy to follow and stand up to scrutiny.
You can tell what is routine and what feels higher risk, and when something needs to be escalated you can summarise the issue and your recommendation clearly.
You can juggle several priorities at once, stay on top of deadlines and keep stakeholders updated.
You are calm and constructive when things get busy. You can handle pushback, ask the right questions, and land a practical outcome without becoming a blocker.
You pay attention to detail, and you keep good records. You are comfortable maintaining trackers and logs, and you follow actions through to completion.
You handle sensitive information with care. You understand the importance of confidentiality, especially when dealing with claims information and special category data.
You look for ways to improve how things are done. You notice and you suggest practical changes that make the process smoother and reduce risk.
You enjoy working in a diverse and multi-national environment.
You work well as part of a team, sharing updates early, supporting colleagues when priorities shift, and contributing to a positive, collaborative way of working.

Essential Experience

Demonstrates relevant experience in data protection, privacy, compliance, audit, risk, governance, legal operations or a paralegal role. Equivalent experience in a regulated operational environment with substantial data protection exposure will also be considered.
Experience supporting data subject rights requests, data protection complaints, DPIAs, maintenance of records of processing activities, privacy notice updates and reviews.
Working knowledge of the UK and EU data protection regulatory framework, including the practical application of lawful basis, transparency, data subject rights, personal data breach management, data protection impact assessments and international data transfers.
Proficiency in Microsoft Office applications, particularly Excel, PowerPoint and Word, and confidence maintaining trackers, dashboards and supporting evidence.

Desirable Experience

Experience in insurance, claims, medical assistance, financial services or another regulated environment with complex customer journeys and third-party arrangements.
Experience supporting data protection complaints, data retention, privacy training, supplier due diligence or processor assurance, contract reviews and assessments.
Familiarity with multi-entity and cross-border processing environments, including data sharing within a group and with external parties.
Awareness of privacy considerations arising from AI-enabled processing and automated decision making.
A law degree or legal background, particularly where this has involved interpreting data protection requirements, applying exemptions and producing clear, defensible documentation.

Reward & Benefits: What's in it for me?

We want our people to feel recognised, supported and able to thrive both at work and beyond it.

We offer a competitive reward package designed to support your financial, physical and mental wellbeing, alongside opportunities to learn, develop and be recognised for the contribution you make. Benefits vary by role and location, and full details will be shared as part of the application process.

Equal opportunities: Our commitment to inclusion

Collinson Group is an equal opportunities employer. We welcome applications from people of all backgrounds, identities and experiences, and believe that different perspectives make our business stronger.

Job Description

Role Purpose

Key Responsibilities

Advice & Triage: provide first line practical guidance on day-to-day privacy queries across commercial, operations, medical assistance and customer support teams. Escalate complex, high risk or strategic matters with a clear summary and recommendation.
Data subject rights & complaints: support the handling of data subject requests and data protection complaints
DPIAs: support DPIAs for change initiatives by assisting with advice, wording, identification and documentation of risks, mitigations and track actions through to completion.
AI and Automated Decision Making: support privacy assessments for AI enabled tools and automated decision making, including data mapping, DPIA input, transparency requirements, human oversight measures and escalation of potential high risk use cases.
RoPA & Data Mapping: maintain RoPA entries and data maps for core insurance processes documenting data flows and supporting periodic governance reviews.
Incident and breach management: Manage personal data incident logging, triage and assist with risk assessment and documentation, and track remediation.
Retention & Deletion: support the implementation and monitoring of data retention requirements, including retention schedules, deletion actions, exceptions, and evidence of compliance.
Supplier & Contract Assurance: support third party privacy due diligence and the review of data processing clauses, maintaining trackers and evidence for processor compliance. Escalate higher risk arrangements, international transfers and non-standard contractual positions.
Training & Awareness: support role-based privacy training and development of guidance materials tailored to operational claims and customer service scenarios.
Reporting & Governance Support: maintain Privacy Dashboards and support audit and regulator readiness by ensuring decisions and evidence are properly documented.
Privacy Notice & Transparency: support reviews of privacy notices, customer communications and operational documentation to ensure processing is explained clearly and accurately.

You’re the right person if

You’re good with building relationships across with internal and external stakeholders.
You communicate in a clear, straightforward way. You can explain privacy requirements in plain English, tailor your message to the audience, and write things down so they are easy to follow and stand up to scrutiny.
You can tell what is routine and what feels higher risk, and when something needs to be escalated you can summarise the issue and your recommendation clearly.
You can juggle several priorities at once, stay on top of deadlines and keep stakeholders updated.
You are calm and constructive when things get busy. You can handle pushback, ask the right questions, and land a practical outcome without becoming a blocker.
You pay attention to detail, and you keep good records. You are comfortable maintaining trackers and logs, and you follow actions through to completion.
You handle sensitive information with care. You understand the importance of confidentiality, especially when dealing with claims information and special category data.
You look for ways to improve how things are done. You notice and you suggest practical changes that make the process smoother and reduce risk.
You enjoy working in a diverse and multi-national environment.
You work well as part of a team, sharing updates early, supporting colleagues when priorities shift, and contributing to a positive, collaborative way of working.

Essential Experience

Demonstrates relevant experience in data protection, privacy, compliance, audit, risk, governance, legal operations or a paralegal role. Equivalent experience in a regulated operational environment with substantial data protection exposure will also be considered.
Experience supporting data subject rights requests, data protection complaints, DPIAs, maintenance of records of processing activities, privacy notice updates and reviews.
Working knowledge of the UK and EU data protection regulatory framework, including the practical application of lawful basis, transparency, data subject rights, personal data breach management, data protection impact assessments and international data transfers.
Proficiency in Microsoft Office applications, particularly Excel, PowerPoint and Word, and confidence maintaining trackers, dashboards and supporting evidence.

Desirable Experience

Experience in insurance, claims, medical assistance, financial services or another regulated environment with complex customer journeys and third-party arrangements.
Experience supporting data protection complaints, data retention, privacy training, supplier due diligence or processor assurance, contract reviews and assessments.
Familiarity with multi-entity and cross-border processing environments, including data sharing within a group and with external parties.
Awareness of privacy considerations arising from AI-enabled processing and automated decision making.
A law degree or legal background, particularly where this has involved interpreting data protection requirements, applying exemptions and producing clear, defensible documentation.

Reward & Benefits: What's in it for me?

We want our people to feel recognised, supported and able to thrive both at work and beyond it.

Equal opportunities: Our commitment to inclusion

Job Description

Role Purpose

Key Responsibilities

Advice & Triage: provide first line practical guidance on day-to-day privacy queries across commercial, operations, medical assistance and customer support teams. Escalate complex, high risk or strategic matters with a clear summary and recommendation.
Data subject rights & complaints: support the handling of data subject requests and data protection complaints
DPIAs: support DPIAs for change initiatives by assisting with advice, wording, identification and documentation of risks, mitigations and track actions through to completion.
AI and Automated Decision Making: support privacy assessments for AI enabled tools and automated decision making, including data mapping, DPIA input, transparency requirements, human oversight measures and escalation of potential high risk use cases.
RoPA & Data Mapping: maintain RoPA entries and data maps for core insurance processes documenting data flows and supporting periodic governance reviews.
Incident and breach management: Manage personal data incident logging, triage and assist with risk assessment and documentation, and track remediation.
Retention & Deletion: support the implementation and monitoring of data retention requirements, including retention schedules, deletion actions, exceptions, and evidence of compliance.
Supplier & Contract Assurance: support third party privacy due diligence and the review of data processing clauses, maintaining trackers and evidence for processor compliance. Escalate higher risk arrangements, international transfers and non-standard contractual positions.
Training & Awareness: support role-based privacy training and development of guidance materials tailored to operational claims and customer service scenarios.
Reporting & Governance Support: maintain Privacy Dashboards and support audit and regulator readiness by ensuring decisions and evidence are properly documented.
Privacy Notice & Transparency: support reviews of privacy notices, customer communications and operational documentation to ensure processing is explained clearly and accurately.

You’re the right person if

You’re good with building relationships across with internal and external stakeholders.
You communicate in a clear, straightforward way. You can explain privacy requirements in plain English, tailor your message to the audience, and write things down so they are easy to follow and stand up to scrutiny.
You can tell what is routine and what feels higher risk, and when something needs to be escalated you can summarise the issue and your recommendation clearly.
You can juggle several priorities at once, stay on top of deadlines and keep stakeholders updated.
You are calm and constructive when things get busy. You can handle pushback, ask the right questions, and land a practical outcome without becoming a blocker.
You pay attention to detail, and you keep good records. You are comfortable maintaining trackers and logs, and you follow actions through to completion.
You handle sensitive information with care. You understand the importance of confidentiality, especially when dealing with claims information and special category data.
You look for ways to improve how things are done. You notice and you suggest practical changes that make the process smoother and reduce risk.
You enjoy working in a diverse and multi-national environment.
You work well as part of a team, sharing updates early, supporting colleagues when priorities shift, and contributing to a positive, collaborative way of working.

Essential Experience

Demonstrates relevant experience in data protection, privacy, compliance, audit, risk, governance, legal operations or a paralegal role. Equivalent experience in a regulated operational environment with substantial data protection exposure will also be considered.
Experience supporting data subject rights requests, data protection complaints, DPIAs, maintenance of records of processing activities, privacy notice updates and reviews.
Working knowledge of the UK and EU data protection regulatory framework, including the practical application of lawful basis, transparency, data subject rights, personal data breach management, data protection impact assessments and international data transfers.
Proficiency in Microsoft Office applications, particularly Excel, PowerPoint and Word, and confidence maintaining trackers, dashboards and supporting evidence.

Desirable Experience

Experience in insurance, claims, medical assistance, financial services or another regulated environment with complex customer journeys and third-party arrangements.
Experience supporting data protection complaints, data retention, privacy training, supplier due diligence or processor assurance, contract reviews and assessments.
Familiarity with multi-entity and cross-border processing environments, including data sharing within a group and with external parties.
Awareness of privacy considerations arising from AI-enabled processing and automated decision making.
A law degree or legal background, particularly where this has involved interpreting data protection requirements, applying exemptions and producing clear, defensible documentation.

Reward & Benefits: What's in it for me?

We want our people to feel recognised, supported and able to thrive both at work and beyond it.