Privacy & Data Governance Manager

Own and maintain BYOMA’s Record of Processing Activities, ensuring it reflects how the business uses personal data.

Maintain associated registers, including the sub-processor register and data protection documentation.

Map personal data flows across business areas, systems, vendors and jurisdictions.

Document what data we hold, where it is processed, who it is shared with, the lawful basis for processing and any international transfer considerations.

Keep documentation to the standard expected under UK GDPR Article 30 and equivalent consumer privacy disclosure expectations in relevant US markets.

Work with business teams so privacy documentation is updated as systems, vendors, processes and marketing activities change.

Own and maintain BYOMA’s data classification approach, ensuring the sensitivity of key data assets is documented and understood.

Develop and maintain retention schedules, working with system owners to ensure they are practical and applied.

Coordinate periodic access reviews across key platforms so permissions reflect current business roles and responsibilities.

Work with the DPO to define governance standards for classification, retention, access control, data ownership and documentation, and own them day to day once agreed.

Support the development of Microsoft Purview, or equivalent tooling, as the backbone for classification, retention, eDiscovery, DLP and data governance.

Coordinate a lightweight data governance forum so decisions about data are made deliberately and consistently.

Work closely with data engineering so governance requirements are understood and built into how the data platform operates.

Own the end-to-end handling of data subject access requests and consumer rights requests.

Manage requests relating to access, deletion, correction, restriction, objection and relevant US consumer rights.

Ensure requests are handled within statutory timeframes and in line with BYOMA’s documented processes.

Verify requester identity and manage authorised agent requests appropriately.

Build and refine repeatable processes so request handling remains consistent as volumes grow.

Keep records of requests, decisions and outcomes.

Maintain and update BYOMA’s privacy policies, notices and disclosures across the UK, EU and US, keeping them accurate as law and practice evolve.

Keep cookie notices, consent records and marketing consent documentation aligned with how the business operates .

Conduct DPIAs and legitimate interests assessments for new systems, tools, products, campaigns and processing activities.

Translate privacy requirements into practical business actions.

Work with the DPO and external advisers where specialist legal advice is required.

Conduct privacy and data protection due diligence on vendors and processors.

Review data processing agreements and support contract review from a privacy and governance perspective.

Maintain oversight of processors and sub-processors.

Work with legal, procurement and business owners to ensure vendor processing is documented, risk-assessed and appropriately controlled.

Support international transfer assessments where relevant.

Track US state privacy developments that may affect BYOMA, including CCPA/CPRA and other relevant consumer privacy laws.

Coordinate with the DPO and external advisers to understand the practical implications for BYOMA.

Translate US privacy requirements into practical process updates, notices and disclosures, working with the DPO and external advisers where needed.

Support a risk-based approach to reducing privacy, regulatory and customer trust risks.

Work with teams across marketing, e-commerce, customer service, sales, operations, IT and data to embed privacy and good data practice into day-to-day work.

Design and deliver practical privacy and data-handling training.

Help colleagues understand when to involve privacy, how to handle personal data and how to escalate issues.

Promote a culture where personal data and business data are managed responsibly.

Support breach and incident response, including logging, initial assessment, evidence gathering and escalation to the DPO.

Assist the DPO with notification assessments and documentation.

Monitor relevant developments in UK, EU and US privacy law.

Flag changes that could affect BYOMA’s processes, policies, vendors or customer-facing disclosures.

Support audit readiness and ongoing improvement of BYOMA’s privacy and governance controls.

Three or more years’ experience in a privacy, data protection, information governance or compliance role.

Strong working knowledge of UK GDPR, EU GDPR and PECR.

Practical experience handling DSARs or equivalent rights requests end to end.

Experience maintaining a ROPA, data inventory, processing register or equivalent documentation.

Experience documenting how data moves through a business — systems, vendors, teams and purposes — rather than working from documentation someone else produced.

Ability to turn legal, technical or policy requirements into practical business processes.

Comfortable working with vendors, reviewing DPAs and coordinating privacy input into supplier assessments.

Experience with US privacy law, particularly CCPA/CPRA.

Awareness of other US state consumer privacy laws or biometric privacy requirements.

CIPP/E, CIPM or CIPP/US certification, or actively working towards one.

Practical data governance experience — cataloguing, classification, retention scheduling, access reviews or governance forums.

Experience working in a Microsoft 365 environment, including SharePoint and Teams.

Experience with Microsoft Purview for classification, retention, eDiscovery, DLP or data governance.

Experience in e-commerce, retail, FMCG, beauty, consumer goods or a consumer brand.

Familiarity with analytics and marketing technology — GA4, consent management platforms, advertising pixels or CRM.

Data analysis knowledge, or confidence working alongside data engineers and technical teams.

Experience delivering training or awareness programmes.

Exposure to a multi-entity or international group structure.

BYOMA is an equal opportunity employer. We value a culture of inclusion and diversity within our team. We are committed to maintaining a workplace free from prohibited employment conduct, including discrimination based on age, color, disability, marital or parental status, national origin, race, religion, sex, sexual orientation, gender identity, veteran status or any other legally protected status in accordance with applicable federal, state and local laws.

If you have a preferred name, please use it to apply. We don't need full or birth names at application stage. 😊