Data Protection Officer

Job Title: Data Protection Officer Location: London/Hybrid (Typically 2/3 days in the office) Type: Full time – Permanent At Ardonagh Specialty, we provide much more than just a workplace. We are dedicated to fostering skill development, knowledge and inclusive culture within a passionate team that values diversity. Working at Ardonagh Specialty means you’ll be part of The Ardonagh Group.

We are proud of our innovative environment offering many opportunities for growth across the wider group. What we can offer We offer an inclusive culture with apprenticeships, study support, participation in awards, community trusts, sports teams, office socials, events, wellbeing programmes and discounts across many big‑name businesses. Further perks of working with us (Fixed benefits) Employer pension contribution of 10% (providing you, the Employee provides 5%).

Good work life balance – flexibility to suit you. Competitive salary. Life Assurance at X4 of your base salary.

Group Income Protection. Generous Annual Leave entitlement. Private Medical Insurance.

Group annual bonus scheme. Purpose of the Role The DPO provides independent oversight of all personal data processing, ensuring that Ardonagh Specialty meets statutory obligations while providing oversight and challenge to privacy resilience across underwriting, claims, delegated authority, data‑driven growth initiatives, and emerging technologies. This includes scrutiny of AI‑enabled processing and awareness of the appropriate deployment and limitations of Privacy‑Enhancing Technologies (PETs).

The role supports Senior Management Functions by providing independent challenge, insight, and reporting as part of the firm’s risk and conduct strategy. Key Role Accountabilities 1. Regulatory Governance and Statutory Oversight Serve as the statutory Data Protection Officer under UK GDPR Articles 37–39, operating with full organisational independence and free from any involvement in decisions determining the purposes or means of processing.

Inform and advise the organisation and its employees on their data protection obligations under the UK GDPR, Data Protection Act 2018, and evolving digital regulations like the Data Use and Access Act (DUAA). Oversee and assure the completeness and accuracy of the firm’s ROPA through periodic reviews, data‑flow mapping and validation across brokers, MGAs, TPAs and reinsurance partners. Act as the primary escalation point for the ICO and data subjects, providing oversight of SAR handling processes to ensure compliance, consistency, and timeliness. 2.

Strategic Risk Management and Technical Oversight Independently oversee and challenge the GDPR remediation programme, providing assurance to Senior Management and documenting risk closures across the value chain. Review and challenge DPIAs and AI Impact Assessments for high‑risk initiatives, ensuring transparency, fairness, minimisation, explainability, and compliance with Article 22 safeguards for automated decision‑making. Review and challenge privacy implications of cloud‑related processing activities by evaluating shared‑responsibility allocations, data governance controls, and alignment with ASL security and data‑management frameworks.

Oversee and assure international data‑transfer governance, ensuring SCCs/IDTAs are supported by regularly reviewed Transfer Risk Assessments and evolving regulatory guidance. 3. Collaborative Advisory Input Align GDPR and Anti‑Money Laundering (AML) obligations to ensure that data collected for financial crime prevention (KYS) is handled proportionately and not repurposed for unrelated commercial aims. If applicable, partner with Consumer Duty representatives to ensure data practices support fair outcomes and effective identification of vulnerable customers, embedding Privacy by Design and clear language communication principles.

Collaborate with the CISO to integrate privacy risk assessment, harm modelling, ICO notification criteria, and data‑subject communication procedures into the Incident Response Framework. Provide advisory input on AI Systems by ensuring that privacy implications, model‑specific risks, data‑minimisation principles, and Article 22 safeguards are consistently applied, while maintaining awareness of the appropriate use and limitations of Privacy‑Enhancing Technologies (PETs) within AI‑enabled environments. Essential Experience Significant experience in data protection leadership (5+ years) within FS/insurance, including oversight of data governance operating models, control frameworks, and multi‑entity data sharing environments.

Proven track record of managing complex data ecosystems involving third‑party intermediaries e.g., delegated authority (MGAs), and cross‑border reinsurance arrangements. Experience in conducting DPIAs and implementing Privacy by Design within modern IT architectures, including cloud native systems (IaaS, PaaS, SaaS) and AI Systems. Technical and Legal Expertise Expert knowledge of UK GDPR and the Data Protection Act 2018.

Deep understanding of FCA frameworks, including the Senior Managers and Certification Regime (SMCR). Knowledge of industry specific data quality standards (e.g., Solvency II Article 82 requirements for data accuracy and completeness). Strong understanding of the privacy, governance, and accountability requirements relating to AI Systems, including assessment of model‑specific risks, data‑minimisation expectations, and the appropriate use of Privacy‑Enhancing Technologies (PETs).

Preferred Qualifications Industry‑recognised certifications (e.g., BCS Foundation Certificate in Data Protection, CIPP/E, Certified Data Protection Practitioner – GDPR) are highly desirable as evidence of professional qualities. A multidisciplinary background combining legal knowledge with an understanding of actuarial science or technical security architecture. Person Specification Must exhibit the highest standards of integrity and a service‑oriented mindset when handling sensitive consumer and financial data, including data used within AI‑enabled processes.

Demonstrates resilience and authority in providing independent challenge to senior leaders, with the ability to escalate concerns directly to Senior Management, the Board, SMFs, and Risk Committees when necessary, particularly where AI‑related privacy or governance risks are identified. Equal Opportunity Statement We truly value the diversity of our teams and, as a Group, we are committed to supporting and welcoming individuals from all backgrounds. Should you require any reasonable adjustment throughout the recruitment process, please let a member of our Talent team know. #J-18808-Ljbffr