Head of Data Protection

Role description

Benefits of working at Together

26 days holiday, and a day off for your birthday (increasing with service to 30 days), plus bank holidays

Free access to company holiday homes

Buy & sell holidays

Discretionary annual bonus plus an additional Shared Reward Bonus

Matched pension contribution

Health cash plan plus Private medical insurance

Life assurance and Critical illness cover

Travel season ticket loans and Ride to work scheme

Free local gym access

Local bar / restaurant discounts

–––––––––––––

Company Description

We’re Together. For over 50 years, we’ve helped thousands of people, businesses and professionals unlock their property ambitions with our common-sense approach to mortgages and secured loans.

We take the time to understand our customers and our door is always open, so we can often help when other lenders can’t or won’t. Based in Cheadle, Cheshire, our 750 colleagues help our customers throughout the UK, backed by the power of a £7 billion loan book.

As the Head of Data Protection you will be responsible for overseeing Together Money's Data Protection Framework, ensuring compliance with UK General Data Protection Regulations (UK GDPR), the Data Protection Act 2018 (DPA) and the Privacy and Electronic Communication Regulations (collectively “Data Protection Laws”), Consumer Duty, and other relevant regulatory expectations. The role provides strategic leadership on privacy, data protection, data governance, and information risk, acting as the primary subject matter expert and advisor to senior management and the Board.

As the Head of Data Protection we are looking for someone to:

Lead the development and implementation of Together Money’s data protection strategy

Serve as the organisation’s Data Protection Officer under UK GDPR

Monitor compliance with data protection laws, internal policies, and regulatory obligations

Provide advice on, and monitor the completion and outcomes of, Data Protection Impact Assessments (DPIAs) for high‑risk processing and change initiatives

Cooperate with, and act as the main point of contact for, the Information Commissioner’s Office (ICO), including supporting any prior consultation activities

Act as a contact point for data subjects on the exercise of their rights and privacy queries, and support timely, compliant responses

Drive continuous improvement of data protection and privacy controls

Drive continuous improvement of data protection training and awareness programmes

Provide expert advice on new products, systems, and change initiatives

Inform and advise the organisation (including employees) on obligations under UK GDPR, DPA 2018 and related data protection laws

Monitor compliance with data protection laws and internal policies, including assigning responsibilities, overseeing audits, and driving awareness and training

Provide assurance and oversight of data retention, archiving, and disposal practices

Ensure privacy by design and default is embedded across all change initiatives

Lead investigations into complex or high‑risk data protection incidents

Develop data protection KPIs, metrics, and Board‑level reporting dashboards

Support enterprise‑wide risk management and governance activities

Contribute to Consumer Duty compliance, ensuring vulnerable customer considerations are embedded

Provide regular reports to CORC, Executive Risk Committee, and Board as required

Oversee third‑party data protection assurance and contractual controls

Champion a strong culture of privacy and responsible data use across the business

Lead internal awareness campaigns to enhance data protection culture

Support internal and external audits relating to privacy and information governance

Collaborate with Cyber Security to align privacy and security risk management

Essential:

Experienced Data Protection professional with substantial experience as a Data Protection Officer

Excellent and effective communication, negotiation, influencing and interpersonal skills

Expertise in UK and EU data protection laws and an in-depth understanding of the UK GDPR

Ability to demonstrate technical knowledge and awareness of current data management and communication technologies.

Experience of continuous improvement activity driving high performance

Desirable:

CIPP/E

CIPT

CISM

Advanced report writing experience

If you feel you have some of the skills mentioned above, but not all, please do still apply and we would be happy to have a further discussion with you in regards to your suitability for the role.

Together embraces diversity and inclusion, and are proud to be an equal opportunity workplace. Not only do we welcome difference – we celebrate it, support it and really value our colleagues for who they are. We are committed to building a team that represents a variety of backgrounds, perspectives and skills.

If you feel you'd benefit from any support or reasonable adjustments during any stage of the recruitment process, please don’t hesitate to let us know when completing your application. This information will be picked up by our team, so we can try and put steps in place to help you be at your best through this process.

Please note that all successful applicants will undergo relevant employment reference, financial and criminal record checks.