About The Role

As our Data Protection and Information Governance Lead, you will act as the organisation’s statutory Data Protection Officer, taking responsibility for all aspects of data protection, GDPR compliance and privacy governance. You will lead the implementation and ongoing management of GDPR requirements across the business, ensuring we remain accountable, audit‑ready and fully aligned with regulatory expectations. Your work will help embed a privacy‑first culture, ensuring that data protection principles are understood and applied consistently across all teams. The initial focus will be on strengthening core GDPR controls, supporting audit readiness and embedding practical governance improvements. This role will operate proportionately, balancing oversight with hands-on delivery in a small/medium housing association context.

This is an opportunity to shape and mature data protection arrangements in a values-driven organisation, with oversight of organisation-wide governance. You will support the organisation in demonstrating compliance against regulatory expectations, including internal and external audit requirements.

In this role, you will advise the organisation on its GDPR obligations and compliance strategy, monitor internal compliance, and report regularly to senior leadership. You will serve as the primary point of contact for the ICO and for data subjects, ensuring independence and objectivity at all times. You will oversee the development and maintenance of our Record of Processing Activities and Data Retention Schedule, manage Data Protection Impact Assessments, and ensure that all Data Processing and Data Sharing Agreements are robust, lawful and up to date. You will also be responsible for reviewing and updating privacy notices, strengthening staff training and awareness, and ensuring that privacy‑by‑design is embedded into systems, processes and digital transformation programmes.

You will maintain our compliance registers and dashboards, prepare the organisation for internal and external audits, and ensure that governance reporting is accurate, timely and evidence‑based. Your work will involve close collaboration with colleagues across governance, IT, cyber security, digital, People Services and operational teams, as well as external partners, statutory bodies and auditors. The role will operate with the independence required of a statutory Data Protection Officer under UK GDPR.