Data Privacy Analyst – Regulatory Compliance

Overview

In this role you will run iwoca’s day-to-day UK data protection work, ensuring practical application of UK GDPR, Data Protection Act 2018 and PECR. You will tackle core duties like DSARs, DPIAs, and breach handling while exploring automation and AI-enhanced privacy solutions. As you grow credibility, you’ll own broader aspects of the framework and advise across the business. You’ll work closely with Compliance leadership and cross-functional teams to support compliant, scalable product delivery. This position offers real visibility and impact in a regulated fintech environment.

Pay / Benefits

• Flexible working hours
• Medical insurance from Vitality
• Private GP service for you/partner/dependents
• 25 days’ holiday + birthday day off + buy/sell additional leave
• One-month paid sabbatical after four years
• Equity incentive scheme

Responsibilities

• Own data subject access requests from intake to response, apply exemptions and meet deadlines
• Conduct privacy assessments (DPIAs, LIA), and other privacy reviews for new products, features, suppliers and data flows
• Maintain Records of Processing Activities and retention/deletion schedules; manage DPAs with suppliers
• Assess AI tooling and automated decisioning for lending/operations; address data inputs, lawful basis, model outputs, and user rights
• Identify manual privacy steps and propose automation with clear requirements for Tech and Data teams
• Provide accessible privacy guidance to non-specialist stakeholders and shape product development with privacy in mind

Key requirements

• Experience in data protection or privacy operations or a role where data protection was part of the job
• Solid practical knowledge of UK GDPR, Data Protection Act 2018 and PECR; awareness of Data (Use and Access) Act 2025 is advantageous
• Hands-on experience with DSARs, DPIAs, legitimate interests assessments, breach handling, ROPA maintenance, and DPAs review
• Interest and working understanding of applying data protection law to AI and automation; ability to discuss with engineers
• Stakeholder management skills with ability to give clear non-legal guidance to product/engineering/marketing/operations

• Clear and practical communicator
• Collaborative and business-facing
• Judgement and proactive problem solving
• UK GDPR, Data Protection Act 2018, PECR expertise
• DSARs, DPIAs, legitimate interests assessments, breach handling, ROPA maintenance, DPAs
• AI governance and automation assessment for privacy

…