Data Protection Officer

The role

The group runs around 900 stores across the UK and Ireland, alongside an online business and a loyalty scheme with 20 million members. A reportable breach last year at a third-party marketing supplier led to an ICO investigation, which closed without a fine but with clear recommendations. The permanent DPO has since left, and a replacement is unlikely to start before the spring. You will report to the General Counsel, with direct access to the Audit and Risk Committee.

What you will do

• Act as the named Data Protection Officer under UK GDPR and the Irish Data Protection Act.
• Close out the ICO’s recommendations and report progress to the Audit and Risk Committee.
• Review personalisation and profiling in the loyalty programme, including legitimate interests assessments.
• Tighten supplier due diligence and data processing terms across around 150 processors.
• Manage a privacy team of four and prepare the handover to the permanent hire.

What you will bring

• Experience as a DPO or head of privacy in a consumer business with large volumes of customer data.
• Deep working knowledge of UK GDPR, PECR and the Data (Use and Access) Act 2025.
• Experience of handling a regulatory investigation or breach response with the ICO.
• A practical, commercially minded approach to marketing and loyalty data.
• Availability to start within four weeks.

The package

A day rate of £800 to £950 outside IR35 for a six-month assignment, four or five days a week. The role is remote, with occasional days at the head office in Leeds or the Dublin office. Interviews can be arranged at short notice.