Location: Aylesbury
Overview
If you’re passionate about data, transparency and ensuring information is handled with integrity, this is a great opportunity to join us as a Data Protection Practitioner. You’ll help the Council meet its statutory duties across Data Protection, Freedom of Information and Environmental Information Regulations, playing a vital role in protecting the public’s trust and supporting high‑quality decision‑making across the organisation.
About the role
This is a dedicated Data Protection practitioner role, focused on delivering high‑quality operational data protection work. You will manage a range of information governance casework from start to finish, with a particular emphasis on subject access requests and data protection compliance.
You’ll provide clear, confident advice to services, support colleagues in navigating complex legislation, and help embed good data protection practice across the Council. While the primary focus of the role is data protection, there may be occasions where you support the FOI team by picking up FOI or EIR casework when required.
Your work will involve assessing risk, reviewing evidence, preparing professional correspondence and maintaining accurate records to ensure statutory duties and timescales are consistently met. A key aspect of the role is communicating data protection requirements clearly and confidently to colleagues at all levels across the Council, including designing and delivering training and awareness activity.
Key elements of the role include:
1. Acting as an experienced Data Protection practitioner, managing complex and sensitive casework with minimal supervision.
2. Leading the end‑to‑end handling of Subject Access Requests (SARs), including complex and sensitive cases, ensuring lawful decision‑making and compliance with statutory deadlines.
3. Locating, retrieving and reviewing information held across multiple systems to support SARs and other casework.
4. Investigating and managing data protection breaches, including fact‑finding, risk assessment, mitigation actions and drafting clear outcomes and correspondence.
5. Confidently applying UK GDPR and Data Protection Act 2018 rights, exemptions and restrictions.
6. Providing practical, proportionate data protection advice to services on issues such as lawful basis, data sharing, retention, transparency and individual rights.
7. Supporting and reviewing Data Protection Impact Assessments (DPIAs), offering constructive challenge and guidance where appropriate.
8. Drafting, reviewing or advising on data sharing agreements and information‑sharing arrangements.
9. Providing data protection advice in relation to contracts and suppliers, including the use of appropriate contractual clauses.
10. Managing FOI and EIR casework when required to support the FOI team.
11. Preparing clear written responses, reports and case summaries suitable for audit, escalation or ICO scrutiny.
12. Using iCasework to manage, analyse and record data protection casework accurately and defensibly.
13. Confidently using operational and case management systems and SharePoint to locate, retrieve, download, review, combine and convert information held across service areas to support SARs, breach investigations and other data protection work.
14. Creating, combining and redacting documents, including producing clear and accurate PDF disclosures.
15. Contributing to data protection training, guidance, templates, internal communications and awareness materials.
About you
You’ll bring strong practical experience of data protection work and enjoy applying legislation in a clear, solutions‑focused way. You’ll be comfortable working independently, making reasoned decisions and communicating confidently with a wide range of people across the Council.
You’ll thrive in this role if you are:
16. A clear and confident communicator, able to explain complex legal or technical issues in plain language.
17. Credible and assured when working with colleagues at all levels of the organisation, including senior officers.
18. Highly organised and detail‑focused, with the ability to manage multiple statutory deadlines.
19. Analytical and evidence‑based, with experience assessing risk and presenting well‑reasoned conclusions.
20. Comfortable delivering training or briefings and responding confidently to questions.
You will also have:
21. Significant hands‑on experience working in data protection or a closely related information governance role.
22. Strong practical knowledge of UK GDPR and core data protection principles.
23. Proven experience of managing Subject Access Requests, including complex or sensitive cases.
24. Experience investigating and responding to data protection breaches.
25. Experience delivering data protection training, briefings or awareness activity, or the confidence to develop and deliver this effectively.
26. Strong technical skills, with the ability to locate, retrieve and manage information across multiple systems accurately and securely.
27. Experience using case management systems, such as iCasework, to manage statutory casework and maintain defensible records.
28. Confidence working with digital documents, including combining files, creating PDFs and applying accurate redactions.
29. A working knowledge of SharePoint or similar document management systems.
30. Knowledge or experience of FOI and EIR legislation is desirable, as the postholder may be required to support the FOI team by managing FOI cases when needed.
31. NVQ Level 3 / HNC (or equivalent) as a minimum.
32. The ability to converse effectively with the public in spoken English.
A full driving licence is desirable but not essential.