A well-established, national law firm is seeking a Data Protection Officer to join its Information Governance and Data Protection team in their beautiful offices in Birmingham city centre.
The RoleYou will work in a fast-paced team alongside the Head of Data Protection, supporting both client-facing and internal governance activity. The role requires strong attention to detail, accuracy, and confidence working with technical and regulatory material.Key Responsibilities
1. Manage Data Subject Access Requests (DSARs) end-to-end, including review, redaction, and delivery of high-volume data sets.
2. Review Data Protection Impact Assessments (DPIAs), identifying risks and providing clear, structured feedback.
3. Analyse Data Processing Agreements (DPAs), highlighting gaps, inconsistencies, and compliance risks, and escalating where appropriate.
4. Support wider information governance and compliance activities, including advisory support and internal processes.
About You
5. Strong working knowledge of GDPR and UK data protection law (no legal qualification required).
6. Practical understanding of data protection risks and compliance principles.
7. Experience handling sensitive and confidential information.
8. Excellent attention to detail, particularly in document review and redaction work.
9. Clear and confident communicator, able to explain technical issues simply.
10. Highly organised, with the ability to manage multiple priorities accurately.
If you have any queries about the role, contact Alice on 0121 633 4443. If you are already registered with Katie Bard, please contact your consultant directly. Katie Bard is an Equal Opportunities Employer.Katie Bard will manage your application in accordance with GDPR and the Data Protection Act 2018, and in line with the Employment Agencies and Employment Businesses Regulations 2003. Please refer to the privacy notice on our website for further details on how we manage your data. If your application is successful, we will contact you and handle your personal information in line with GDPR guidelines. If unsuccessful, your application and associated data will be deleted within six weeks.