Privacy Analyst (Data Protection & AI Risk)

Job Title: Privacy Analyst (Data Protection & AI Risk) Location: London/Hybrid (Typically 1/2 days in the office) Type: Full time - Fixed Term 12 Months (If you are a job share partnership, work reduced hours, or any other way of working flexibly, please do still get in touch) At Ardonagh Specialty, we provide much more than just a workplace. We are dedicated to fostering skill development and knowledge within a team that is passionate about their work, values their Employees, and truly celebrates diversity. Working at Ardonagh Specialty means you’ll be part of The Ardonagh Group. We are proud of our innovative environment offering many opportunities for growth across the wider group. Employees regularly move between our united teams, and we encourage you to make your role your own. Our offices are lively and exciting places to be, but we understand that life needs flexibility, and offer a genuinely flexible approach to working. If you are looking to join a thriving, energetic business with exciting plans, this role could be an ideal fit for you. What we can offer: We offer much more than just an inclusive culture with apprenticeships, study support, participation in our annual Spotlight Awards, Community Trust, Sports Teams, office socials, events and so much more. All of this with a supportive management team as well as working alongside some of the industry’s top talent. You’ll have access to wellbeing programs, fantastic discounts across many big-name businesses including supermarkets, gym memberships, restaurants, and healthcare cash plans etc. Further perks of working with us (Fixed benefits): Employer pension contribution of 10% (providing you, the Employee provides 5%). Good work life balance - flexibility to suit you. Competitive salary. Life Assurance at X4 of your base salary. Group Income Protection. Generous Annual Leave entitlement. Private Medical Insurance. Group annual bonus scheme. Manager says: We are looking for an experienced Privacy Analyst to perform day-to-day privacy processes and support the operation of ASL’s emergent Data Protection & Governance frameworks. The role is the core operational administrator for the OneTrust Data Management platform, maintaining accurate records and workflows and coordinating the timely, compliant handling of data subject rights requests, assessments and activities such as due diligigence for internal and external risk assessments. The role holder will embed privacy by design by triaging new projects, systems and business initiatives; determining when a PIA, DPIA or AI Risk Assessment is required; and coordinating assessments through to documented approval and remediation. The role also supports privacy due diligence for suppliers through the Know Your Supplier (KYS) process, reviews relevant contractual privacy safeguards, and assesses the privacy and responsible-use risks of internal and third-party AI solutions. Working within ASL policies, standards and governance, the role will provide clear management information, maintain auditable evidence and escalate material risks to the DPO and appropriate control owners. What you will do: OneTrust and GDPR administration Support operational administration of OneTrust, configuring and maintaining workflows, user access, templates, reporting and supporting guidance. Maintain data inventories, data maps and records of processing activities (ROPA), coordinating periodic reviews with accountable business owners and challenging incomplete or inconsistent records. Track privacy obligations, control gaps, actions and evidence; produce management information and escalate overdue or material issues to the DPO and relevant control owners. Screening and impact assessment Manage the privacy intake and initial screening process for new projects, products, systems, processing changes and internal initiatives. Assess whether proposals involve personal data, special category or criminal offence data, vulnerable individuals, large-scale monitoring, international transfers, profiling or automated decision-making. Determine, with appropriate DPO oversight, whether a PIA, DPIA, legitimate interests assessment, transfer risk assessment or AI Risk Assessment is required (escalating to the Data & AI Controls lead as appropriate). Coordinate assessments through completion, document decisions and residual risks, monitor actions and provide practical privacy-by-design advice during solution design and implementation. Data subject rights Coordinate the end-to-end lifecycle of data subject rights requests, including access, deletion, rectification, restriction, objection and portability, ensuring identity checks, scope, searches, exemptions, approvals and responses are completed within statutory deadlines. Work with IT, HR, Legal, business teams and system owners to locate, retrieve, review and securely disclose relevant information, applying proportionate redaction and protecting third-party rights. Maintain a complete audit trail, identify recurring issues and improve OneTrust intake, fulfilment and reporting workflows to reduce manual effort and operational risk. Supplier risk Perform due diligence for new and existing suppliers through the KYS process, assessing processing purpose, data categories, hosting, sub-processors, retention, security, incident handling and international transfer risks. Support review of data processing agreements, transfer safeguards and privacy schedules against approved standards, escalating material departures for Legal or DPO decision. Conduct Risk Assessments for internal and third-party AI/ML use cases, considering purpose, data provenance and lawful use, training and prompt inputs, scraping, transparency, human oversight, security, accuracy, bias, explainability and impacts on individuals inlcusive of Data Protection impact. Maintain the AI use-case inventory and assessment evidence, monitor remediation and support alignment with the ASL AI Policy, UK GDPR, applicable ICO guidance and, where relevant, the EU AI Act and NIST AI Risk Management Framework. What you will bring: Essential Bachelor’s degree or equivalent practical experience in data protection, law, information security, data governance, risk, compliance or a related discipline. At least three years’ relevant experience in privacy, compliance, legal operations or a closely related operational risk role, preferably within financial services, insurance or another regulated environment. Hands-on experience administering OneTrust or a comparable privacy management platform, including DSR, data mapping/ROPA and assessment workflows; able to configure workflows, templates, permissions and reporting. Strong operational knowledge of UK GDPR and relevant Data Protection Act requirements, data subject rights, DPIAs, lawful bases, retention, controller/processor responsibilities and international data transfer mechanisms. Demonstrable ability to triage project and supplier information, identify material privacy risks, make proportionate recommendations and maintain clear, auditable records. Sufficient technical understanding of cloud services, system architecture, access controls, data flows, APIs and AI/ML systems to challenge how personal data is collected, used, stored, shared and deleted. Excellent written and verbal communication, with the ability to translate legal and technical requirements into clear, practical actions for business, product, engineering and procurement teams. Desirable CIPP/E, CIPM, OneTrust Certified Professional or equivalent privacy qualification. Experience of supplier privacy due diligence, DPAs, standard contractual clauses and transfer risk assessments. Working knowledge of responsible AI governance, the EU AI Act, NIST AI Risk Management Framework and privacy risks associated with generative AI and machine learning. Person Specification: This role is suited to an individual who has completed the first few years of their career, or someone seeking to establish and develop a career in privacy, data protection and responsible AI governance. The successful candidate will be highly organised, detail-oriented and curious, with the confidence to ask questions, follow defined processes and take ownership of accurate records and time-sensitive activities. They do not need to be an established privacy expert but should demonstrate a genuine interest in the field, an ability to learn regulatory and technical concepts quickly, and sound judgement about when to seek guidance or escalate risk. They will be comfortable working with digital platforms, analysing information from different sources and communicating clearly with business and technical stakeholders. Success will require discretion, reliability, collaborative working, strong follow-through and a commitment to continuous learning, evidence-based working and privacy by design. Think you don’t meet every requirement? We are an equal opportunities Employer, dedicated to creating a diverse, inclusive, and authentic workplace where everyone can thrive, bring their whole self to work, and reach their full potential. If you’re excited about this role, but your experience doesn’t perfectly match what we are looking for, please apply anyway. You might just be the right fit for the job, or other opportunities we may have within the wider Group. Interview Process: At Ardonagh Specialty, we have a straightforward interview process to ensure the best fit for both you and the company: Submit your application with your CV, emphasising your skills and experience related to the job. Our Talent Acquisition team will then arrange a call where they can tell you more about the role and the team. We want to learn about your motivation and goals, what you can bring to Ardonagh Specialty, and answer any immediate questions. If successful, you will generally be invited to engage in a 1-hour interview with the Hiring Manager and selected team members, via teams or in person. We will discuss our technologies, key skills, and team dynamics and provide further opportunity to ask any questions. This is your chance to voice your thoughts on the role and we will outline our expectations and ensure this role aligns with your ambitions for the future. Depending on the role, you may be invited to attend a second stage interview with further members of the team. If successful or unsuccessful, we always try and move quickly in presenting an offer or providing feedback. We truly value the diversity of our teams and as a Group, we are committed to supporting and welcoming individuals from all backgrounds, as we appreciate every perspective is a significant part of our success. Should you require any reasonable adjustment throughout the recruitment process, please do not hesitate to let a member of the Talent team know. If your application is successful, we will conduct relevant employment checks prior to you commencing employment with us. These will include verifying your recent employment, address, credit history, and a standard criminal record check. Note to recruiters and employment agencies: We will not pay for unsolicited CV's from recruiters and employment agencies unless we have a signed agreement and have requested assistance, in writing, for a specific vacancy.