Data Privacy Analyst – Regulatory Compliance

iwoca

. Run iwoca’s day-to-day UK data protection work and help apply UK GDPR, the Data Protection Act 2018 and PECR.

Posted 10/26/2026full-timeLondon • United KingdomMid-LevelSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in UK GDPR, Data Protection Act 2018, and PECR, with hands-on experience in data subject access requests, breach handling, and privacy assessments. Capable of providing actionable data protection advice and collaborating effectively with cross-functional teams.

Highest-signal resume keywords

UK GDPR ComplianceData Subject Access Requests (DSARs)Data Protection Impact Assessments (DPIAs)Breach HandlingPrivacy Management Platforms

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Data Protection LawPrivacy OperationsRisk AssessmentData Processing Agreement ReviewRetention and Deletion SchedulesAutomated Decision-MakingTechnical FluencyPrivacy ReportingLegitimate Interests AssessmentsICO Compliance

Soft Skills

Clear CommunicationCollaborationProblem-SolvingActionable AdviceStakeholder Engagement

Tools & Technologies

Claude CodeLLMsPrivacy Management Platforms

Certifications & Qualifications

CIPP/ECIPMICO-Recognised Practitioner Certificates

Industry Keywords

Financial ServicesFintechLendingPaymentsData Protection Act 2018PECRData (Use and Access) Act 2025

About the role

Key responsibilities & impact

Run iwoca’s day-to-day UK data protection work and help apply UK GDPR, the Data Protection Act 2018 and PECR.
Own data subject access requests from intake to response, including search scoping, exemptions and statutory deadlines.
Handle erasure, rectification and objection requests.
Triage and investigate suspected personal data breaches, assess the 72-hour notification test, and maintain the breach register.
Assist with DPIAs, legitimate interests assessments and privacy reviews for products, features, suppliers and data flows.
Provide early, actionable data protection advice to teams across iwoca.
Maintain accurate records of processing activities as the business changes.
Hold retention and deletion schedules to account.
Review supplier data processing agreements.
Help maintain data protection policies and standards.
Produce privacy reporting for senior stakeholders.
Assess AI tooling and automated decision-making across lending and operations, including personal data, lawful basis, model processing and customer rights.
Identify and address risks including decisions without meaningful human involvement, bias and unreliable model output.
Identify manual privacy-operation steps suitable for automation or AI support, assess options and specify requirements for Tech and Data teams.
Work with the Data Privacy Manager, Head of Compliance/DPO, Tech, Data, Credit, Operations and Legal; present work to senior stakeholders or the regulator.

Requirements

What you’ll need

Experience in data protection or privacy operations, or in a compliance, legal, risk or operational role where data protection was a real part of the job.
Solid practical understanding of UK GDPR, the Data Protection Act 2018 and PECR, and of how the ICO expects firms to apply them.
Familiarity with the Data (Use and Access) Act 2025 is an advantage.
Hands-on experience of some statutory privacy work, including DSARs, DPIAs, legitimate interests assessments, breach handling, ROPA maintenance or data processing agreement review.
Working understanding of how data protection law applies to AI and automated decision-making.
Technical fluency sufficient to identify automation opportunities, specify requirements, and converse with engineers.
Comfortable dealing directly with product, engineering, marketing, credit and operations teams.
Ability to give non-specialists clear, actionable answers.
Financial services or fintech experience, ideally in lending or payments, is a bonus.
Privacy or AI qualification such as CIPP/E, CIPM, or ICO-recognised practitioner certificates, or working towards one, is a bonus.
Experience using Claude Code, LLMs or privacy management platforms is a bonus.

Benefits

Comp & perks

Flexible working hours.
Medical insurance from Vitality, including discounted gym membership.
A choice between a dedicated dental plan or a health cash plan that reimburses everyday medical expenses.
A private GP service for you, your partner, and your dependents.
25 days’ holiday per year, an extra day off for your birthday, the option to buy or sell an additional five days of annual leave, and unlimited unpaid leave.
A one-month, fully paid sabbatical after four years.
Instant access to external counselling and therapy sessions for team members that need emotional or mental health support.
3% Pension contributions on total earnings.
An employee equity incentive scheme.
Generous parental leave and a nursery tax benefit scheme.
Electric car scheme and cycle to work scheme.
Two company retreats a year.
A learning and development budget for everyone.
Company-wide talks with internal and external speakers.
Access to learning platforms like Treehouse.
Offices with drinks and snacks.
Events and community-led groups, including running groups, padel, and monthly ping-pong and pool competitions.