Global Compliance Manager & Data Protection Officer

Department: Enabling : Legal and Insurance

Employment Type: Permanent - Full Time

Location: Spain

Description

Key Responsibilities

• Compliance framework & policies: Maintain and develop the Group's compliance policies (e.g. anti-bribery & corruption, anti-fraud & tax evasion, AML, whistleblowing, code of conduct, conflicts of interest, and gifts & hospitality). Own the policy inventory and control matrix; monitor adherence and report to leadership. 
• Know Your Client (KYC) / due diligence & AML: Run risk-based client onboarding and ongoing due diligence, beneficial-ownership verification, and anti-money laundering (AML) checks. 
• Sanctions: Support in the screening of clients and counterparties against UK, EU, US (OFAC) and UN sanctions lists; consider red flags; maintain awareness of export-control considerations. 
• Training & culture: Deliver compliance and data protection training; embed a culture of compliance across the business. 
• Cross-functional partnering: Work closely with Legal, IT&Tech, Finance, People & Development and the business lines; support internal and client audits. 
• Working with external legal counsel on compliance and data protection matters 
• ISO 27001 & audit support: Support ISO 27001 certification and surveillance audits (and client or SOC audits where relevant) by providing privacy evidence, maintaining privacy controls in the ISMS and working with the Cyber Risk & Compliance team. 

• Lead global privacy compliance (UK & EU GDPR, US state privacy laws, and other applicable regimes).  vendor/third-party due diligence and data processing agreements (DPAs). 
• Named DPO where registration required and serve as point of contact for supervisory authorities and data subjects 
• Development of group-wide policies and procedures required to implement global data protection compliance 
• Data Protection advisory for Technology, P&D, Marketing, Finance, 
• Maintenance of Record of Processing Activities (ROPA) and other mandatory registers and documentations under relevant data protection law 
• Creation and provision of privacy notices where required 
• Handle Data Subject Access Requests, liaising where relevant with Tech/IT Team 
• Advise on data breaches/incidents where relevant  
• Creation and delivery of data protection training where relevant 
• Review of data protection relevant contractual requirements (including, but not limited to, mandatory processor DPAs for GDPR compliance) 
• Conducting Data Protection Impact Assessments where relevant 
• Implementing Intergroup Data Transfer agreements to ensure compliance with international data transfer requirements 
• Review of data protection/privacy questionnaires and similar as part of onboarding, RfP, annual review etc. 
• Due Diligence on potential processors that engage AG and use AG personal data 
• Data protection representative on the AI Governance Committee 
• Act as the privacy and compliance contact for client due diligence, third-party risk management (inbound and outbound) and contractual negotiations on data protection, data deletion, sub-processors and AI use clauses 
• Support the Acceptable Use of AI Policy, the AI capability inventory and AI risk assessments; advise on EU AI Act deployer obligations, client disclosure and consent requirements for AI use, and AI-related data retention and deletion queries from clients 
• Data protection input on Cyber Security Working Group 
• Contribute to the Group data governance programme, including data classification, retention and deletion policy and process, and client data segregation, working with IT and Legal 
• Own and maintain the Group Data Protection Policy and lead the Data Privacy Team, including coordination with any Deputy DPO or privacy support roles 
• Any other relevant data protection requirements 

• Privacy-by-design across technology platforms – ensures all systems, applications, and integrations embed data protection controls (access, encryption, logging) aligned with privacy regulations. 
• Personal data risk ownership in technology landscapes - identifies, assesses, and mitigates privacy risks arising from technology platforms are tracked within ISMS risk registers. 
• Data availability and protection in business continuity plan and disaster recovery - ensures business continuity and disaster recovery plans protect personal data confidentiality and integrity while maintaining availability during disruptions and crisis scenarios. 
• Breach, resilience, and recovery oversight - ensures privacy impact assessment, breach containment, secure recovery and post-incident remediation are built into incident and business continuity playbooks. 
• Third-party technology and resilience assurance - ensures vendors and service providers meet data privacy requirements, including tested recovery capabilities and contractual privacy safeguards.

Required experience & skills

• Minimum 5 years' experience in a global / multi-jurisdictional compliance and/or data protection role. 
• Strong, demonstrable data protection expertise (GDPR + international frameworks). 
• Policy drafting, governance and monitoring experience. 
• Able to advise senior stakeholders independently; detail-oriented and pragmatic. 
• Excellent written and spoken English. 

• Legal qualification (a plus, not essential: strong compliance professionals from non-legal backgrounds are welcome). 
• Additional languages  
• Privacy / compliance certifications 
• Familiarity and comfort with technology systems and AI