About this role
Job summary
NHS England (NHSE) is responsible for comprehensive and sensitive collections of health and care data, supporting decisions and services that affect citizens across England. It has a critical role in commissioning, delivering and overseeing the data and digital systems that connect the NHS, effective data protection, privacy and public trust are fundamental.
Given the scale and importance of the data NHSE is responsible for, the Deputy Director for Data Protection and Trust who is also the Data Protection Officer is a key role. The Deputy Director provides independent advice and challenge, helping NHSE to make decisions about data and technology while protecting individuals, meeting legal responsibilities and maintaining public trust.
The Deputy Director is responsible for the Data Protection & Trust team which supports them with their DPO statutory and wider functions, including the provision of information governance (IG) advice, guidance, and incident management support across the NHS. The Data Protection & Trust team sits within NHSE's Privacy, Transparency and Trust (PTT) sub-directorate which provides privacy and IG support to NHSE and the wider NHS. Other teams in PTT include IG Delivery, who help to embed privacy by design in all of our data processing, and IG Risk and Assurance who provide assurance and risk management support, including for the Senior Information Risk Officer. The DPO reports to the Director for Privacy and Information Governance who leads PTT.
Main duties of the job
Act as NHS Englands senior independent data protection adviser, advising and challenging executive leaders, major programmes and national digital, data and technology services on UK GDPR, the Data Protection Act 2018, common law confidentiality and privacy requirements.
Provide independent judgement on novel uses of health data, artificial intelligence, analytics and information sharing involving complex legal, operational and public-interest considerations.
Lead the data protection response to major cyber and security incidents, assessing risks to individuals, advising on mitigation and notifications, and working with Cyber Security, Legal, Clinical and Communications.
Lead the team delivering statutory data protection services, national privacy and information governance advice, guidance and training, ensuring rights requests, complaints and incidents are handled effectively.
Set NHS Englands strategic direction through privacy and data protection policies, standards, guidance and assurance, while promoting awareness.
Influence major decisions while maintaining DPO independence, supporting lawful approaches and challenging or escalating where risks require it.
Provide assurance over DPIAs, transparency, information rights, breaches, data sharing and wider privacy and information governance.
Lead and develop an inclusive, high-performing Data Protection and Trust Team, contribute to the PTT Senior Leadership Team and support the Director through change.
About us
NHS England has a wide range of statutory functions, responsibilities and regulatory powers. These are focused on supporting the wider NHS to deliver high quality care, as well as doing those things that are best done once for the whole NHS.
Our staff bring expertise across clinical, operational, commissioning, technology, data science, cyber security, software engineering, education, and commercial specialisms -- enabling us to design and deliver high-quality NHS services.
In March 2025, the Government announced that NHS England and the Department of Health and Social Care will increasingly merge functions, ultimately leading to NHS England being fully integrated into the department.
If you currently work within the NHS and if successful at interview, we will initiate an Inter Authority Transfer (IAT) via the Electronic Staff Record (ESR).This retrieves key data from your current or previous NHS employer to support onboarding, including competency status, Continuous Service Dates (CSD), and annual leave entitlement. You may opt out at any stage of the process.
Colleagues with a contractual office base are expected to spend, on average, at least 40% of their time working in our offices.
Staff recruited from outside the NHS will usually be appointed at the bottom of the pay band.
We cannot offer visa sponsorship for any vacancies.
Job description
Job responsibilities
You can find further details about the job, organisational structure, recruitment profile, expected outcomes and benefits information in the attached Job Description and other supporting documents.
Important: Please be aware there are residency requirements you need to meet:
All NHS England Deputy Director for Data Protection and Trust personnel must hold SC security clearance as a minimum.
To meet National Security Vetting requirements, SC clearances require 5 years continuous UK residency. In certain cases, this can be reduced to three years continuous UK residency, with additional overseas checks for the previous two years.
Candidates who were posted abroad for service with HM Government, Armed Forces or within a UK government role - will still be considered.
Please make sure you meet these requirements before applying for this role.
You dont need to have SC security clearance already, however, failure to achieve the requirements for SC clearanceafter offer, will result in the job offer being withdrawn.
For further advice please check https://www.gov.uk/government/publications/united-kingdom-security-vetting-clearance-levels/national-security-vetting-clearance-levels#security-check-sc or contact [email protected].
Person Specification
Qualifications
Essential
- Educated to master's degree level or able to demonstrate equivalent senior-level professional knowledge and experience relevant to data protection, privacy, information law and information governance.
- Hold a recognised practitioner-level qualification in data protection or privacy, such as BCS/ISEB Practitioner Certificate in Data Protection, CIPP/E, PDP Practitioner Certificate in Data Protection, or another demonstrably equivalent professional qualification.
- Evidence of substantial continuing professional development in data protection and privacy, demonstrating current and expert knowledge of UK GDPR, the Data Protection Act 2018, the common law duty of confidentiality and the wider legal and regulatory framework relevant to a senior Data Protection Officer.
Desirable
- Additional relevant qualification in law, AI governance, data ethics, cyber security or a related discipline.
Knowledge
Essential
- Extensive knowledge of being in the role of the Data Protection Officer, UK GDPR, Data Protection Act 2018, confidentiality and wider information governance legislation, standards and best practice.
- Extensive knowledge and the practical application of key data protection, information governance and confidentiality rules including privacy by design, DPIAs, data protection principles, lawful processing, automated decision making, accountability, transparency and individual rights.
- Extensive knowledge of applying data protection, information governance and confidentiality rules to large scale technology and data driven processes, services, and information systems including to AI technologies.
- Extensive knowledge of data security requirements in the handing of data, and organisational governance processes for managing privacy risks in large complex data driven organisations.
Desirable
- A deep knowledge and understanding of the NHS 10 Year Plan and the role digital and data driven services and systems play in the transformation of health and social care.
Skills and Experience
Essential
- Extensive experience leading and /or advising on creating an environment for success, through the development of high-performance teams with the right mix of skills, encouraging equality, diversity and an inclusive culture, allowing people to be their authentic self at work. Proactively looks for opportunities to celebrate and share success.
- Extensive experience of providing deep subject matter expertise in privacy/data protection/transparency/ethics on a range of highly complex and strategic matters and effectively communicating to internal and external stakeholders, including to Senior Leadership Teams, Executive Management Team and Committees of the Board.
- Extensive experience of assessing and responding to organisational wide potential data breach incidents; including on-going advice, guidance, recommendations, and the drawing up and monitoring of resultant action plans.
- Extensive experience working with diverse groups of stakeholders solving their problems, adding value to their operating environment, coping under pressure, managing conflicting priorities and resolving complex challenges.
Desirable
- Experience of working in a health and/or social care organisation.
Disclosure and Barring Service Check
This post is subject to the Rehabilitation of Offenders Act (Exceptions Order) 1975 and as such it will be necessary for a submission for Disclosure to be made to the Disclosure and Barring Service (formerly known as CRB) to check for any previous criminal convictions.
Employer details
Employer name
NHS England
Address
Any NHSE Office
Nationally
LS1 4AP
United Kingdom
Employer's website
https://www.england.nhs.uk/about/working-for/ (Opens in a new tab)