Deputy data protection officer

Band 8a · Data protection officer · 560 job evaluation points

Supports the DPO in monitoring compliance and giving advice, leads complex casework, and deputises for the DPO.

Responsibilities

Advise teams on data protection law, including lawful basis, transparency, and individual rights.
Review high-risk data protection impact assessments and draft the DPO's advice.
Monitor compliance through audits, spot checks, and reviews of records of processing.
Lead the investigation of serious data breaches and prepare notifications to the regulator.
Handle complex complaints and requests from individuals about their data.
Deputise for the DPO with senior leaders and the regulator.

Skills

Skill	Expected level	What this level means
Information governance and data protectionThis reference	Expert (4)	You can: set information governance policy and strategy advise the board on information risk and compliance represent the organisation with regulators and partners
Data protection impact assessmentThis reference	Practitioner (3)	You can: review and advise on data protection impact assessments for complex systems judge whether risks are acceptable and recommend controls decide when to escalate high risks for senior or regulator review
Information governance incident managementThis reference	Practitioner (3)	You can: investigate serious incidents and find their root causes decide, with senior colleagues, whether to notify regulators and people affected share lessons and track improvements
Information rights requestsThis reference	Practitioner (3)	You can: handle complex or sensitive requests, including those involving third parties apply exemptions and decide what to withhold, with clear reasons manage internal reviews and complaints about responses
Information governance assurance and auditThis reference	Practitioner (3)	You can: plan and run the information governance assurance programme judge whether evidence meets the standard and identify gaps work with internal and external auditors
Confidentiality and information sharingThis reference	Practitioner (3)	You can: advise on complex confidentiality questions, such as sharing without consent in the public interest review information sharing agreements with partner organisations apply consent and patient objection rules to data flows
Data ethics and privacyUK GDaD PCF	Practitioner (3)	You can: work with stakeholders to identify and address ethical and privacy concerns demonstrate and communicate how data ethical issues fit into the wider organisational context research developments in data ethics and privacy to improve compliance and processes assess and constructively challenge proposed data ethics policies
Communicating informationUK GDaD PCF	Practitioner (3)	You can: work collaboratively in a group and build relationships with others identify issues through Agile 'health checks' and work with others to address them manage stakeholder expectations be flexible and capable of proactive and reactive communication host or moderate difficult discussions within the team or with senior stakeholders

Typical qualifications and experience

A recognised professional qualification in data protection, or equivalent experience.
Substantial experience of data protection in health or care.

Band 8a outline

Knowledge: Expert knowledge of a discipline and its management.
Autonomy: Interprets organisational policy for a service; sets the team's direction.
Scope: A service area or a discipline across the organisation.
Leadership: Manages a team, or leads a discipline without line management.
Accountability: A service area, its staff, and its budget.

Job evaluation (illustrative)

Factor	Level	Level summary	Points
Communication and relationship skills	5	Gives highly complex or contentious information needing developed persuasion and negotiation, presents to large groups, or communicates where there are significant barriers to acceptance.	45
Knowledge, training, and experience	7	Highly developed specialist knowledge across the range of the specialism (master's level or equivalent).	196
Analytical and judgemental skills	5	Judgements on highly complex facts or situations needing analysis, interpretation, and comparison of options.	60
Planning and organisational skills	4	Plans a broad range of complex activities or strategies, adjusting them as needed.	42
Physical skills	2	Skills gained through practice, such as standard keyboard use or driving.	15
Responsibility for patient and client care	1	Helps patients, clients, or relatives during incidental contact.	4
Responsibility for policy and service development	4	Implements policy and develops policy or services for a service or several areas.	32
Responsibility for financial and physical resources	3	Authorises payments, buys some assets or supplies, monitors or holds a delegated budget, or maintains assets.	21
Responsibility for people	3	Manages a group of staff day to day, teaches core or specialist training, or gives core HR advice.	21
Responsibility for information resources	5	Designs and develops major information systems, or runs information systems for several services as the main duty.	34
Responsibility for research and development	2	Regularly does research, development, trials, or equipment and system testing as part of the job.	12
Freedom to act	5	Works within general policies, and in most cases decides how to interpret them.	45
Physical effort	1	Sitting, standing, and walking, with little physical effort.	3
Mental effort	3	Frequent concentration on unpredictable work, or occasional prolonged concentration.	12
Emotional effort	2	Occasional exposure, or frequent indirect exposure, to distressing circumstances.	11
Working conditions	2	Occasional unpleasant conditions, frequent travel or outdoor work, or near-continuous screen use on most days.	7
Total (Band 8a: 540 to 584)			560

Deputy data protection officer

Responsibilities

Skills

Typical qualifications and experience

Band 8a outline

Job evaluation (illustrative)

Self assessment