Senior data protection officer

Band 8c · Data protection officer · 644 job evaluation points

The data protection officer for a large organisation or a group of organisations that share a DPO, leading the data protection function and setting its standards.

Responsibilities

Act as the statutory DPO for a large organisation or a group of care organisations.
Lead the data protection function, its staff, and its work programme.
Set the data protection framework and standards across the organisation or group.
Give the final advice on the highest-risk processing, such as large-scale data linkage and AI.
Lead engagement with the regulator, partners, and patient and public groups on data use.
Report to the board on data protection risk, compliance, and public trust.

Skills

Skill	Expected level	What this level means
Information governance and data protectionThis reference	Expert (4)	You can: set information governance policy and strategy advise the board on information risk and compliance represent the organisation with regulators and partners
Data protection impact assessmentThis reference	Expert (4)	You can: set the organisation's data protection impact assessment process and standards give the final advice on the highest-risk processing, such as large-scale data sharing or AI consult regulators where the law requires it
Information governance assurance and auditThis reference	Expert (4)	You can: own the organisation's information governance assurance framework report assurance and compliance to the board and its committees set improvement priorities based on risk
Confidentiality and information sharingThis reference	Expert (4)	You can: act as the senior adviser on confidentiality for the organisation resolve the most difficult disclosure decisions set the framework for sharing information with partners
Corporate governance and complianceThis reference	Practitioner (3)	You can: run the governance cycle for boards and committees review policies and advise on compliance
Organisational risk managementThis reference	Practitioner (3)	You can: run the risk process for a directorate or programme assess risks against the risk appetite and escalate them report on risks to committees
People managementThis reference	Practitioner (3)	You can: line manage a team, setting objectives and running appraisals support wellbeing and manage attendance, performance, and conduct plan the team's development and succession
Data ethics and privacyUK GDaD PCF	Expert (4)	You can: oversee compliance with data ethics standards and legislation across the organisation develop, manage and continuously improve an ethical framework within your area develop a data ethics culture, influencing others to act on it ensure data ethics is applied appropriately when formulating, implementing and evaluating organisational policies and programmes
Leadership and guidanceUK GDaD PCF	Practitioner (3)	You can: make decisions characterised by medium levels of risk and complexity and recommend decisions as risk and complexity increase build consensus between services or independent stakeholders identify problems or issues in the team dynamic and rectify them engage in varying types of feedback, choosing the right type at the appropriate time and ensuring the discussion and decision stick bring people together to form a motivated team and help create the right environment for a team to work in facilitate the best team makeup depending on the situation

Typical qualifications and experience

A recognised professional qualification in data protection, or equivalent experience.
Extensive experience as a data protection officer in a large or complex organisation.

Band 8c outline

Knowledge: Expert knowledge, and wide organisational and sector understanding.
Autonomy: Sets strategy for a function; accountable to a director.
Scope: A function or department.
Leadership: Leads a function through several management layers.
Accountability: A function's performance, workforce, and budget.

Job evaluation (illustrative)

Factor	Level	Level summary	Points
Communication and relationship skills	6	Gives highly complex, highly contentious information where there are significant barriers to acceptance, using the highest level of communication skills.	60
Knowledge, training, and experience	7	Highly developed specialist knowledge across the range of the specialism (master's level or equivalent).	196
Analytical and judgemental skills	5	Judgements on highly complex facts or situations needing analysis, interpretation, and comparison of options.	60
Planning and organisational skills	5	Forms long-term strategic plans, with uncertainty and effects across the organisation.	60
Physical skills	2	Skills gained through practice, such as standard keyboard use or driving.	15
Responsibility for patient and client care	1	Helps patients, clients, or relatives during incidental contact.	4
Responsibility for policy and service development	5	Implements and develops a range of policies or services for a directorate.	45
Responsibility for financial and physical resources	3	Authorises payments, buys some assets or supplies, monitors or holds a delegated budget, or maintains assets.	21
Responsibility for people	4	Line manages a function or department, designs training programmes as a main duty, or delivers a full range of HR services.	32
Responsibility for information resources	6	Manages and develops information systems across the organisation as the main duty.	46
Responsibility for research and development	2	Regularly does research, development, trials, or equipment and system testing as part of the job.	12
Freedom to act	6	Interprets overall policy and strategy to set goals and standards.	60
Physical effort	1	Sitting, standing, and walking, with little physical effort.	3
Mental effort	3	Frequent concentration on unpredictable work, or occasional prolonged concentration.	12
Emotional effort	2	Occasional exposure, or frequent indirect exposure, to distressing circumstances.	11
Working conditions	2	Occasional unpleasant conditions, frequent travel or outdoor work, or near-continuous screen use on most days.	7
Total (Band 8c: 630 to 674)			644

Information resources is scored at level 6 because the job oversees how personal data is processed across the whole organisation or group.