Data Protection Analyst

In this Data Protection Analyst role, you will protect data across the Vitality Group, guiding teams on privacy matters and managing incidents. You’ll work closely with the Group Head of Data Protection to enable business momentum while safeguarding customers and people. You’ll assess risks, lead audits, and embed privacy by design into operations and strategy. This is a chance to shape Vitality’s data protection framework and improve governance in a high-privacy, regulated environment.

• Bonus schemes
• Pension up to 12% with 6% matched
• Vitality health insurance with rewards
• Life assurance (four times annual salary)
• Flexible working arrangements
• Hybrid work model (#LI-Hybrid)

• Provide authoritative data protection advice across the business and translate regulatory requirements into practical solutions
• Lead data protection health checks and audits, identify material risks, drive remediation and escalation
• Oversee data protection incidents, ensuring breach handling per Group requirements
• Own Data Subject Rights requests, including complex cases, ensuring regulatory obligations are met
• Assess privacy risks from new activities and projects, including PIAs and mitigating controls
• Influence stakeholders to embed privacy in decision-making and operations
• Develop and improve Vitality’s data protection framework, policies, processes, and controls
• Develop and deliver data protection training and guidance; enhance privacy accountability
• Produce privacy reporting and root cause analysis to identify trends and escalation needs

• Extensive working knowledge of UK and EU GDPR and the UK Data Protection Act 2018
• Strong experience in managing data protection breaches and incidents
• Proven experience handling Data Subject Rights requests, including complex cases
• Ability to interpret regulatory requirements and resolve complex privacy queries
• Strong judgement and problem-solving in a complex organisation
• Proven ability to influence and challenge stakeholders across levels of the business
• Ability to assess privacy risk and balance compliance with commercial needs and customer experience
• Experience in regulatory, operational or conduct risk within FCA or PRA-regulated financial services (advantageous)

• Influencing and stakeholder management
• Strong judgement and problem-solving
• Cross-functional collaboration
• UK and EU GDPR
• UK Data Protection Act 2018
• Privacy Impact Assessments