Data Privacy Manager

• Join Zopa, the UK digital bank that built the world’s first peer-to-peer lending company, in a permanent hybrid role in London. • Lead the Data Privacy function within Operational Risk & Compliance, serving the whole of Zopa. • Help teams across the business make confident, well-reasoned decisions about customer data. • Manage a Data Privacy Associate and partner with product, technology, legal, risk, security and commercial colleagues. • Evolve a privacy capability that is rigorous where it needs to be and practical everywhere it can be. • Help build the function’s PCI DSS capability over time.

• Bring deep practical knowledge of UK GDPR, the Data Protection Act 2018 and wider UK privacy regulation. • Apply privacy law proportionately and give pragmatic, business-enabling advice in a commercial environment. • Make and defend risk-based decisions, including challenging interpretations where commercial impact outweighs the real privacy risk. • Show experience helping develop a data protection function in an organisation with evolving privacy maturity. • Design and implement governance frameworks covering DPIAs, privacy by design, retention, ROPA and third-party due diligence. • Manage data breaches and privacy incidents end to end, including ICO notification where required. • Handle data-subject rights requests with quality, timeliness and defensible decisions. • Build credibility with business, technology, legal, risk and security stakeholders. • Lead and develop high-performing teams with accountability and continuous improvement. • Commute to the London office 2–3 days a week.

• Bring hands-on PCI DSS knowledge and a desire to help build this capability across the function. • Understand PCI DSS requirements and how they apply in financial services or payments. • Assess cardholder-data flows, scope boundaries and control gaps as part of broader data-risk reviews. • Show experience contributing to PCI DSS compliance programmes. • Understand how privacy obligations interact with FCA and PRA expectations in regulated financial services. • Influence senior executives comfortably and handle challenging conversations. • Bring exposure to another risk discipline, such as compliance or operational risk. • Show experience using OneTrust to manage data privacy obligations.

• Advise product and business teams on the privacy implications of new products, changes and customer journeys. • Translate UK privacy law into clear, proportionate recommendations that enable responsible decisions. • Develop the data privacy governance framework, covering DPIAs, privacy by design, retention, ROPA and third-party diligence. • Manage complex privacy incidents, including regulatory notification and contact with affected individuals. • Oversee high-quality, timely handling of DSARs, erasure requests and objections. • Build trusted partnerships across technology, legal, risk, security and commercial functions. • Develop your direct report and strengthen privacy awareness across the business. • Contribute to the bank’s approach to data risk across a broad range of business activity.

• Work in a hybrid setup with 2–3 days a week in the London office. • Work from abroad for up to 120 days a year, subject to having the right to work in that country. • Enjoy a culture that values good work-life balance and flexible ways of working. • Get everything you need to thrive at work and at home from day one. • Join one of the UK’s top three Most Loved Workplaces. • Help shape the bank’s privacy capability and build out PCI DSS expertise. • Request reasonable adjustments during the hiring process.

Zopa launched in 2005 as the world’s first peer-to-peer lending company and went on to launch Zopa Bank in 2020. The bank sets out to do the opposite of what customers dislike about traditional finance, putting people at the centre of its products. Zopa has won multiple industry awards, employs people from nearly 50 nationalities, and has been named among the UK’s top three Most Loved Workplaces.