Data Protection Officer (DPO) & Compliance Adviser

About Griffin: Griffin is a fully regulated UK bank powering accounts and payments for product-led fintechs and platforms like Uber, Yonder, Prosper, and Sidekick. Since launching in 2024, Griffin has rapidly grown, supporting products in remittance, payroll, wealth, insurance, proptech, payments, neobanking, and more. Griffin is expanding into card issuing, stablecoin infrastructure, and agentic finance.

Our culture is built on high-trust, high-autonomy environments. We are remote-first, asynchronous, and fully flexible, allowing you to balance work and life effectively. We hire intentionally, ensuring our culture aligns with our core values.

The Team:

You will join our Service guild, working across first-line operations, sales, and product teams. As the first dedicated compliance professional, you will define and implement compliance solutions, ensuring Griffin’s products and customer outcomes remain compliant as we grow.

The Opportunity:

We aim to integrate compliance and data protection into our product design, sales, and operations. As our hands-on Data Protection Officer (DPO) and compliance advisor, you will bring regulatory expertise to our operations, commercial, and product teams. With upcoming launches like card issuing, there is plenty of opportunity to contribute.

What Success Looks Like:

In your first year, you will:

• Take ownership of our data protection agenda, identifying improvements and implementing changes.
• Provide senior leaders with an honest assessment of our compliance status.
• Engage with operations, sales, and product teams to ensure compliance enhances, rather than hinders, their work.
• Guide at least one major launch, such as card issuing, from concept to live implementation.
• Establish clear governance and outcome monitoring for live products, ensuring Protect (our second-line risk and compliance team) faces fewer surprises.

Key Responsibilities:

• Product Development: Translate regulations into clear requirements, customer journeys, Terms and Conditions, and fair value assessments, ensuring data protection is embedded from the start.

• Product Lifecycle Management: Maintain compliance of live products through periodic fair value assessments, outcome monitoring, reviews, changes, and closures.

• Sales: Assist the commercial team in evaluating potential partners’ risk appetites and reviewing sales materials.

• Marketing: Ensure marketing materials, both ours and our customers’, comply with regulations and our policies, and that financial promotions are properly challenged.

• Service (Operations): Integrate regulatory and data protection requirements into daily operations with practical procedures and controls.

• Regulatory Change: Interpret new rules and ensure the appropriate teams implement necessary changes promptly.

• Issues and Reporting: Investigate and resolve compliance issues, including personal data breaches, and report compliance risks and customer outcomes clearly.

• Working with Second Line (Protect): Collaborate early with Protect, sharing necessary evidence and acting on their challenges.

• Data Protection: As our DPO, you will:

  • Advise teams on their data protection obligations, including Data Protection Impact Assessments (DPIAs) and Transfer Risk Assessments (TRAs).
  • Monitor and audit compliance with UK GDPR, other data protection laws, and our internal policies.
  • Train colleagues and raise awareness of data protection.
  • Serve as the contact point for the Information Commissioner's Office (ICO) and individuals with data-related questions or requests.

You will report directly to our Chief Operating Officer (COO) and have the independence needed to perform your role effectively. Griffin will involve you early in any matter affecting personal data.

We expect you to shape this role. This description outlines our current needs, but how you achieve these outcomes, where you focus your efforts, and how the role evolves are up to you.

Your Background:

We seek proactive individuals who take initiative, tackle unfamiliar regulations, and provide practical, clear, and compliant solutions. You should:

• Have compliance experience in the first or second line of a UK regulated firm, preferably a bank, e-money institution, or payments firm.

• Possess practical knowledge of rules behind our products, including Consumer Duty, BCOBS, CASS, FISMA, Payment Services Regulations, Money Laundering Regulations, HMRC requirements like BBSI, and AEOI reporting.

• Have expert knowledge of data protection law and practice, including UK GDPR, Data Protection Act 2018, PECR, and the Data (Use and Access) Act 2025.

• Have hands-on experience translating regulations into practical requirements for product, sales, or operations teams.

• Adopt a curious, questioning approach, asking the right questions before signing off on anything.

• Possess the confidence to challenge issues clearly and kindly when necessary.

• Love writing, as you will contribute significantly to our written documentation, emphasizing clarity and readability.

Ideally, you would also:

• Have deep expertise in a specialist area such as payments, cards, Consumer Duty, BCOBS, financial promotions, or similar.

• Have served as a DPO or worked closely with one in a regulated firm.

• Have experience in finance or banking.

What We Offer:

• Salary: £80,000 - £90,000 (DOE)

• Remote-first flexibility: Work from anywhere in the UK

• Work from abroad: Up to 20 days a year

• Time off: 25 days’ holiday, bank holidays, and a winter break

• Share options: Own a part of what we’re building together

• Pension: Auto-enrolment into our Penfold scheme

• Insurance: Private medical with Bupa (including family cover) and life insurance with AIG

• Wellbeing: 1:1 coaching and therapy sessions available through Oliva

• Family leave: Enhanced parental leave with up to 6 months on full pay after two years’ service

• AI tools: Everyone has a Claude subscription and access to premium tools

• Setup support: We’ll support you in creating a comfortable and effective work-from-home environment

Security: As a bank, we are committed to maintaining the highest security standards. The successful candidate will need to complete background screening, including verification of right to work, criminal record, credit history, social media, and professional reference checks.