Digital Compliance & Data Manager

We are seeking a forward-thinking Digital Compliance & Data Manager to lead, champion, and embed digital compliance and data governance across our digital ecosystem. This role holds a broad strategic focus on emerging digital and privacy regulations globally, ensuring our digital landscapes—spanning cloud platforms, web apps, AI tools, online learning portals, and internal operations—are legally compliant and appropriately structured.

As our subject-matter expert on digital compliance and data protection, you will:

• Build compliance understanding across the Foundation;
• Support the design of new products and services;
• Keep our policies and frameworks current as the law evolves.

You will balance practical, business-enabling advice with the rigor needed to protect young people, educators, staff, and supporters.

Reporting to the Senior Legal Counsel, you will collaborate with colleagues in the Legal team, Operations Division, and cross-functionally with Engineering, Product, and Data teams.

We strive to make the Foundation a place where talented people who care about our mission can thrive. Our flexible and collaborative approach ensures work-life balance and exceptional teamwork.

Key Responsibilities:

• Provide expert advice to ensure compliance with digital and privacy regulations across core markets (UK, EU, US, India, Kenya, and South Africa), embedding Privacy by Design and Default into workflows like sprint planning and design reviews. Coordinate Data Protection Impact Assessments (DPIAs) and other assessments for higher-risk processing, particularly involving children’s data, AI, and online platforms. Offer expert advice to senior stakeholders, including the Foundation’s designated Data Protection Officer.
• Track, interpret, and coordinate responses to emerging digital and privacy regulations globally. Provide clear, proportionate risk assessments on novel technologies like generative AI, cloud migrations, and automated grading/analytics systems, collaborating across the RPF Group.
• Own and continuously improve the Foundation’s information governance framework, including reviewing and iterating information security, data retention, and data privacy policies. Maintain and manage the Record of Processing Activities and organizational data map, and conduct periodic reviews of key data processors and third-party suppliers to ensure appropriate contractual protections.
• Manage data subject access requests (DSARs) in collaboration with People & Culture, and lead investigation, mitigation, and reporting procedures for potential data breaches and complaints.
• Design and deliver practical, modern compliance and data privacy training tailored to software developers, educators, researchers, and operational teams. Foster a collaborative culture of transparency and accountability, embedding compliance as a key component of digital child protection, safeguarding, and children’s digital rights.

Experience and Personal Attributes:

We welcome applications from candidates who can demonstrate some, but not all, of the following:

• A recognized data protection qualification (e.g., CIPP/E, CIPM, or equivalent legal/compliance qualification);
• Strong working knowledge of privacy regimes including UK GDPR, the Data Protection Act 2018, US legislation, and practical experience applying them;
• In-depth knowledge of children’s online privacy and familiarity with the ICO’s Age Appropriate Design Code (Children’s Code);
• Digital and technical literacy with a strong understanding of modern software paradigms, including APIs, cloud architecture (AWS/GCP), cookies/trackers, SDKs, and data pipelines (coding not required but must confidently discuss architectures with engineers);
• Experience in an international organization handling multi-jurisdictional data transfers (UK, EU, USA, India, Kenya, South Africa);
• Experience in small-medium-sized businesses and user-centred agile software development teams;
• Familiarity with compliance frameworks related to AI governance, ethical machine learning, and accessibility;
• Excellent communication skills to translate legal requirements into practical guidance for non-specialist colleagues;
• A collaborative instinct, viewing compliance as a team-owned responsibility and participating in workshops, planning sessions, and design reviews;
• Experience in the charity or edtech sectors.