Lawfront is a national legal services business supporting leading regional law firms across the UK. We are committed to delivering excellent legal services while maintaining the highest standards of data protection, compliance, and client confidentiality.
As the group continues to grow, we are seeking a full-time Data Rights & Privacy Specialist to join our Professional Standards Team. You will coordinate and manage data subject rights requests - including access and erasure requests - and data-handling complaints, helping colleagues resolve cases consistently, sensitively and within applicable deadlines.
The Role
You will manage the end-to-end handling of Data Subject Access Requests (DSARs), erasure requests and other data subject rights matters under the UK GDPR and Data Protection Act 2018, alongside complaints about the handling of personal data.
Working with the Professional Standards Team, People & Culture, IT and operational colleagues, you will coordinate searches and investigations, assess information, prepare clear responses and keep cases moving. You will balance individuals’ rights with the organisation’s legal obligations, including appropriate consideration of third-party information, retention requirements, exemptions and legal privilege.
This role suits an organised and thoughtful case-handler with practical experience of data rights or privacy casework, sound judgment, excellent attention to detail and the confidence to escalate complex or high-risk issues appropriately.
Key Responsibilities
- Own the day-to-day lifecycle of DSARs and other data rights cases, from receipt and triage through investigation, response and closure.
- Receive, log and assess requests and complaints; establish their scope, check identity or authority where appropriate, identify any need for clarification, and agree the next steps.
- Plan and coordinate proportionate searches across relevant teams, systems and records, following up to ensure information gathered is complete and within scope.
- Review documents and electronic records to identify responsive personal data and assess what should be disclosed, retained, restricted or otherwise actioned.
- Apply appropriate redactions for third-party information, privileged material and other information that should not be disclosed; record the rationale and refer uncertain or sensitive decisions for review.
- Draft clear, accurate and accessible acknowledgements, progress updates, outcome letters and disclosure packs.
- Maintain complete, accurate case records, including searches, decisions, actions, communications, deadlines and outcomes.
- Track applicable statutory and internal deadlines, flag risks early, and coordinate any permitted extensions or other timing steps with the appropriate colleagues.
- Escalate complex, sensitive or high-risk cases - including proposed refusals, exemptions, retention decisions or potential conflicts - to the Chief Risk Officer and support the review and communication of decisions.
- Manage and coordinate individual rights requests, including:
- Data Subject Access Requests (the right of access)
- Right to Erasure requests, assessing the request and coordinating any action or response with the appropriate decision-makers
- Right to Rectification requests
- Restriction of Processing requests and objections to processing
- Liaise with external legal advisers where needed and coordinate with internal stakeholders to obtain timely, consistent input.
- Handle and coordinate investigations into data protection and data-handling complaints, including concerns about the collection, use, sharing, retention or security of personal data. Gather relevant facts, maintain a clear record, support a fair response and promptly escalate any potential personal data breach or other high-risk issue under internal procedures.
- Support responses to Information Commissioner’s Office (ICO) enquiries and other regulatory matters, working with the Chief Risk Officer and relevant colleagues.
- Identify improvements to case workflows, templates, guidance and management information; help colleagues understand data rights and the organisation’s data-handling responsibilities.
Skills & Experience
Essential
- Hands-on experience managing DSARs and related data rights or privacy cases in a professional services, legal, financial services, public sector or other regulated environment, including practical involvement in erasure requests and/or data-handling complaints.
- A sound working knowledge of:
- UK GDPR, including data subject rights and the practical requirements for handling requests
- Data Protection Act 2018
- Information Commissioner’s Office guidance and regulatory expectations
- Experience reviewing substantial volumes of documents and electronic records, and coordinating searches across different teams or systems.
- Understanding of redaction and disclosure principles, third-party rights, exemptions, legal privilege and the need to consider retention obligations when assessing erasure requests.
- Strong investigative and analytical skills, including the ability to assess evidence, identify gaps and explain a reasoned outcome.
- Excellent written communication skills, with the ability to prepare clear, accurate and appropriately sensitive responses.
- Ability to manage a varied caseload, prioritise competing demands and meet strict deadlines.
- High levels of accuracy, sound judgement and attention to detail.
- Experience handling confidential and sensitive information with discretion.
- Confident using Microsoft 365 applications, particularly Outlook, Excel, Word and Teams.
Desirable
- Experience working in a law firm or legal services environment.
- Experience with case management, document management, e-disclosure or document review platforms.
- A privacy, compliance or information governance qualification (for example, CIPP/E, CIPM or a BCS/ISEB data protection qualification).
- Experience handling employment-related DSARs or other particularly sensitive requests.
- Experience supporting formal regulatory investigations or responding to complex ICO correspondence.
Personal Attributes
- Highly organised and methodical, with a reliable approach to managing case records and deadlines.
- A practical problem-solver who can exercise sound judgement and knows when to seek advice.
- Professional, empathetic and discreet when dealing with sensitive or potentially contentious matters.
- Collaborative and confident working with stakeholders at different levels.
- Resilient and calm under pressure, able to manage competing priorities.
- Committed to high standards of confidentiality, fairness and data protection.
If this sounds like something you would be interested in then please click apply to upload your CV and one of the Talent Acquisition Team will be in touch.