Privacy and Data Protection Manager

We are looking for an individual to take a lead role in our Data Protection team. The team is based in the Glasgow HQ and provides oversight and influence over privacy and data protection of the whole Arnold Clark business and its subsidiaries.

We are a mature enterprise with over 12.5k employees, we sell more than 300,000 cars a year and have over 200 locations stretching from Elgin down to Exeter. We are after an individual who is ready to step up in their current role and lead privacy work at scale, however, support of the Data Protection Officer (DPO) and Chief Information Officer (CISO) will be offered, and a great team is already in place.

We offer:

Hybrid working - on average two days per week in one of our offices (Hillington or Kilbirnie Street in Glasgow)

Bi-annual bonus

33 days' holiday allowance with room to grow

Access to training opportunities to grow and develop skills

Private healthcare

Generous retail discounts

Maternity and paternity packages

and much more!

Hours

Full time: Monday - Friday, 37.5 hours per week

About the role

Reporting to our CISO, you will play a vital role in protecting the personal data in our custody, while helping to provide an excellent service and commercial offering to our customers. You will work closely with colleagues across various functions and businesses in the Group, as well as suppliers, to ensure we follow the applicable laws and regulations, and working alongside cyber security colleagues make sure relevant data protection controls are in place and effective. Day-to-day duties

Be the face of privacy and data protection in the business. Liaise with data owners and champions across the business.

Leading the team on the triage of privacy governance and compliance-related matters.

Develop and deliver targeted training programmes for data owners and champions in Group policies, principles and practices.

Oversee the correctness and completeness of our records of data processing activities.

Ensure that we follow applicable laws and regulations.

Oversee enforcement of data processing controls in the group.

Essential skills and experience

Strong background in advising on personal data processing activities at a commercial B2C and/or B2B organisation and handling the personal data of customers or consumers

Strong working knowledge of the Data Protection legislations including Data (Use and Access) Act 2025 as well as PECR and their implication on retail business

Experience with privacy impact assessments (PIAs), data protection impact assessments (DPIAs), and Records of Processing Activities (ROPAs)

Working knowledge of key international data transfer laws

Leadership and influence skills (prior managerial experience is not required provided these skills can be evidenced)

Excellent people and communication skills and an ability to explain complex requirements in understandable terms

Strong analytical and problem-solving skills

Coaching skills

Good working knowledge of office productivity packages (word processing, presentations, basic data analytics)

The ability to use your initiative and take a hands-on approach

Relevant level of understanding of digital technologies

Nice to have but not essential

No formal education is required for this role provided extensive experience in the field can be evidenced.

Qualifications such as CIPP/E and CIPM are desirable but not required.

Our Culture

Arnold Clark is committed to creating a diverse and inclusive workplace. We strive to create an environment where collaboration, unique perspectives and multiple approaches are celebrated. We care about our employees and our communities, we nurture talent and encourage ambition, and we are passionate about people who take pride in their work. Our employees are at the heart of everything we do - diverse in our make-up, united in our goals.

To find out more about Life at Arnold Clark , visit our website.

Employment within the Arnold Clark Group is offered subject to satisfactory reference and disclosure check.