Data Protection Manager/Lawyer

The postholder will lead the firm's global operational response to data subject rights requests and data protection and privacy-related complaints, primarily arising from client matters.

Working closely with the Head of Data Protection, Data Protection Lawyer and Data Protection Officer, the postholder will oversee the end-to-end management of requests and complaints and supervise the Data Protection Analysts and any supporting paralegal or temporary resource. The role may also provide advice on partner and employee rights requests, although these are generally managed separately.

The postholder will be responsible for triage, response strategy, quality assurance and risk assessment, ensuring matters are handled consistently, efficiently and in accordance with applicable legal and regulatory requirements.

A key focus of the role will be reviewing and enhancing the existing rights request and complaint-handling framework and developing a scalable and sustainable global operating model across APAC, MEA and Europe.

The role requires strong judgement and investigative skills, together with an in-depth understanding of data protection and privacy law, privilege, client confidentiality and litigation.

• Lead the end-to-end management of data subject access requests (DSARs) and other data subject rights requests, supervising analysts and supporting resources as required.
• Oversee initial triage and assessment, including scope, complexity, legal and regulatory risk and resourcing requirements.
• Determine and direct response strategies, particularly where matters involve litigation, regulatory considerations or reputational risk.
• Direct searches for relevant information and provide second-level review and quality assurance of outputs and redactions, leading document review exercises where necessary.
• Assess the application of exemptions and restrictions, proportionality, identity verification requirements and statutory timescales.
• Review and approve final response packs, correspondence and response letters, escalating novel, complex or high-risk legal matters where appropriate.
• Maintain accurate records and audit trails to demonstrate compliance with legal requirements and internal procedures.
• Lead the investigation and resolution of data protection and privacy-related complaints from initial assessment through to closure.
• Conduct factual investigations and gather evidence from relevant stakeholders where required.
• Assess findings, document conclusions and make recommendations to the Head of Data Protection.
• Review and approve final complaint responses and related communications.
• Manage communications with complainants, including contentious, sensitive or escalated matters.
• Escalate significant risks and issues where appropriate, identifying lessons learned and recommending remedial or preventative actions.

Governance, Process Improvement and Global Programme Development

• Review and enhance existing rights request and complaint-handling processes and controls.
• Support the design and implementation of a sustainable and scalable global operating model for rights requests and complaints.
• Develop and maintain standard operating procedures, playbooks, guidance and templates.
• Identify opportunities for automation, workflow optimisation and improved use of technology.
• Lead the implementation and development of rights request and complaint-handling processes across APAC and MEA, followed by expansion across Europe.
• Develop management information, reporting frameworks and performance metrics to monitor effectiveness, risk and service delivery.
• Analyse trends to identify recurring issues, emerging risks and opportunities for continuous improvement.
• Support the training and development of analysts and other colleagues involved in rights request and complaint handling.