A

Anthesis

Global ESG and decarbonization advisory

Global Compliance Manager - Data Protection Officer

Regulatory Compliance & Ethics +1Updated on Nov 13
Full-timeSpainNo salary listedHybrid

About the Job

Requirements

  • At least 5 years of experience in a global or multi-jurisdictional compliance and/or data protection role.
  • Strong, demonstrable expertise in data protection, including GDPR and international frameworks.
  • Experience drafting, governing, and monitoring policies.
  • Ability to advise senior stakeholders independently.
  • Excellent written and spoken English.

Responsibilities

  • Maintain and develop the Group's compliance policies covering anti-bribery and corruption, anti-fraud and tax evasion, anti-money laundering, whistleblowing, code of conduct, conflicts of interest, and gifts and hospitality; own the policy inventory and control matrix, monitor adherence, and report to leadership.
  • Run risk-based client onboarding and ongoing due diligence, verify beneficial ownership, and perform anti-money-laundering checks.
  • Support screening clients and counterparties against UK, EU, US OFAC, and UN sanctions lists; consider red flags and maintain awareness of export-control considerations.
  • Deliver compliance and data protection training and embed a culture of compliance across the business.
  • Work with Legal, IT and Technology, Finance, People and Development, and business lines, and support internal and client audits.
  • Work with external legal counsel on compliance and data protection matters.
  • Support ISO 27001 certification and surveillance audits, as well as relevant client or SOC audits, by providing privacy evidence, maintaining privacy controls in the ISMS, and working with the Cyber Risk and Compliance team.
  • Lead global privacy compliance under UK and EU GDPR, US state privacy laws, and other applicable regimes, including vendor and third-party due diligence and data processing agreements.
  • Serve as the named Data Protection Officer where registration is required and as a point of contact for supervisory authorities and data subjects.
  • Develop group-wide policies and procedures to implement global data protection compliance.
  • Provide data protection advice to Technology, People and Development, Marketing, and Finance.
  • Maintain the Record of Processing Activities and other mandatory registers and documentation required by applicable data protection law.
  • Create and provide privacy notices where required.
  • Handle Data Subject Access Requests, liaising with the Technology and IT team where relevant.
  • Advise on data breaches and incidents where relevant.
  • Create and deliver data protection training where relevant.
  • Review data protection-related contractual requirements, including processor data processing agreements required for GDPR compliance.
  • Conduct Data Protection Impact Assessments where relevant.
  • Implement intergroup data transfer agreements to meet international data transfer requirements.
  • Review data protection and privacy questionnaires for onboarding, requests for proposals, and annual reviews.
  • Perform due diligence on potential processors that engage Anthesis Global and use its personal data.
  • Represent data protection on the AI Governance Committee.
  • Act as the privacy and compliance contact for client due diligence, third-party risk management, and contractual negotiations on data protection, data deletion, subprocessors, and AI use clauses.
  • Support the Acceptable Use of AI Policy, AI capability inventory, and AI risk assessments; advise on EU AI Act deployer obligations, client disclosure and consent requirements for AI use, and client questions about AI-related data retention and deletion.
  • Provide data protection input to the Cyber Security Working Group.
  • Contribute to the Group data governance programme, including data classification, retention and deletion policy and process, and client data segregation, in partnership with IT and Legal.
  • Own and maintain the Group Data Protection Policy and lead the Data Privacy Team, including coordinating any Deputy DPO or privacy support roles.
  • Ensure technology platforms, systems, applications, and integrations embed privacy-by-design controls, including access, encryption, and logging, aligned with privacy regulations.
  • Identify, assess, and mitigate privacy risks from technology platforms and track them within ISMS risk registers.
  • Ensure business continuity and disaster recovery plans protect personal data confidentiality and integrity while maintaining availability during disruptions and crises.
  • Ensure privacy impact assessment, breach containment, secure recovery, and post-incident remediation are included in incident and business continuity playbooks.
  • Ensure vendors and service providers meet data privacy requirements, including tested recovery capabilities and contractual privacy safeguards.

Desired Qualifications

  • A legal qualification; it is a plus but not essential, and compliance professionals from non-legal backgrounds are welcome.
  • Additional languages.
  • Privacy or compliance certifications.
  • Familiarity and comfort with technology systems and AI.
  • Detail-oriented and pragmatic approach.

About the Company

Anthesis

Global ESG and decarbonization advisory

Anthesis is a global sustainability consultancy that helps organizations meet environmental, social, and governance (ESG) goals. It offers services in carbon strategy, sustainable finance, supply chain transparency, and net-zero decarbonization, delivered through advisory, digital tools, and educational programs. How it works: the company provides data-driven consulting, develops practical action plans, and uses software to monitor progress, enabling clients to set targets, implement decarbonization measures, and report on ESG metrics. How it differs: it combines expert advisory with digital solutions and training for a broad client base (corporations, governments, nonprofits), delivering end-to-end support from strategy to implementation rather than just recommendations. Its goal is to help clients reduce climate impact, improve resource efficiency, and advance social equity, building a more sustainable and resilient future.

Company size
501-1,000
Company stage
Not listed
Total funding
Not listed
Headquarters
London, United Kingdom
Founded
2013

Recently Posted Jobs

Explore more opportunities at Anthesis

See more jobs