Data Protection Analyst

Job Title: Data Protection Analyst

Function: D & T - Data Services

Location: Hybrid working based in one of our offices (Nottingham, Alfreton, Daresbury, Sheffield or Wakefield) plus occasional travel to Nottingham for meetings.

Contract type: FTC – 6 months

Due to the urgent nature of this requirement, we are seeking candidates who can start immediately or are subject to a maximum 4-week notice period.

Salary: £37,502

Closing Date: Monday 31 August 2026

NHS Supply Chain currently has an opportunity for a Data Protection Analyst to join our Data Services team. We are seeking an experienced Data Protection and Risk professional to play a key role in strengthening our privacy governance framework. This position will focus on analysing Records of Processing Activities (RoPA), identifying and assessing privacy risks, and supporting the development of robust data protection controls. Working closely with stakeholders across the organisation, you will help ensure compliance with UK GDPR requirements while driving improvements in data governance, risk management, and regulatory assurance.

Every day you will…

RoPA Analysis and Risk Assessment

• Review and analyse existing Records of Processing Activities to identify privacy risks, control gaps and improvement opportunities.
• Develop a repeatable approach for assessing privacy risks associated with processing activities.
• Assess the completeness, quality and consistency of existing RoPA records.

• Assess lawful basis, retention requirements, data-sharing arrangements, international transfers, and processing purposes recorded within the RoPA.

• Produce recommendations to improve governance, data quality and ongoing maintenance of Records of Processing Activities.
• Support the alignment of RoPA records with other governance artefacts, including the IT Service Catalogue.

• Produce risk reporting and management information derived from RoPA analysis.

Data Protection Risk Management

• Conduct privacy risk assessments and support Data Protection Impact Assessments (DPIAs).
• Identify and evaluate data protection risks arising from business processes, systems, projects, and third-party arrangements.
• Maintain privacy risk registers.

What can we offer you? 

We want to reward you for your passion, enthusiasm, and hard work so we offer much more than a competitive salary: 

• Hybrid working opportunities, giving you the flexibility to work collaboratively in the office and remotely.   

• We recognise our employees' hard work and contributions with annual bonus schemes, long service, and colleague recognition awards.  

• 27 days holiday plus bank holidays 

• We are dedicated to your development, through in-house training, support, and access to external qualifications to maximise your potential. 

• A focus on your well-being offering 1 day of paid well-being leave and free access to the 24/7 Employee Assistance Programme 

• Generous pension scheme (with us contributing 12% when you contribute 6%) 

• Access to our Flexible Benefits Scheme, where you can choose from a variety of benefits such as Life Insurance, Critical Illness Cover, Income Protection, Health Cash Plan, Dental Insurance, and additional pension contributions that suit you. 

• 2 days of paid volunteering leave allowing you to give back to your community.  

• Access to many discounts from the Blue Light Card to NHS Discounts. 

NHS Supply Chain, who are we?

Our role is to support the NHS to save lives and improve health. We are a part of the NHS family, and our role is to source, deliver and supply healthcare products, services and food for NHS trusts and healthcare organisations across England and Wales.  

We serve every NHS Trust and operate a national network of distribution centres, managing relationships with more than a thousand suppliers and delivering more than 8,000,000 orders each year to more than 17,000 locations. Doing all of this on behalf of the NHS gives NHS staff more time to focus on their main priority of providing excellent patient care. 

What skills will help you thrive in this role?   

• 3+ years' experience working within a Data Protection, Information Governance, Risk Management or Compliance function, including the identification, assessment and management of risk.
• Excellent working knowledge of UK GDPR and Data Protection principles and regulatory frameworks
• Experience supporting privacy risk assessments, DPIAs, risk reviews or similar governance activities.
• Strong analytical, reporting, and stakeholder management skills.
• Ability to translate regulatory requirements into practical business controls.

Our Inclusive Commitment

At NHS Supply Chain, we are committed to building an inclusive environment where difference is not only valued, but celebrated, giving everyone the opportunity to thrive in their career. Developing our people is key to our success, so if this role sounds like the right next step in your career but your experience doesn’t match perfectly with the job advert, we encourage you to still apply.  

Struggling to complete our application form, and require additional support? Reach out to our Talent Acquisition team at careers@supplychain.nhs.uk who will be happy to help you with alternative ways to apply.