Data Privacy Specialist US

About you and the Role:

The Data Privacy Specialist will sit in Enstars Global Data Privacy team reporting to the Data Privacy Manager and working alongside colleagues in the UK and US. You will be providing day-to-day specialist data privacy advice across the Group so that personal data is handled lawfully, consistently and demonstrably in every jurisdiction in which Enstar operates. The role holder is expected to work across all disciplines of data privacy rather than specialising in specific areas and will coordinate with colleagues in other time zones.
Provide day-to-day specialist data privacy advice across the Group so that personal data is handled lawfully, consistently and demonstrably in every jurisdiction in which Enstar operates and deliver assigned workstreams of the data privacy maturity programme.

Work in a Group-wide, multi-jurisdictional role within Enstars Global Data Privacy team, reporting to the Data Privacy Manager and coordinating with colleagues in the UK, US and other time zones.
Work across all disciplines of data privacy rather than specialising in specific areas.
Escalate appropriately to the Data Privacy Manager. Legal conclusions and the acceptance of business risk remain with the Head of Data Privacy, the DPO and the relevant business owners.
Advise project teams on applying Privacy by Design and Default principles, supporting the initiative to embed them across the organisation and delivering the relevant training.

Produce privacy impact assessments (PIAs), data protection impact assessments (DPIAs) and legitimate interests assessments (LIAs), including those escalated following screening by the Analyst.
Submit completed assessments to the Data Privacy Manager for quality review, with decisions on residual risk taken by the DPO, Head of Data Privacy or business owner as applicable.
Consumer and data subject rights

~ Advise on data subject rights requests across all jurisdictions and handle complex or multi-jurisdictional cases, including those referred by the Analyst, ensuring each is recorded end to end.

ROPA, inventories and data maps

~ Maintain and update the record of processing activities (ROPA), supporting the Data Privacy Manager.

Regulatory compliance and horizon scanning

Support the Data Privacy Manager in maintaining compliance with applicable data protection legislation across all operating jurisdictions (UK GDPR, EU GDPR, US privacy laws and the Australian Privacy Act).
Monitor regulatory developments as part of the Horizon Scanning Framework.
Regulatory registrations and filings

~ Assist with regulatory registrations and filings.

Data Processing Agreements

~ Review Data Processing Agreements (DPAs) with relevant data processors and recommend changes.

International transfers and TIAs/TRAs

Assist with international data transfer mechanisms across all operating jurisdictions, ensuring they are current, properly documented and subject to regular review.
Produce transfer impact or risk assessments (TIAs/TRAs) where required, develop recommendations for the Data Privacy Managers review, and maintain oversight of cross-border data flows arising from third-party arrangements.
Assist with the handling of personal data incidents from identification to resolution.
Where required, support the DPO in the assessment and management of notifiable breaches across jurisdictions, and liaise with Information Security to align incident management processes.
Breach response testing

~ Assist with testing of the Data Breach Response Plan.

Training and awareness

~ Design and deliver data privacy training for employees and contractors at all levels, monitor completion rates and champion privacy awareness across the business.

Coordinate the deployment, day-to-day support and development of the Data Privacy Champions network.

Privacy risk register and mitigation

Assist with the maintenance and development of the data privacy risk register within the Groups ERM framework across all jurisdictions.
Identify and assess privacy risks, develop recommendations and proportionate mitigation plans and controls, deliver assigned mitigation actions, and track and report on progress, collaborating with the relevant business functions.
Policies and procedures

~ Assist with the review of data protection policies and procedures across all jurisdictions.

Prepare management information and reporting on the status of the privacy programme for the Data Privacy Manager and relevant stakeholders.

A minimum of four to six years of substantive, hands-on data privacy experience, ideally gained within a regulated financial services, insurance, or professional services environment.
Demonstrable expertise in UK GDPR and the Data Protection Act 2018, with solid working knowledge of EU GDPR and at least one of: US privacy law (GLBA, CCPA/CPRA, state privacy laws), or Australian privacy law (Privacy Act 1988, APPs, NDB scheme).
Demonstrable breadth across all disciplines of data privacy, rather than deep specialism in one or two areas
Practical experience of data subject rights at volume, including DSARs in a regulated sector context.
Experience of negotiating and reviewing Data Processing Agreements and international data transfer mechanisms.
Demonstrable experience of managing personal data breaches and advising on regulatory notification obligations.
Ability to work productively and visibly in a remote setting across time zones
Clear written English, including policies and guidance that a non-specialist can follow
Experience in the insurance or reinsurance sector, with familiarity with insurance-specific data processing activities (claims, underwriting, fraud prevention databases, actuarial processing).
Further certification such as CIPM, CIPT or Fellow of Information Privacy, or a relevant legal qualification
Knowledge of the NAIC Insurance Data Security Model Law and state insurance commissioner notification requirements.
Experience of working within a multi-jurisdictional privacy programme spanning EEA, UK, US and/or Australian operations simultaneously.
Familiarity with ISO 27701, ISO 27001, SOC 2 or NIST, and with working alongside an information security team.
Hands-on use of privacy management tooling, for example OneTrust or TrustArc, including consent management platforms.
Technical literacy sufficient to read a data flow or architecture diagram and understand what deletion means across databases, logs, archives and backups.
Interest in artificial intelligence governance and the emerging obligations under the EU AI Act.
Legal qualification (solicitor, barrister or overseas equivalent) or privacy law academic background.
Enstar offers best-in-class Medical, Dental, and Vision healthcare for single and family coverage.
~ Board-certified doctors and pediatricians are available virtually 24/7 for urgent care.
~ Access to Health Savings Account (HSA) or Flexible Spending Account (FSA).
~ Access to Employee Assistance Programs (EAP) for health and well-being.
~ Optional Pet & Home/Auto Insurance.
~ Wellness Reimbursement program (up to $600 annual reimbursement for wellness-related expenses, i.e., 401K retirement plan (company matches up to 6% of employee contribution).
~ The target base salary pay range for this role is $130,000-$145,000
*Target full-time equivalent base salary range is based on relevant market data. The actual salary offered will depend on applicable market data for the hiring location and the relevant candidates knowledge, skills/experience. We are a trusted global re/insurance group and the leading provider of retrospective solutions, with specialist underwriting capabilities. We help our clients manage risk, unlock capital and create the financial freedom to grow. With operations across the world’s major insurance hubs and a global network of close to 800 talented professionals, we bring expertise and fresh thinking to some of the industry’s biggest challenges.
For more information about Enstar, visit our website:
For more information about careers at Enstar, visit our LinkedIn Life page or visit our careers site
Supporting growth and career progression is key to how we engage our people - helping them to learn, grow and succeed at Enstar.
Training, Conferences & Seminars:

As a global organisation, we work with many professional bodies to provide access to training programmes, conferences, seminars and continuing professional development (CPD) opportunities.

~ Digital Learning Hub:

Our digital learning hub, LinkedIn Learning, offers a wide range of self-serve resources, including courses, videos, eBooks, and audio books, to help employees build news skills and deepen their knowledge.

We also invest in physical, mental and financial wellbeing initiatives for our employees. Beyond the workplace, we strive to make a positive influence in our communities and to continuously reduce our impact on the environment.
Enstar Inclusivity Policy:
We don’t discriminate on the basis of age, physical or mental disability, gender reassignment, marriage and civil partnership, pregnancy and carer status, race (including colour, nationality, and ethnic or national origin), religion or belief, sex and sexual orientation. Please let your Enstar Recruitment Partner know if you require any reasonable accommodation during the application process due to a disability to enable you to fully participate in our recruitment process.