Data Rights Manager

About DUAL

Working across 21 countries, DUAL has built a reputation as a specialist underwriting group and the market of choice for insurance intermediaries around the world. That’s how we have become one of the world’s largest international underwriting agencies (or MGAs) with US$3.4bn GWP.

DUAL is part of Howden, a leading global insurance group with employee ownership at its heart. Founded in 1994, it provides insurance, reinsurance and underwriting services to clients ranging from private individuals to the largest multinational companies. The Group operates in 57 countries, employs over 24,000 people and manages premiums totalling US$50bn on behalf of its clients.

The DSAR Process Manager will own the end-to-end administration of Data Subject Access Requests across Personal Lines. Acting as the central referral point and knowledge hub, you’ll make sure requests are identified, validated, managed and completed securely, accurately and within statutory timescales, while building a clear, efficient and sustainable first-line process.

What you'll be doing

• Own the end-to-end DSAR process for Personal Lines, maintaining accurate case files, the central tracker and clear audit trails from receipt through to closure.
• Validate requests by completing identity and authority checks, clarifying scope where needed and calculating and monitoring statutory deadlines.
• Triage cases according to complexity, risk, age and dependencies, escalating deadlines, high-risk decisions and potentially unfounded or excessive requests appropriately.
• Coordinate searches across relevant business areas, systems, claims handlers, third-party administrators and data processors, setting clear expectations and internal deadlines.
• Review high-volume records including claim files, correspondence, reports, images and call recordings to identify personal data that should be disclosed.
• Apply accurate and consistent redactions and exemptions, protecting third-party information and escalating complex or novel decisions to the Head of Data Protection and DPO.
• Prepare legally compliant responses covering Article 15 UK GDPR requirements and arrange independent four-eyes assurance before information is released.
• Deliver disclosures securely, managing access permissions, passwords and proof of delivery, and resolving any post-response access issues.
• Maintain complete records of searches, decisions, exemptions, extensions and correspondence, ensuring cases are accurate and auditable.
• Develop practical DSAR workflows, procedures, templates, checklists and controls that create a consistent and sustainable approach across Personal Lines.
• Produce management information covering DSAR volumes, response times and bottlenecks, using insight to improve performance and manage risk.
• Improve DSAR capability through employee and third-party training, better data mapping and appropriate automation while maintaining human oversight and judgement.

Who we're looking for

• Proven experience managing Data Subject Access Requests end-to-end in line with UK GDPR and the Data Protection Act 2018.
• Strong working knowledge of Article 15, statutory timescales, identity and authority checks, third-party rights and relevant exemptions.
• Experience reviewing and redacting high-volume, sensitive or complex records, with evidence of accurate and consistent decision-making.
• Strong case-management experience, including managing fluctuating workloads, statutory deadlines, audit trails and competing priorities.
• Experience coordinating multiple teams and third parties, following up incomplete information and escalating risks or delays appropriately.
• Strong written communication skills, with experience explaining data protection requirements clearly to customers and non-specialists.
• Experience working with Microsoft 365, Adobe Acrobat Pro and secure file-sharing tools.
• Experience within motor insurance, claims or another regulated financial services environment would be valuable, particularly where third-party administrators or outsourced providers are involved.

Qualifications

• A recognised data protection or information governance qualification is desirable.
• Practical knowledge of the UK GDPR and Data Protection Act 2018 gained through relevant professional experience.
• Strong written and verbal English, with the ability to draft clear and accurate customer correspondence.
• Good numeracy, including the ability to monitor volumes, deadlines, response times and management information.

What do we offer in return?

A career that you define.

Of course, we offer a competitive range of rewards and benefits to support you, but we know you expect all that.

What you might not expect is a job where everyone has a voice, where volunteering in the community is part of the day job, and where everyone is encouraged to play a part towards our sustainability goals. We want people who want to make a difference - not just in the workplace, but in the industry and in the wider community.

Our culture: people first

Our core values dictate how we live and work. We’re a group with independence and people at its heart - and a home for talent with a unique culture: the biggest small company in the world.

Being a people-first business has always been central to who we are. Our vision was to create an independent organisation with a distinctive culture that would survive and thrive through the people who shape it. Finding the most talented and entrepreneurial individuals to join the group has been, and will continue to be, key to our success.

Diversity and inclusion

At DUAL, our people are our greatest strength. We are committed to building an open and inclusive culture where everyone feels trusted and that they belong. We work to ensure all candidates, employees, clients and business partners are treated with fairness and respect.

We want every candidate to be able to bring their best to the recruitment process, so if you require reasonable accommodation at any stage, please let us know and we will work with you to provide appropriate support.