Data Governance & Compliance Officer

Are you a data privacy specialist ready to step into a statutory Data Protection Officer (DPO) role? National Express Bus is looking for a Data Governance & Compliance Officer to act as the statutory DPO for West Midlands Bus Limited and WM Property Holdings Limited.

Reporting directly to the Managing Director, you will be the trusted advisor guiding our senior leadership and operational teams through governance, risk, and data security. Working closely with our legal and info sec teams, you will embed an effective accountability framework, manage ICO relations, and promote a strong culture of data protection across the business.

Where you will be based

This role is based at NX House (Birmingham) with a hybrid working arrangement.

What you will actually be doing

• Statutory DPO Leadership: Serve as statutory Data Protection Officer, guiding senior leaders and reporting data protection risks directly to the Managing Director and Data Protection Governance Board.
• Audits & Accountability Framework: Coordinate regular data protection audits across our company and third party processors, while maintaining records of processing (ROPA), DPIAs, and privacy notices.
• ICO Liaison & Governance: Act as the primary lead for the Information Commissioner’s Office (ICO), managing registrations, regulatory inquiries, and investigations.
• Contract & Processor Reviews: Draft, review, and negotiate Data Processing Addenda with internal legal teams and external processors in the UK, EU, and beyond.
• Rights & Incident Management: Manage Data Subject Access Requests (DSARs) and Freedom of Information Act (FOI) requests, while working with security teams on incident responses and breach remediation.
• Training & Culture: Develop and deliver business wide data protection training to drive continuous improvement and awareness across all departments.

W hat we need from you

• Certified Expertise: At least one recognized data protection certification (e.g. BCS Practitioner Certificate in Data Protection, CIPM, or Data Protection & Information Governance Practitioner Level 4).
• Hands On Experience: Minimum 2 years of data protection experience in a compliance, legal, audit, or risk role, ideally within a B2C service industry.
• Regulatory Track Record: Proven experience liaising directly with the ICO, carrying out DPIAs, and handling DSARs and FOI requests.
• Contracting Know How: Practical experience drafting and negotiating Data Processing Addenda across UK, EU, and international jurisdictions.
• Strong Communicator: Excellent influence, administration, and communication skills to deal with complex, changing demands across different business areas.

The perks of joining us

We look after our people with benefits that make a genuine difference:

• Free Travel: Free travel right across the National Express network for you.
• Peace of Mind: Solid company pension scheme and life assurance.
• Wellbeing Support: Access to our Employee Assistance Programme and a private online GP service.

Apply now