Data Privacy Analyst - Regulatory Compliance

The company Small businesses move fast. Opportunities often don’t wait, and cash flow pressures can appear overnight. To keep going, and growing, SMEs need finance that’s as flexible and responsive as they are. That's why we built iwoca. Our smart technology, data science and five-star customer service ensures business owners can act with the speed, confidence and control they need, exactly when it's needed. We’ve already cleared the way for 100,000 businesses with more than £4 billion in funding. Our passionate team is driven to help even more SMEs succeed, through access to better finance and other services that make running a business easier. Our ultimate mission is to support one million SMEs in their defining moments, creating lasting impact for the communities and economies they drive. The team The Compliance team’s mission is to keep iwoca a safe and trusted lender for UK small businesses, and to make the compliant path the easy path for the teams we work with. We make sure iwoca meets its regulatory obligations, particularly the financial crime, sanctions and data protection requirements that apply across our suite of products and services. We are the second line of defence for the UK business. We advise the people building and running the business on what the rules require, set the policies and standards they work to, and test whether what happens in practice matches them. We work alongside the product teams so that each product meets its obligations and can grow. Data protection is central to what we do. We hold the data privacy function for the UK business and own how iwoca handles personal data end to end: the lawful basis for how customer, applicant and third-party data is used; data subject access requests and other individual rights; personal data breaches; retention and deletion; records of processing; marketing and consent; the privacy review of new products and features; and the governance of automated decisioning and AI tooling. How we work: We enable rather than block. The answer is rarely just “no” — it’s what it would take to get to yes, and what the firm is accepting if it goes ahead anyway. We go to the source. Positions are grounded in the actual rule, regulation or guidance, and we can show where they come from. We’re proportionate. Controls match the risk in front of us. We don’t build process for its own sake. We’re close to the business. We work directly with Tech, Data, Credit, Operations and Legal, and we want to be in the room early rather than at the end. The role As Data Privacy Analyst you will run iwoca’s day-to-day UK data protection work and help the business apply UK GDPR, the Data Protection Act 2018 and PECR in practice. Your primary focus will be the statutory core: data subject access requests, data protection impact assessments, legitimate interests assessments, personal data breaches and records of processing. The role is not only to run that work but to improve it. A significant part of the job is identifying where our privacy operations could be automated, supported by AI or otherwise improved, assessing what each option would take and what it would mean for compliance, and specifying it well enough for our Tech and Data teams to deliver. There is real room for the role to grow: as you build credibility, so does the scope, towards owning areas of the framework outright, leading on AI and automation governance, and taking a larger advisory remit across the business. You will report to the Data Privacy Manager and work closely with the Head of Compliance who also acts as iwoca’s DPO, so you will have experienced support on the harder judgement calls. This is a hands-on role and the work is visible — much of it goes to senior stakeholders or to the regulator. Impact and influence Individual rights and data breaches. Own data subject access requests from intake to response — scoping the search, applying exemptions and meeting the statutory deadline