Senior Data Protection & Regulatory Compliance Manager

About this role

About Zymix

Zymix is the definitive lifestyle ecosystem for the digital generation-bridging the gap between social connection and real-world experience. Transcending the "Super App" model, Zymix fuses hyper-social interaction with a seamless service layer, empowering global youth to integrate a wide range of services beyond social networking, discover Al-curated experiences, and unlock essential services in one fluid motion. We are redefining the platform economy by prioritising authenticity, community, and friction-free living.

ZYMIX is seeking an experienced Senior Data Protection & Regulatory Compliance Manager to lead and strengthen its data protection, privacy and digital-platform compliance framework. The role will primarily lead ZYMIX’s data protection and privacy compliance framework, while also providing senior regulatory compliance support in relation to Online Safety, safeguarding and wider digital-platform regulation.

Working closely with Legal, Product, Technology, Security, Operations and senior management, the successful candidate will provide independent advice, monitoring and challenge while helping the business translate regulatory requirements into practical and proportionate controls.

Roles & responsibilities...

Data Protection & Privacy

• Act as the Company’s Data Protection Officer where formally appointed.
• Monitor compliance with the UK GDPR, Data Protection Act 2018, PECR and other applicable data protection and privacy requirements.
• Provide independent advice to senior management and business teams on data protection obligations and privacy risk.
• Advise on and monitor Data Protection Impact Assessments (DPIAs), including higher-risk or novel processing activities.
• Maintain oversight of the Company’s data protection governance framework, including: Records of Processing Activities, lawful basis assessments, privacy notices and transparency requirements, consent management, data retention and deletion, data subject rights, data sharing arrangements, international data transfers, data processing agreements, privacy-related vendor assessments.
• Advise on the processing of special-category data, children’s data and other higher-risk personal data.
• Provide privacy advice in relation to new products, technologies and processing activities.
• Monitor the effectiveness of privacy-by-design and data-minimisation measures implemented by relevant business teams.
• Maintain oversight of personal data breach procedures and advise on notification and escalation requirements.
• Act as a point of contact with the Information Commissioner’s Office in relation to data protection matters.
• Act as a point of contact for individuals exercising their rights under applicable data protection legislation.

Product Privacy & Technology Compliance

• Participate in relevant product and technology governance processes to provide privacy and regulatory advice at an early stage of product development.
• Review proposed new products, features and material product changes and identify relevant privacy and regulatory risks.
• Advise Product and Technology teams on privacy-by-design and data-minimisation requirements.
• Review and challenge proposed processing activities where appropriate.
• Advise on privacy and regulatory considerations relating to areas including: age assurance and age estimation, location and proximity features, messaging and user-to-user interactions, profiling and personalisation, recommender systems, artificial intelligence and automated technologies, health and wellbeing data, identity verification, fraud-prevention technologies, analytics and advertising technologies.
• Monitor whether agreed privacy and compliance measures are implemented appropriately by relevant business owners.
• Escalate material privacy or regulatory concerns where appropriate.

Online Safety

• Provide senior compliance advice in relation to the UK’s Online Safety Act and applicable Ofcom Codes of Practice, guidance and regulatory requirements.
• Support and monitor the Company’s Online Safety compliance framework.
• Advise on the preparation, review and maintenance of relevant Online Safety risk assessments and compliance records.
• Review and challenge Online Safety risk assessments where appropriate.
• Advise relevant business owners on regulatory requirements relating to: illegal content, user-generated content, harmful user behaviour, user reporting and complaints, content moderation, blocking and user controls, age assurance, protection of children and younger users.
• Monitor relevant Ofcom regulatory developments and advise the business on their impact.
• Monitor the implementation and effectiveness of Online Safety compliance measures owned by relevant Product, Technology or Operations teams.
• Support appropriate escalation of material Online Safety risks to senior management.

Safeguarding

• Provide compliance and governance advice in relation to ZYMIX’s safeguarding framework.
• Advise on safeguarding risks arising from user-to-user interaction, vulnerable users and higher-risk platform features.
• Review safeguarding policies, escalation procedures and governance arrangements.
• Advise relevant operational teams on the compliance and safeguarding aspects of serious user-safety incidents.
• Monitor recurring safeguarding issues and identify potential systemic or regulatory concerns.
• Support the development of appropriate safeguarding training and staff awareness.
• Escalate material safeguarding concerns to relevant senior management where appropriate.

Compliance Governance

• Support the development and maintenance of a proportionate regulatory compliance framework for a consumer technology platform.
• Maintain oversight of relevant compliance risk registers, policies, monitoring programmes and compliance records.
• Conduct periodic compliance reviews and thematic assessments.
• Identify material compliance gaps and provide recommendations to relevant business owners and senior management.
• Track relevant regulatory developments and assess their potential impact on ZYMIX.
• Advise relevant teams on regulatory change and monitor resulting implementation actions.
• Prepare compliance reporting for senior management and, where appropriate, the Board.
• Escalate material regulatory or compliance risks independently and promptly.
• Maintain appropriate evidence demonstrating the Company’s compliance governance and monitoring activities.

Third-Party Privacy & Compliance

• Provide privacy and regulatory advice in relation to higher-risk third-party service providers.
• Review privacy and compliance due diligence conducted in relation to relevant vendors.
• Review data processing agreements, data-sharing arrangements and international data transfer mechanisms.
• Work with Security, Technology, Procurement and Legal teams where suppliers process personal data or provide higher-risk technology services.
• Monitor material privacy and compliance risks associated with key third-party providers.
• Recommend appropriate contractual, technical or organisational safeguards where required.

Policies, Training & Compliance Culture

• Advise on the development and maintenance of core privacy and regulatory compliance policies.
• Review policies periodically to ensure they remain aligned with applicable regulatory requirements.
• Develop and deliver data protection, privacy, Online Safety and safeguarding training and awareness programmes.
• Provide practical guidance to Product, Technology, Operations and other relevant teams.
• Promote early escalation of privacy, safety and regulatory issues.
• Support a culture in which regulatory requirements are considered as part of product and operational decision-making.

About you

• Significant senior-level experience in data protection, privacy or technology regulatory compliance.
• Strong practical knowledge of the UK GDPR, Data Protection Act 2018 and PECR.